agentwallet-mcp 1.13.6 → 1.13.7

package/build/index.js

@@ -579,7 +579,7 @@ function resolveChainId(network) {
 const AddressSchema = z.string().regex(/^(0x[a-fA-F0-9]{40}|[1-9A-HJ-NP-Za-km-z]{32,44})$/, 'Must be a 0x-prefixed 40-hex EVM address or a base58 Solana address');
 const server = new McpServer({
     name: 'agentwallet',
-    version: '1.13.6',
+    version: '1.13.7',
 }, {
     instructions: `AgentWallet gives AI agents their own blockchain wallets. ${anyLocalMode()
         ? 'This server runs in LOCAL (self-custody) mode: the operator supplied the key, signing happens in this process, and the only spend guards are the AGENTWALLET_MAX_TX_* environment caps. There is no server-side pause, daily limit or approval email; pause_wallet, unpause_wallet and delete_wallet are refused.'
@@ -1712,10 +1712,17 @@ server.tool('get_chains', 'List all supported chains (EVM + Solana) with their c
 });
 // ─── Tool: delete_wallet ─────────────────────────────────────────
 server.tool('delete_wallet', 'Delete (soft-delete) a wallet. The wallet will no longer appear in listings ' +
-    'and cannot be used for transactions.', {
+    'and cannot be used for transactions. The wallet is read first and the delete names its address, ' +
+    'so a wallet that cannot be read is never deleted.', {
     wallet_id: z.number().int().describe('Wallet ID to delete'),
 }, async ({ wallet_id }) => {
-    const data = await api(`/wallets/${wallet_id}`, 'DELETE');
+    // The server asks the caller to name the wallet it means to delete, so a
+    // leaked API key alone cannot destroy a key (2026-10-04 audit, server 1.7.1).
+    const w = (await api(`/wallets/${wallet_id}`, 'GET', undefined, { 'X-AGW-SKIP-X402': 'true' }));
+    const address = String(w?.address || w?.wallet_address || '');
+    if (!address)
+        throw new Error(`Wallet ${wallet_id} could not be read (${serverText(w?.error) || 'no address in the response'}); nothing was deleted.`);
+    const data = await api(`/wallets/${wallet_id}`, 'DELETE', { confirm: address });
     return jsonResponse(data);
 });
 // ─── Tool: create_paywall ────────────────────────────────────────

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "agentwallet-mcp",
   "mcpName": "io.github.hifriendbot/agentwallet",
-  "version": "1.13.6",
+  "version": "1.13.7",
   "description": "MCP server for AgentWallet: self-custody local signing on EVM and Solana, or hosted wallets. Sign, broadcast, pay x402 invoices, and accept x402 payments.",
   "type": "module",
   "main": "build/index.js",
@@ -16,7 +16,7 @@
   "scripts": {
     "build": "tsc",
     "start": "node build/index.js",
-    "test": "node test/x402-payment.test.mjs && node test/eip3009.test.mjs && node test/permit2-risk.test.mjs && node test/token-cap.test.mjs && node test/spl-cap.test.mjs && node test/unknown-decimals-cap.test.mjs && node test/decimals-range-cap.test.mjs && node test/local-mode.test.mjs && node test/ssrf-guard.test.mjs && node test/x402-policy.test.mjs && node test/local-guard-shape.test.mjs && node test/allowance-total-cap.test.mjs && node test/autopay-scheme.test.mjs && node test/spl-recipient-guard.test.mjs && node test/approval-binding.test.mjs && node test/ata-rent-size.test.mjs && node test/final-url-guard.test.mjs && node test/audit-1135.test.mjs && node test/local-no-autopay.test.mjs && node test/audit-1136.test.mjs",
+    "test": "node test/x402-payment.test.mjs && node test/eip3009.test.mjs && node test/permit2-risk.test.mjs && node test/token-cap.test.mjs && node test/spl-cap.test.mjs && node test/unknown-decimals-cap.test.mjs && node test/decimals-range-cap.test.mjs && node test/local-mode.test.mjs && node test/ssrf-guard.test.mjs && node test/x402-policy.test.mjs && node test/local-guard-shape.test.mjs && node test/allowance-total-cap.test.mjs && node test/autopay-scheme.test.mjs && node test/spl-recipient-guard.test.mjs && node test/approval-binding.test.mjs && node test/ata-rent-size.test.mjs && node test/final-url-guard.test.mjs && node test/audit-1135.test.mjs && node test/local-no-autopay.test.mjs && node test/audit-1136.test.mjs && node test/delete-confirm.test.mjs",
     "prepublishOnly": "npm run build"
   },
   "keywords": [