agentwallet-mcp 1.13.9 → 1.13.11

package/README.md

@@ -37,9 +37,9 @@ Run `wallet_mode` at any time and the server will tell you which one you are in,
 }
 ```
 
-Use `AGENTWALLET_KEYFILE=/path/to/key` instead if you would rather keep the key out of your shell config. The key is read once, never written to disk, never logged, and never included in an error message.
+Use `AGENTWALLET_KEYFILE=/path/to/key` instead if you would rather keep the key out of your shell config (one or the other: the server refuses to start when both are set). The key is read once, never written to disk, never logged, and never included in an error message.
 
-`AGENTWALLET_RPC_<chainId>` (or `AGENTWALLET_RPC_URL` for all chains) points at an endpoint you trust. Without it a public RPC is used, and a public RPC can see which addresses you ask about.
+`AGENTWALLET_RPC_<chainId>` (or `AGENTWALLET_RPC_URL` for all chains) points at an endpoint you trust (https; plain http only on localhost). Without it a public RPC is used, and a public RPC can see which addresses you ask about. Decimals for a token outside the registry come from that RPC and are accepted only up to 18; pin anything else with `AGENTWALLET_TOKEN_DECIMALS`.
 
 `AGENTWALLET_MAX_TX_NATIVE` is a per-transaction ceiling in native units (ETH, MATIC and so on). In hosted mode the server enforces limits; in local mode there is no server, so these guards are the only ones there are. Set them.
 
@@ -69,7 +69,7 @@ Local signing uses [viem](https://viem.sh) for EVM and `@solana/web3.js` for Sol
 `npm audit` reports no advisories as of 1.13.5; the overrides in package.json keep two advisories under `@solana/web3.js`'s jayson closed. Earlier releases carried advisories inside `@modelcontextprotocol/sdk`'s HTTP transport dependencies. This server speaks stdio, so that code never loads, and the SDK is not something this package can patch. Run the audit yourself. Publishing a tree you can inspect is the point.
 
 <p align="center">
-  <img src="assets/demo.svg" alt="AgentWallet demo, AI agent pays x402 invoice automatically" width="800">
+  <img src="https://raw.githubusercontent.com/hifriendbot/agentwallet-mcp/main/assets/demo.svg" alt="AgentWallet demo, AI agent pays x402 invoice automatically" width="800">
 </p>
 
 ## Features
@@ -118,7 +118,7 @@ Add to your config:
 }
 ```
 
-> `AGENTWALLET_WALLET_ID` is optional. Set it to enable x402 auto-pay: when you exceed the free tier without a credit card, the MCP server automatically pays for operations with USDC from this wallet.
+> `AGENTWALLET_WALLET_ID` is optional. Set it to enable x402 auto-pay: when you exceed the free tier without a credit card, the MCP server automatically pays for operations with USDC from this wallet. Only the metered routes (creating a wallet, signing, sending) are paid this way, at most `AGENTWALLET_MAX_AUTOPAY_PER_HOUR` times an hour (default 20), and every automatic payment is reported in the tool result under `autopay_payment`. A 402 on any other route is reported, never paid.
 >
 > **Auto-pay safety cap.** `AGENTWALLET_MAX_AUTOPAY` (optional, default `1`) is the most one x402 payment may authorize, in stablecoin units: `1` means one dollar. It prices registry stablecoins only (USDC, USDT, USDbC, DAI on the supported chains, USDC and USDT on Solana). A requirement in the chain's native asset or in any other token is refused, because "1" measured in ETH is a few thousand dollars; list such assets in `AGENTWALLET_AUTOPAY_ASSETS` (comma-separated addresses or mints, or the word `native`) to allow them, and the cap then applies in that asset's own units. Any requirement above the cap is rejected instead of paid, so a malformed or tampered payment requirement cannot drain the wallet. This automatic path settles `exact` requirements only; an `upto` offer from the API is refused before any wallet call, because paying a usage maximum upfront is not what the offer means (use `pay_x402`, which signs a Permit2 authorization for it). The cap is the operator's ceiling: a `max_payment` argument can lower it for one call but never raise it. Raise the variable itself if you genuinely need larger automatic payments (for example `"5"` for up to 5 USDC per call).
 
@@ -330,6 +330,7 @@ Which guards apply depends on who holds the key.
 **Local mode** (you hold the key): there is no server in the signing path, so the server-side limits and pause above cannot see or stop a locally signed transaction, and nobody (including us) can freeze a local wallet. Your protection is the per-transaction caps enforced inside your own process before anything is signed. Set them before you fund the wallet; an unset cap means no limit.
 
 - `AGENTWALLET_MAX_TX_NATIVE`: ceiling per transaction in native units (ETH, MATIC, and so on)
+- `AGENTWALLET_MAX_FEE_NATIVE`: the most one transaction may burn in fees, gas x max fee per gas, in native units (default `0.01`). The value cap alone did not bound fees: a node answering an absurd tip or gas estimate could take the whole balance as priority fee on a cap-compliant transfer. Caller-supplied `gas_limit` / `max_fee` / `priority_fee` are honoured and then bounded by this cap
 - `AGENTWALLET_MAX_TX_TOKEN`: ceiling per ERC-20 transfer or approval, in human units of the token
 - `AGENTWALLET_ALLOW_UNKNOWN_TOKEN_CALLS`: set to `1` to let calldata the token cap cannot price reach a token contract or Permit2 (refused by default while the cap is set)
 - `AGENTWALLET_TOKEN_DECIMALS`: pin decimals for tokens outside the registry (`8453:0x<token>=6,<mint>=9`); a pin is used for amounts and caps instead of asking the RPC
@@ -337,8 +338,10 @@ Which guards apply depends on who holds the key.
 - `AGENTWALLET_MAX_AUTOPAY`: ceiling per x402 auto-payment in stablecoin units (default `1`); `AGENTWALLET_AUTOPAY_ASSETS` opts native or non-stable assets in; `AGENTWALLET_X402_MAX_TIMEOUT` bounds how long a signed authorization stays valid (default 3600 seconds)
 - `AGENTWALLET_SOLANA_RPC_<chainId>` (or `AGENTWALLET_SOLANA_RPC` for all clusters): the RPC's genesis hash is checked against the chain id before anything is sent, and an EVM RPC's `eth_chainId` likewise, so one URL cannot silently serve a different network than the one requested
 - `AGENTWALLET_TOKEN_RISK=0`: skip the GoPlus lookup `approve_token` performs (a third-party call that reveals which token you are about to approve)
+- `AGENTWALLET_CHAIN_ID`: the EVM chain used when a call names none (default 8453)
+- `AGENTWALLET_LEGACY_PAYWALL_ORIGINS`: comma-separated https origins whose legacy-shaped 402 may be settled by an on-chain transfer proved by hash; every other host gets a signed authorization
 
-All cap variables are validated at startup; a typo stops the server rather than reading as "no limit". `wallet_mode` reports every guard, including the token cap and whether unknown token calls are allowed. Node.js 22.19 or newer is required.
+Every `AGENTWALLET_*` variable is validated at startup: a malformed cap stops the server rather than reading as "no limit", and an unrecognised name (a misspelled cap) stops it too. `wallet_mode` reports every guard with its parsed value. Tool arguments are strict: an unknown argument name (a typo in `max_payment`) is an error, never silently ignored. `pay_x402` signs one live authorization per resource; a second, different requirement for the same resource is refused until the first expires unless `fresh_authorization` is passed. Node.js 22.19 or newer is required.
 
 **Either mode**, for x402 paywalls you run through the hosted API:
 

package/build/index.js

@@ -27,15 +27,35 @@ function anyLocalMode() {
     return isLocalMode() || isSolanaLocalMode();
 }
 // ─── Configuration ──────────────────────────────────────────────
-const API_BASE = process.env.AGENTWALLET_API_URL || 'https://hifriendbot.com/wp-json/agentwallet/v1';
-const API_USER = process.env.AGENTWALLET_USER || '';
-const API_PASS = process.env.AGENTWALLET_PASS || ''; // WordPress application password
-const X402_WALLET_ID = process.env.AGENTWALLET_WALLET_ID || ''; // Wallet ID for x402 auto-pay
-const DASHBOARD_URL = process.env.AGENTWALLET_DASHBOARD_URL || 'https://hifriendbot.com/wallet/';
+const API_BASE = (process.env.AGENTWALLET_API_URL || 'https://hifriendbot.com/wp-json/agentwallet/v1').trim().replace(/\/+$/, '');
+const API_USER = (process.env.AGENTWALLET_USER || '').trim();
+const API_PASS = (process.env.AGENTWALLET_PASS || '').trim(); // WordPress application password
+const X402_WALLET_ID = (process.env.AGENTWALLET_WALLET_ID || '').trim(); // Wallet ID for x402 auto-pay
+const DASHBOARD_URL = (process.env.AGENTWALLET_DASHBOARD_URL || 'https://hifriendbot.com/wallet/').trim();
 // Basic credentials and 402 auto-pay decisions ride on this URL, so it must be
-// https, or loopback for a local test server. Anything else is refused at start.
-if (/^http:/i.test(API_BASE) && !/^http:\/\/(localhost|127\.0\.0\.1|\[::1\])(:\d+)?(\/|$)/i.test(API_BASE)) {
-    throw new Error(`AGENTWALLET_API_URL must be https (got ${API_BASE}); plain http is allowed only for localhost.`);
+// https, or loopback for a local test server. The value is parsed, not
+// pattern-matched: a leading space defeated the old regex while fetch still
+// sent the credentials in plaintext (2026-10-04 round 4).
+{
+    let u;
+    try {
+        u = new URL(API_BASE);
+    }
+    catch {
+        throw new Error(`AGENTWALLET_API_URL is not a URL: "${API_BASE}".`);
+    }
+    const loopback = u.hostname === 'localhost' || u.hostname === '127.0.0.1' || u.hostname === '[::1]';
+    if (u.username || u.password)
+        throw new Error('AGENTWALLET_API_URL must not carry credentials; use AGENTWALLET_USER and AGENTWALLET_PASS.');
+    if (u.protocol !== 'https:' && !(u.protocol === 'http:' && loopback)) {
+        throw new Error(`AGENTWALLET_API_URL must be https (got ${u.protocol}//${u.host}); plain http is allowed only for localhost.`);
+    }
+    if (API_USER.includes(':'))
+        throw new Error('AGENTWALLET_USER must not contain ":" (the Basic auth separator).');
+    if ((API_USER === '') !== (API_PASS === ''))
+        console.error('AgentWallet MCP: warning, only one of AGENTWALLET_USER / AGENTWALLET_PASS is set; hosted calls will carry no credentials.');
+    if (X402_WALLET_ID && !/^\d+$/.test(X402_WALLET_ID))
+        throw new Error(`AGENTWALLET_WALLET_ID must be a wallet id (digits only), got "${X402_WALLET_ID}".`);
 }
 /* ── Local-mode routing ──────────────────────────────────────────
    Translates the REST paths the tools already speak into in-process signing
@@ -99,7 +119,12 @@ async function routeLocally(path, method, body) {
             throw new Error(`Local mode expects an EVM address, got "${to}".`);
         }
         const hasData = data && data !== '0x';
-        return localSend(chainId, to, value, hasData ? data : undefined);
+        const fees = {
+            ...(body?.gas_limit ? { gas: String(body.gas_limit) } : {}),
+            ...(body?.max_fee ? { maxFeePerGas: String(body.max_fee) } : {}),
+            ...(body?.priority_fee ? { maxPriorityFeePerGas: String(body.priority_fee) } : {}),
+        };
+        return localSend(chainId, to, value, hasData ? data : undefined, fees);
     }
     // POST /wallets/{id}/x402/authorize  (x402 "exact": EIP-3009 authorization, signed here, broadcast by nobody)
     if (method === 'POST' && /^\/wallets\/[^/]*\/x402\/authorize$/.test(rawPath)) {
@@ -288,7 +313,7 @@ async function api(path, method = 'GET', body, extraHeaders) {
 function autopayRouteAllowed(path, method) {
     return method === 'POST' && /^\/wallets(\/\d+\/(sign|send))?(\?|$)/.test(path);
 }
-const AUTOPAY_PER_HOUR = (() => { const n = Number(process.env.AGENTWALLET_MAX_AUTOPAY_PER_HOUR ?? '20'); return Number.isInteger(n) && n >= 0 ? n : 20; })();
+const AUTOPAY_PER_HOUR = (() => { const raw = (process.env.AGENTWALLET_MAX_AUTOPAY_PER_HOUR ?? '20').trim(); return /^\d+$/.test(raw) ? Number(raw) : 20; })(); // validated in validateGuardEnv
 const autopayLog = [];
 /** Read a body no larger than maxChars, refusing early on a declared length and mid-stream on a real one. */
 async function readBounded(res, maxChars, who) {
@@ -552,7 +577,8 @@ const PAYWALL_MAX_CHARS = 4 * 1024 * 1024; // a paywall's answer, before and aft
    and the client's log (2026-10-04 audit). */
 function redactRpcSecrets(err) {
     const e = err;
-    let msg = e?.shortMessage ? [e.shortMessage, e.details].filter(Boolean).join(' ') : String(e?.message ?? err);
+    // A rejection that is not an Error (web3.js rejects with a raw {InstructionError} object) used to read "[object Object]".
+    let msg = e?.shortMessage ? [e.shortMessage, e.details].filter(Boolean).join(' ') : (e?.message !== undefined ? String(e.message) : (err && typeof err === 'object' ? JSON.stringify(err) : String(err)));
     msg = msg.split(/\r?\n/).filter(l => !/^\s*(URL|Request body|Request Arguments|Raw Call Arguments)\s*:/i.test(l)).join('\n').trim();
     return msg.replace(/[a-z][a-z0-9+.-]*:\/\/[^\s"'<>)]+/gi, (u) => redactUrl(u)); // brackets stay in: IPv6 hosts
 }
@@ -582,7 +608,7 @@ async function verifiedDecimals(chainId, token, given) {
 /** Cap variables are read at send time; a typo must fail at startup, not after funding. */
 function validateGuardEnv() {
     parseDecimalPins(process.env.AGENTWALLET_TOKEN_DECIMALS); // throws on a malformed pin
-    for (const name of ['AGENTWALLET_MAX_TX_NATIVE', 'AGENTWALLET_MAX_TX_TOKEN', 'AGENTWALLET_MAX_TX_SOL', 'AGENTWALLET_MAX_AUTOPAY']) {
+    for (const name of ['AGENTWALLET_MAX_TX_NATIVE', 'AGENTWALLET_MAX_TX_TOKEN', 'AGENTWALLET_MAX_TX_SOL', 'AGENTWALLET_MAX_AUTOPAY', 'AGENTWALLET_MAX_FEE_NATIVE']) {
         const raw = process.env[name];
         const v = (raw || '').trim();
         // Set but blank is a typo, not "no cap": refuse to start rather than run uncapped.
@@ -600,6 +626,48 @@ function validateGuardEnv() {
     if (t && (!/^\d+$/.test(t) || Number(t) < 60 || Number(t) > 31_536_000)) {
         throw new Error(`AGENTWALLET_X402_MAX_TIMEOUT must be a whole number of seconds between 60 and 31536000, got "${t}".`);
     }
+    const perHour = process.env.AGENTWALLET_MAX_AUTOPAY_PER_HOUR;
+    if (perHour !== undefined && !/^\d+$/.test(perHour.trim())) {
+        throw new Error(`AGENTWALLET_MAX_AUTOPAY_PER_HOUR must be a whole number (0 disables internal auto-pay), got "${perHour}".`);
+    }
+    for (const o of (process.env.AGENTWALLET_LEGACY_PAYWALL_ORIGINS || '').split(',').map(x => x.trim()).filter(Boolean)) {
+        let u = null;
+        try {
+            u = new URL(o);
+        }
+        catch {
+            u = null;
+        }
+        if (!u || u.protocol !== 'https:' || u.origin !== o.replace(/\/+$/, '')) {
+            throw new Error(`AGENTWALLET_LEGACY_PAYWALL_ORIGINS entry "${o}" is not an https origin (scheme and host only, like https://shop.example).`);
+        }
+    }
+    // Two sources for one key family is ambiguous; refuse rather than pick one silently.
+    if ((process.env.AGENTWALLET_PRIVATE_KEY || '').trim() && (process.env.AGENTWALLET_KEYFILE || '').trim()) {
+        throw new Error('Both AGENTWALLET_PRIVATE_KEY and AGENTWALLET_KEYFILE are set; keep one.');
+    }
+    if ((process.env.AGENTWALLET_SOLANA_KEY || '').trim() && (process.env.AGENTWALLET_SOLANA_KEYFILE || '').trim()) {
+        throw new Error('Both AGENTWALLET_SOLANA_KEY and AGENTWALLET_SOLANA_KEYFILE are set; keep one.');
+    }
+    // An unrecognised AGENTWALLET_* name is almost always a misspelled cap, which
+    // would run uncapped without a word (round 4). Refuse to start instead.
+    for (const k of Object.keys(process.env)) {
+        if (!k.startsWith('AGENTWALLET_'))
+            continue;
+        if (KNOWN_ENV.has(k) || /^AGENTWALLET_(RPC|SOLANA_RPC)_\d+$/.test(k))
+            continue;
+        throw new Error(`Unknown environment variable ${k}. AgentWallet refuses to start on an unrecognised AGENTWALLET_* name so that a misspelled cap cannot run uncapped. Known names: ${[...KNOWN_ENV].join(', ')}, AGENTWALLET_RPC_<chainId>, AGENTWALLET_SOLANA_RPC_<chainId>.`);
+    }
+}
+const KNOWN_ENV = new Set(["AGENTWALLET_ALLOW_UNKNOWN_TOKEN_CALLS", "AGENTWALLET_API_URL", "AGENTWALLET_APPROVALS", "AGENTWALLET_AUTOPAY_ASSETS", "AGENTWALLET_CHAIN_ID", "AGENTWALLET_DASHBOARD_URL", "AGENTWALLET_KEYFILE", "AGENTWALLET_LEGACY_PAYWALL_ORIGINS", "AGENTWALLET_MAX_AUTOPAY", "AGENTWALLET_MAX_AUTOPAY_PER_HOUR", "AGENTWALLET_MAX_FEE_NATIVE", "AGENTWALLET_MAX_TX_NATIVE", "AGENTWALLET_MAX_TX_SOL", "AGENTWALLET_MAX_TX_TOKEN", "AGENTWALLET_PASS", "AGENTWALLET_PERMIT2_AUTO_APPROVE", "AGENTWALLET_PRIVATE_KEY", "AGENTWALLET_RPC_URL", "AGENTWALLET_SOLANA_KEY", "AGENTWALLET_SOLANA_KEYFILE", "AGENTWALLET_SOLANA_RPC", "AGENTWALLET_TOKEN_DECIMALS", "AGENTWALLET_TOKEN_RISK", "AGENTWALLET_USER", "AGENTWALLET_WALLET_ID", "AGENTWALLET_X402_MAX_TIMEOUT"]);
+/**
+ * Register a tool whose arguments are strict: an unknown key (max_payemnt for
+ * max_payment) is an error that names it, not a silently dropped guard. The
+ * advertised schema always said additionalProperties: false; now the runtime
+ * agrees (round 4).
+ */
+function tool(name, description, shape, cb) {
+    return server.registerTool(name, { description, inputSchema: z.object(shape).strict() }, cb);
 }
 // ─── EVM Helpers ──────────────────────────────────────────────────
 /**
@@ -679,10 +747,10 @@ function resolveChainId(network) {
 const AddressSchema = z.string().regex(/^(0x[a-fA-F0-9]{40}|[1-9A-HJ-NP-Za-km-z]{32,44})$/, 'Must be a 0x-prefixed 40-hex EVM address or a base58 Solana address');
 const server = new McpServer({
     name: 'agentwallet',
-    version: '1.13.9',
+    version: '1.13.11',
 }, {
     instructions: `AgentWallet gives AI agents their own blockchain wallets. ${anyLocalMode()
-        ? 'This server runs in LOCAL (self-custody) mode: the operator supplied the key, signing happens in this process, and the only spend guards are the AGENTWALLET_MAX_TX_* environment caps. There is no server-side pause, daily limit or approval email; pause_wallet, unpause_wallet and delete_wallet are refused.'
+        ? 'This server runs in LOCAL (self-custody) mode: the operator supplied the key, signing happens in this process, and the only spend guards are the environment caps (AGENTWALLET_MAX_TX_NATIVE / _TOKEN / _SOL per transaction, AGENTWALLET_MAX_AUTOPAY and AGENTWALLET_AUTOPAY_ASSETS for x402, AGENTWALLET_X402_MAX_TIMEOUT for authorization windows). There is no server-side pause, daily limit or approval email; pause_wallet, unpause_wallet and delete_wallet are refused.'
         : 'Private keys are encrypted server-side and never exposed: agents sign and broadcast transactions without ever touching raw keys.'}
 
 ## Getting Started
@@ -738,9 +806,7 @@ Create paywalls to charge other agents for accessing your resources:
 
 ## Wallet Security
 - ${anyLocalMode() ? 'pause_wallet does not exist in local mode: revoke the key (rotate it and move the funds) if the process is compromised.' : 'Use pause_wallet to immediately freeze a wallet if compromised. No transactions can be signed while paused.'}
-- Use unpause_wallet to resume operations.
-- Use delete_wallet to permanently disable a wallet.
-- ${anyLocalMode() ? 'Spend limits are the AGENTWALLET_MAX_TX_NATIVE / _TOKEN / _SOL / _AUTOPAY caps the operator set; run wallet_mode to see them. Unset means no limit.' : 'Wallets have server-enforced spending limits.'}
+${anyLocalMode() ? '' : '- Use unpause_wallet to resume operations.\n- Use delete_wallet to permanently disable a wallet.\n'}- ${anyLocalMode() ? 'Spend limits are the AGENTWALLET_MAX_TX_NATIVE / _TOKEN / _SOL caps the operator set (unset means no limit) and AGENTWALLET_MAX_AUTOPAY for x402 (default 1); run wallet_mode to see them.' : 'Wallets have server-enforced spending limits.'}
 
 ## Tool Selection Guide
 | Goal | Tool |
@@ -760,7 +826,7 @@ Create paywalls to charge other agents for accessing your resources:
 | Check usage/billing | get_usage |`,
 });
 // ─── Tool: create_wallet ─────────────────────────────────────────
-server.tool('create_wallet', 'Create a new EVM or Solana wallet. Returns the wallet ID and address. ' +
+tool('create_wallet', 'Create a new EVM or Solana wallet. Returns the wallet ID and address. ' +
     (anyLocalMode() ? 'In local mode this reports the key already configured; no wallet is created remotely.' : 'Private key is encrypted server-side and never exposed.'), {
     label: z.string().default('').describe('Friendly name for the wallet'),
     chain_id: z.number().int().default(8453).describe('Default chain ID (1=Ethereum, 8453=Base, 42161=Arbitrum, 10=Optimism, 137=Polygon, 43114=Avalanche, 56=BSC, 7777777=Zora, 369=PulseChain, 900=Solana, 901=Solana Devnet)'),
@@ -769,13 +835,13 @@ server.tool('create_wallet', 'Create a new EVM or Solana wallet. Returns the wal
     return jsonResponse(data);
 });
 // ─── Tool: list_wallets ──────────────────────────────────────────
-server.tool('list_wallets', 'List all wallets owned by the authenticated user. ' +
+tool('list_wallets', 'List all wallets owned by the authenticated user. ' +
     'Returns wallet IDs, addresses, labels, chain IDs, and status.', {}, async () => {
     const data = await api('/wallets');
     return jsonResponse(data);
 });
 // ─── Tool: get_wallet ────────────────────────────────────────────
-server.tool('get_wallet', 'Get details for a specific wallet by ID. ' +
+tool('get_wallet', 'Get details for a specific wallet by ID. ' +
     'Returns address, label, chain, spending limits, and pause status.', {
     wallet_id: z.number().int().describe('Wallet ID'),
 }, async ({ wallet_id }) => {
@@ -783,7 +849,7 @@ server.tool('get_wallet', 'Get details for a specific wallet by ID. ' +
     return jsonResponse(data);
 });
 // ─── Tool: get_balance ───────────────────────────────────────────
-server.tool('get_balance', 'Get the native token balance for a wallet on a specific chain. ' +
+tool('get_balance', 'Get the native token balance for a wallet on a specific chain. ' +
     'Returns balance in both wei (or lamports for Solana) and human-readable format.', {
     wallet_id: z.number().int().describe('Wallet ID'),
     chain_id: z.number().int().optional().describe('Chain ID to check (defaults to wallet\'s default chain)'),
@@ -793,7 +859,7 @@ server.tool('get_balance', 'Get the native token balance for a wallet on a speci
     return jsonResponse(data);
 });
 // ─── Tool: sign_transaction ──────────────────────────────────────
-server.tool('sign_transaction', 'Sign a transaction with a wallet\'s private key. ' +
+tool('sign_transaction', 'Sign a transaction with a wallet\'s private key. ' +
     'For EVM: returns signed raw transaction hex. For Solana: returns base64 signed transaction. ' +
     'Does NOT broadcast — use send_transaction for sign + broadcast.', {
     wallet_id: z.number().int().describe('Wallet ID'),
@@ -839,7 +905,7 @@ server.tool('sign_transaction', 'Sign a transaction with a wallet\'s private key
     return jsonResponse(result);
 });
 // ─── Tool: send_transaction ──────────────────────────────────────
-server.tool('send_transaction', 'Sign and broadcast a transaction. ' +
+tool('send_transaction', 'Sign and broadcast a transaction. ' +
     'Returns the transaction hash (EVM) or signature (Solana) on success. ' +
     (anyLocalMode() ? 'Signed in this process with the local key and broadcast via the configured RPC.' : 'The transaction is signed server-side and broadcast via RPC.'), {
     wallet_id: z.number().int().describe('Wallet ID'),
@@ -885,7 +951,7 @@ server.tool('send_transaction', 'Sign and broadcast a transaction. ' +
     return jsonResponse(result);
 });
 // ─── Tool: transfer ─────────────────────────────────────────────
-server.tool('transfer', 'Send native tokens (ETH, AVAX, BNB, POL, PLS, SOL) to an address. ' +
+tool('transfer', 'Send native tokens (ETH, AVAX, BNB, POL, PLS, SOL) to an address. ' +
     'Specify the amount in human-readable format (e.g. "0.1" for 0.1 ETH). ' +
     'The amount is converted to wei/lamports automatically. Signs and broadcasts the transaction.', {
     wallet_id: z.number().int().describe('Wallet ID to send from'),
@@ -916,7 +982,7 @@ server.tool('transfer', 'Send native tokens (ETH, AVAX, BNB, POL, PLS, SOL) to a
     });
 });
 // ─── Tool: get_token_balance ────────────────────────────────────
-server.tool('get_token_balance', 'Get the ERC-20 or SPL token balance for a wallet on a specific chain. ' +
+tool('get_token_balance', 'Get the ERC-20 or SPL token balance for a wallet on a specific chain. ' +
     'Returns the raw balance and human-readable balance. ' +
     'Use get_chains to find stablecoin addresses for each chain.', {
     wallet_id: z.number().int().describe('Wallet ID to check'),
@@ -960,7 +1026,7 @@ server.tool('get_token_balance', 'Get the ERC-20 or SPL token balance for a wall
     });
 });
 // ─── Tool: transfer_token ───────────────────────────────────────
-server.tool('transfer_token', 'Send ERC-20 tokens (EVM) or SPL tokens (Solana) to an address. ' +
+tool('transfer_token', 'Send ERC-20 tokens (EVM) or SPL tokens (Solana) to an address. ' +
     'Specify the amount in human-readable format (e.g. "100" for 100 USDC). ' +
     'Signs and broadcasts the transaction. Use get_chains to find stablecoin addresses.', {
     wallet_id: z.number().int().describe('Wallet ID to send from'),
@@ -1009,7 +1075,7 @@ server.tool('transfer_token', 'Send ERC-20 tokens (EVM) or SPL tokens (Solana) t
     });
 });
 // ─── Tool: call_contract ────────────────────────────────────────
-server.tool('call_contract', 'Execute a read-only call against a smart contract (eth_call). ' +
+tool('call_contract', 'Execute a read-only call against a smart contract (eth_call). ' +
     'Returns the raw hex result. Does not cost gas or modify state. ' +
     'Useful for reading on-chain data like token balances, prices, positions.', {
     chain_id: z.number().int().describe('Chain ID'),
@@ -1023,7 +1089,7 @@ server.tool('call_contract', 'Execute a read-only call against a smart contract
     return jsonResponse(result);
 });
 // ─── Tool: approve_token ────────────────────────────────────────
-server.tool('approve_token', 'Approve a spender contract to transfer ERC-20 tokens on your behalf. ' +
+tool('approve_token', 'Approve a spender contract to transfer ERC-20 tokens on your behalf. ' +
     'Required before interacting with any DeFi protocol (DEXs, lending, etc.). ' +
     'Use amount "max" for unlimited approval, or specify an exact amount.', {
     wallet_id: z.number().int().describe('Wallet ID'),
@@ -1071,7 +1137,7 @@ server.tool('approve_token', 'Approve a spender contract to transfer ERC-20 toke
     });
 });
 // ─── Tool: get_allowance ────────────────────────────────────────
-server.tool('get_allowance', 'Check how many ERC-20 tokens a spender is approved to transfer. ' +
+tool('get_allowance', 'Check how many ERC-20 tokens a spender is approved to transfer. ' +
     'Returns the allowance in both raw and human-readable format. ' +
     'Use this to check if an approval is needed before a DeFi transaction.', {
     wallet_id: z.number().int().describe('Wallet ID (used to determine the owner address)'),
@@ -1107,7 +1173,7 @@ server.tool('get_allowance', 'Check how many ERC-20 tokens a spender is approved
 });
 // ─── WETH / Wrapped Native Token addresses ──────────────────────
 // ─── Tool: wrap_eth ─────────────────────────────────────────────
-server.tool('wrap_eth', 'Wrap native tokens (ETH, AVAX, BNB, POL, PLS) into their wrapped ERC-20 version (WETH, WAVAX, etc.). ' +
+tool('wrap_eth', 'Wrap native tokens (ETH, AVAX, BNB, POL, PLS) into their wrapped ERC-20 version (WETH, WAVAX, etc.). ' +
     'Required for most DeFi protocols that use ERC-20 tokens instead of raw native tokens. ' +
     'Specify amount in human-readable format (e.g. "0.5" for 0.5 ETH).', {
     wallet_id: z.number().int().describe('Wallet ID'),
@@ -1137,7 +1203,7 @@ server.tool('wrap_eth', 'Wrap native tokens (ETH, AVAX, BNB, POL, PLS) into thei
     });
 });
 // ─── Tool: unwrap_eth ───────────────────────────────────────────
-server.tool('unwrap_eth', 'Unwrap wrapped tokens (WETH, WAVAX, WBNB, etc.) back to native tokens. ' +
+tool('unwrap_eth', 'Unwrap wrapped tokens (WETH, WAVAX, WBNB, etc.) back to native tokens. ' +
     'Specify amount in human-readable format (e.g. "0.5" for 0.5 WETH).', {
     wallet_id: z.number().int().describe('Wallet ID'),
     amount: z.string().describe('Amount to unwrap in human-readable format (e.g. "0.5")'),
@@ -1196,7 +1262,7 @@ function decodeAbiString(hex) {
         return '';
     }
 }
-server.tool('get_token_info', 'Get the name, symbol, and decimals of any ERC-20 token by its contract address. ' +
+tool('get_token_info', 'Get the name, symbol, and decimals of any ERC-20 token by its contract address. ' +
     'Useful for discovering token details before transfers or approvals.', {
     token: z.string().regex(/^0x[a-fA-F0-9]{40}$/).describe('ERC-20 token contract address'),
     chain_id: z.number().int().describe('Chain ID'),
@@ -1336,7 +1402,7 @@ async function signPermit2(walletId, chainId, auth, approvalId) {
     return sig;
 }
 // ─── Tool: pay_x402 ─────────────────────────────────────────────
-server.tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the server returns HTTP 402 Payment Required, ' +
+tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the server returns HTTP 402 Payment Required, ' +
     'parses the payment requirements (v1 body or v2 PAYMENT-REQUIRED header), signs an EIP-3009 ' +
     'TransferWithAuthorization for the "exact" scheme (no gas, nothing broadcast by the payer), and retries ' +
     'the request with the payment header. AgentWallet paywalls are paid by on-chain transfer instead. ' +
@@ -1360,6 +1426,9 @@ server.tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the
     fresh_authorization: z.boolean().optional().describe('Sign a new authorization even if one for the same endpoint, amount and recipient is still valid. By default a repeat call ' +
         'within the validity window re-sends the earlier signature (same nonce, so it cannot settle twice) instead of paying again.'),
 }, async ({ url, wallet_id, method, headers: headersJson, body: reqBody, max_payment, prefer_chain, request_approval, approval_id, fresh_authorization }) => {
+    if (max_payment !== undefined && !/^\d+(\.\d+)?$/.test(String(max_payment).trim())) {
+        throw new Error(`max_payment must be a decimal number of stablecoin units, got "${serverText(max_payment)}"; nothing was fetched.`);
+    }
     // Build request headers
     const reqHeaders = { Accept: 'application/json' };
     if (headersJson) {
@@ -1801,10 +1870,10 @@ server.tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the
     });
 });
 // ─── Tool: check_approval ───────────────────────────────────────
-server.tool('check_approval', 'Status of a payment approval created when pay_x402 exceeded the cap on a hosted wallet. ' +
+tool('check_approval', 'Status of a payment approval created when pay_x402 exceeded the cap on a hosted wallet. ' +
     'Returns pending, approved, denied or expired. Once approved, call pay_x402 again with approval_id.', { approval_id: z.string().describe('Approval id returned by pay_x402') }, async ({ approval_id }) => jsonResponse(await api(`/approvals/${encodeURIComponent(approval_id)}`, 'GET', undefined, { 'X-AGW-SKIP-X402': 'true' })));
 // ─── Tool: approve_permit2 ──────────────────────────────────────
-server.tool('approve_permit2', 'One-time ERC-20 approval of a token to the Permit2 contract, needed before paying x402 "upto" endpoints with that token. ' +
+tool('approve_permit2', 'One-time ERC-20 approval of a token to the Permit2 contract, needed before paying x402 "upto" endpoints with that token. ' +
     'A normal on-chain transaction (needs gas). By default approves the maximum, the ecosystem norm, so it never has to be repeated; ' +
     'pass amount to grant a bounded allowance instead (required under AGENTWALLET_MAX_TX_TOKEN, which refuses a max approval). ' +
     'Permit2 itself only moves what each signed authorization allows.', {
@@ -1824,20 +1893,20 @@ server.tool('approve_permit2', 'One-time ERC-20 approval of a token to the Permi
     return jsonResponse({ ...result, token, spender: permit2Address(chain_id), amount: amount ?? 'unlimited', note: 'Permit2 only transfers what a signed authorization allows; the allowance itself moves nothing.' });
 });
 // ─── Tool: check_token_risk ─────────────────────────────────────
-server.tool('check_token_risk', 'Assess an ERC-20 token before approving or swapping it: honeypot, taxes, owner powers, verified source, ' +
+tool('check_token_risk', 'Assess an ERC-20 token before approving or swapping it: honeypot, taxes, owner powers, verified source, ' +
     'holder concentration, DEX liquidity. Uses GoPlus Security (free, no key) with an on-chain fallback. ' +
     'A warning for the caller to weigh, never a block.', {
     token: z.string().regex(/^0x[a-fA-F0-9]{40}$/).describe('ERC-20 token contract address'),
     chain_id: z.number().int().describe('Chain ID'),
 }, async ({ token, chain_id }) => jsonResponse({ token, chain_id, risk: await assessTokenRisk(chain_id, token, (to, data) => ethCallHex(chain_id, to, data)) }));
 // ─── Tool: get_usage ─────────────────────────────────────────────
-server.tool('get_usage', 'Get the current month\'s usage statistics. ' +
+tool('get_usage', 'Get the current month\'s usage statistics. ' +
     'Returns operations count, tier info, remaining quota, and fees.', {}, async () => {
     const data = await api('/usage');
     return jsonResponse(data);
 });
 // ─── Tool: buy_verification_credits ─────────────────────────────
-server.tool('buy_verification_credits', 'Buy x402 verification credits with USDC on-chain. ' +
+tool('buy_verification_credits', 'Buy x402 verification credits with USDC on-chain. ' +
     'Paywall owners need credits to process verifications beyond the free tier (1,000/month) ' +
     'when they don\'t have Stripe billing configured. ' +
     'Returns 402 payment instructions — pay on-chain and retry with proof.', {
@@ -1848,27 +1917,27 @@ server.tool('buy_verification_credits', 'Buy x402 verification credits with USDC
     return jsonResponse(data);
 });
 // ─── Tool: pause_wallet ──────────────────────────────────────────
-server.tool('pause_wallet', 'Emergency pause a wallet. No transactions can be signed while paused.', {
+tool('pause_wallet', 'Emergency pause a wallet. No transactions can be signed while paused.', {
     wallet_id: z.number().int().describe('Wallet ID to pause'),
 }, async ({ wallet_id }) => {
     const data = await api(`/wallets/${wallet_id}/pause`, 'POST');
     return jsonResponse(data);
 });
 // ─── Tool: unpause_wallet ────────────────────────────────────────
-server.tool('unpause_wallet', 'Resume a paused wallet so transactions can be signed again.', {
+tool('unpause_wallet', 'Resume a paused wallet so transactions can be signed again.', {
     wallet_id: z.number().int().describe('Wallet ID to unpause'),
 }, async ({ wallet_id }) => {
     const data = await api(`/wallets/${wallet_id}/unpause`, 'POST');
     return jsonResponse(data);
 });
 // ─── Tool: get_chains ────────────────────────────────────────────
-server.tool('get_chains', 'List all supported chains (EVM + Solana) with their chain IDs, native tokens, ' +
+tool('get_chains', 'List all supported chains (EVM + Solana) with their chain IDs, native tokens, ' +
     'stablecoins, and RPC configuration status.', {}, async () => {
     const data = await api('/chains');
     return jsonResponse(data);
 });
 // ─── Tool: delete_wallet ─────────────────────────────────────────
-server.tool('delete_wallet', 'Delete (soft-delete) a wallet. The wallet will no longer appear in listings ' +
+tool('delete_wallet', 'Delete (soft-delete) a wallet. The wallet will no longer appear in listings ' +
     'and cannot be used for transactions. The wallet is read first and the delete names its address, ' +
     'so a wallet that cannot be read is never deleted.', {
     wallet_id: z.number().int().describe('Wallet ID to delete'),
@@ -1883,7 +1952,7 @@ server.tool('delete_wallet', 'Delete (soft-delete) a wallet. The wallet will no
     return jsonResponse(data);
 });
 // ─── Tool: create_paywall ────────────────────────────────────────
-server.tool('create_paywall', 'Create an x402 paywall that charges agents/clients for accessing a resource. ' +
+tool('create_paywall', 'Create an x402 paywall that charges agents/clients for accessing a resource. ' +
     'Returns a public access URL that returns HTTP 402 until paid. ' +
     'Agents pay on-chain, then retry with proof to get the content.', {
     wallet_id: z.number().int().describe('Wallet ID to receive payments'),
@@ -1923,7 +1992,7 @@ server.tool('create_paywall', 'Create an x402 paywall that charges agents/client
     });
 });
 // ─── Tool: list_paywalls ────────────────────────────────────────
-server.tool('list_paywalls', 'List all your x402 paywalls. Returns paywall IDs, names, pricing, ' +
+tool('list_paywalls', 'List all your x402 paywalls. Returns paywall IDs, names, pricing, ' +
     'access URLs, payment counts, and revenue totals.', {
     page: z.number().int().default(1).describe('Page number'),
     per_page: z.number().int().min(1).max(100).default(50).describe('Results per page (max 100)'),
@@ -1932,7 +2001,7 @@ server.tool('list_paywalls', 'List all your x402 paywalls. Returns paywall IDs,
     return jsonResponse(data);
 });
 // ─── Tool: get_paywall ──────────────────────────────────────────
-server.tool('get_paywall', 'Get details for a specific x402 paywall by ID. ' +
+tool('get_paywall', 'Get details for a specific x402 paywall by ID. ' +
     'Returns pricing, access URL, payment stats, and configuration.', {
     paywall_id: z.number().int().describe('Paywall ID'),
 }, async ({ paywall_id }) => {
@@ -1940,7 +2009,7 @@ server.tool('get_paywall', 'Get details for a specific x402 paywall by ID. ' +
     return jsonResponse(data);
 });
 // ─── Tool: update_paywall ───────────────────────────────────────
-server.tool('update_paywall', 'Update an x402 paywall configuration. ' +
+tool('update_paywall', 'Update an x402 paywall configuration. ' +
     'Can change price, resource URL, active status, or any other field.', {
     paywall_id: z.number().int().describe('Paywall ID to update'),
     name: z.string().optional().describe('New paywall name'),
@@ -1978,14 +2047,14 @@ server.tool('update_paywall', 'Update an x402 paywall configuration. ' +
     return jsonResponse(data);
 });
 // ─── Tool: delete_paywall ───────────────────────────────────────
-server.tool('delete_paywall', 'Delete an x402 paywall. The access URL will return 404 after deletion.', {
+tool('delete_paywall', 'Delete an x402 paywall. The access URL will return 404 after deletion.', {
     paywall_id: z.number().int().describe('Paywall ID to delete'),
 }, async ({ paywall_id }) => {
     const data = await api(`/x402/paywalls/${paywall_id}`, 'DELETE');
     return jsonResponse(data);
 });
 // ─── Tool: get_paywall_payments ─────────────────────────────────
-server.tool('get_paywall_payments', 'Get payment history for a specific x402 paywall. ' +
+tool('get_paywall_payments', 'Get payment history for a specific x402 paywall. ' +
     'Returns verified payments with TX hashes, payer addresses, amounts, and timestamps.', {
     paywall_id: z.number().int().describe('Paywall ID'),
     page: z.number().int().default(1).describe('Page number'),
@@ -1995,13 +2064,13 @@ server.tool('get_paywall_payments', 'Get payment history for a specific x402 pay
     return jsonResponse(data);
 });
 // ─── Tool: get_x402_revenue ─────────────────────────────────────
-server.tool('get_x402_revenue', 'Get aggregate x402 revenue statistics across all your paywalls. ' +
+tool('get_x402_revenue', 'Get aggregate x402 revenue statistics across all your paywalls. ' +
     'Returns total payments and revenue broken down by chain and token.', {}, async () => {
     const data = await api('/x402/revenue');
     return jsonResponse(data);
 });
 // ─── Tool: wallet_mode ──────────────────────────────────────────
-server.tool('wallet_mode', 'Report whether this server is signing locally (self-custody, the private key never leaves this machine) ' +
+tool('wallet_mode', 'Report whether this server is signing locally (self-custody, the private key never leaves this machine) ' +
     'or through the hosted AgentWallet API (custodial). Use this to verify custody before moving funds.', {}, async () => {
     if (!anyLocalMode()) {
         return jsonResponse({
@@ -2011,8 +2080,13 @@ server.tool('wallet_mode', 'Report whether this server is signing locally (self-
             api_base: redactUrl(API_BASE),
             client_guards: {
                 autopay_cap_usd: autopayEnvCap(),
+                internal_autopay_armed: Boolean(X402_WALLET_ID),
+                max_autopay_per_hour: AUTOPAY_PER_HOUR,
                 autopay_assets: (process.env.AGENTWALLET_AUTOPAY_ASSETS || '').trim() || 'registry stablecoins only',
                 x402_max_timeout_seconds: maxAuthWindowSeconds(),
+                approvals: process.env.AGENTWALLET_APPROVALS !== '0',
+                permit2_auto_approve: process.env.AGENTWALLET_PERMIT2_AUTO_APPROVE === '1',
+                legacy_paywall_origins: (process.env.AGENTWALLET_LEGACY_PAYWALL_ORIGINS || '').trim() || 'none (API host only)',
                 note: 'These bound pay_x402 on hosted wallets too; the hosted signer adds its own pause, daily limit and approval checks.',
             },
             to_self_custody: 'Set AGENTWALLET_PRIVATE_KEY for EVM and/or AGENTWALLET_SOLANA_KEY for Solana, then restart. ' +
@@ -2023,12 +2097,18 @@ server.tool('wallet_mode', 'Report whether this server is signing locally (self-
         mode: 'local',
         custody: 'self',
         signing: 'Signed in this process. Keys are never sent to AgentWallet or anyone else.',
-        max_autopay: process.env.AGENTWALLET_MAX_AUTOPAY || '1',
-        autopay_assets: process.env.AGENTWALLET_AUTOPAY_ASSETS || 'registry stablecoins only',
+        max_autopay: autopayEnvCap(),
+        max_autopay_per_hour: AUTOPAY_PER_HOUR,
+        internal_autopay_armed: false, // internal auto-pay never runs in local mode
+        autopay_assets: (process.env.AGENTWALLET_AUTOPAY_ASSETS || '').trim() || 'registry stablecoins only',
         x402_max_timeout_seconds: maxAuthWindowSeconds(),
-        per_tx_cap_token: process.env.AGENTWALLET_MAX_TX_TOKEN || 'not set (ERC-20 and SPL transfers are uncapped)',
+        per_tx_cap_token: (process.env.AGENTWALLET_MAX_TX_TOKEN || '').trim() || 'not set (ERC-20 and SPL transfers are uncapped)',
         allow_unknown_token_calls: process.env.AGENTWALLET_ALLOW_UNKNOWN_TOKEN_CALLS === '1',
         token_decimals_pins: parseDecimalPins(process.env.AGENTWALLET_TOKEN_DECIMALS).size,
+        token_risk_lookup: process.env.AGENTWALLET_TOKEN_RISK !== '0',
+        permit2_auto_approve: process.env.AGENTWALLET_PERMIT2_AUTO_APPROVE === '1',
+        legacy_paywall_origins: (process.env.AGENTWALLET_LEGACY_PAYWALL_ORIGINS || '').trim() || 'none (API host only)',
+        default_chain_id: (process.env.AGENTWALLET_CHAIN_ID || '').trim() || '8453',
     };
     if (isLocalMode()) {
         let rpc = 'default public endpoint';
@@ -2039,7 +2119,8 @@ server.tool('wallet_mode', 'Report whether this server is signing locally (self-
         report.evm = {
             address: getLocalAddress(),
             rpc_endpoint: redactUrl(rpc),
-            per_tx_cap_native: process.env.AGENTWALLET_MAX_TX_NATIVE || 'not set',
+            per_tx_cap_native: (process.env.AGENTWALLET_MAX_TX_NATIVE || '').trim() || 'not set',
+            per_tx_fee_cap_native: (process.env.AGENTWALLET_MAX_FEE_NATIVE || '').trim() || '0.01 (default)',
         };
     }
     else {
@@ -2054,8 +2135,8 @@ server.tool('wallet_mode', 'Report whether this server is signing locally (self-
         report.solana = {
             address: getSolanaAddress(),
             rpc_endpoint: redactUrl(rpc),
-            per_tx_cap_sol: process.env.AGENTWALLET_MAX_TX_SOL || 'not set',
-            per_tx_cap_token: process.env.AGENTWALLET_MAX_TX_TOKEN || 'not set (SPL transfers are uncapped; AGENTWALLET_MAX_TX_SOL does not cover them)',
+            per_tx_cap_sol: (process.env.AGENTWALLET_MAX_TX_SOL || '').trim() || 'not set',
+            per_tx_cap_token: (process.env.AGENTWALLET_MAX_TX_TOKEN || '').trim() || 'not set (SPL transfers are uncapped; AGENTWALLET_MAX_TX_SOL does not cover them)',
         };
     }
     else {
@@ -2064,7 +2145,7 @@ server.tool('wallet_mode', 'Report whether this server is signing locally (self-
     return jsonResponse(report);
 });
 // ─── Tool: export_wallet_key ────────────────────────────────────
-server.tool('export_wallet_key', 'Explain how to export the private key of a hosted (custodial) AgentWallet so it can be moved ' +
+tool('export_wallet_key', 'Explain how to export the private key of a hosted (custodial) AgentWallet so it can be moved ' +
     'to self-custody or any other wallet. Export itself is deliberately human-gated and is not ' +
     'performed by this tool.', {
     wallet_id: z.number().int().optional().describe('Hosted wallet ID to export'),

package/build/local-solana.d.ts

@@ -16,6 +16,22 @@ export declare function isSolanaLocalMode(): boolean;
 export declare function getSolanaKeypair(): Keypair;
 export declare function getSolanaAddress(): string;
 export declare function resolveSolanaRpc(chainId?: number): string;
+/**
+ * Bound SPL movement. AGENTWALLET_MAX_TX_SOL only ever covered native SOL, so
+ * an SPL transfer, which is how USDC moves on Solana and the whole point of the
+ * x402 rail here, went out with no local ceiling at all. Mirrors
+ * AGENTWALLET_MAX_TX_TOKEN on the EVM side and uses the same variable so an
+ * operator sets one token cap, not one per chain family.
+ *
+ * Decimals for the cap come from the trusted table when the mint is known, then
+ * from the mint account itself, and finally 0. The caller-supplied value is
+ * never used for the ceiling: an inflated one would inflate the cap exactly
+ * like the x402 bypass.
+ *
+ * 0 is the only safe fallback. Assuming 6 for an unknown mint is what AW-001
+ * exploited: for a mint with d decimals, a ceiling evaluated at 6 is 10**(6-d)
+ * times too permissive, and SPL mints with 0 to 5 decimals are common.
+ */
 /** The mint's decimals from the chain, or null when they cannot be read. Never guesses. */
 export declare function mintDecimalsStrict(mint: string, chainId: number): Promise<number | null>;
 export declare function localSolBalance(chainId?: number): Promise<{

package/build/local-solana.js

@@ -12,7 +12,7 @@
  * that when the two instructions it needs are a dozen lines each.
  */
 import { readFileSync } from 'node:fs';
-import { Connection, Keypair, PublicKey, SystemProgram, Transaction, TransactionInstruction, sendAndConfirmTransaction, LAMPORTS_PER_SOL, } from '@solana/web3.js';
+import { Connection, Keypair, PublicKey, SystemProgram, Transaction, TransactionInstruction, LAMPORTS_PER_SOL, } from '@solana/web3.js';
 import bs58 from 'bs58';
 import { lookupTrustedDecimals } from './x402-payment.js';
 /* ── Program IDs ─────────────────────────────────────────────────── */
@@ -171,7 +171,10 @@ function assertWithinSolCap(lamports) {
  * exploited: for a mint with d decimals, a ceiling evaluated at 6 is 10**(6-d)
  * times too permissive, and SPL mints with 0 to 5 decimals are common.
  */
-const splDecimalsCache = new Map();
+/* The cap and the instruction read the mint's decimals through ONE call now:
+   a cached cap-side read and an uncached instruction-side read let a hostile
+   RPC answer 6 to one and 18 to the other, which scaled the cap by 10^12
+   while the instruction carried the real byte (2026-10-04 round 4). */
 /** The mint's decimals from the chain, or null when they cannot be read. Never guesses. */
 export async function mintDecimalsStrict(mint, chainId) {
     const known = lookupTrustedDecimals(chainId, mint);
@@ -189,37 +192,14 @@ export async function mintDecimalsStrict(mint, chainId) {
         return null;
     }
 }
-async function resolveMintDecimals(mint, chainId) {
-    const known = lookupTrustedDecimals(chainId, mint);
-    if (typeof known === 'number')
-        return known;
-    const cacheKey = `${chainId}:${mint}`; // the same mint address can exist on two clusters with different decimals
-    const cached = splDecimalsCache.get(cacheKey);
-    if (typeof cached === 'number')
-        return cached;
-    try {
-        const conn = connection(chainId);
-        const info = await conn.getParsedAccountInfo(new PublicKey(mint));
-        const data = info?.value?.data;
-        const d = Number(data?.parsed?.info?.decimals);
-        if (Number.isInteger(d) && d >= 0 && d <= 36) {
-            splDecimalsCache.set(cacheKey, d);
-            return d;
-        }
-    }
-    catch {
-        // Unreachable RPC or non-standard mint: fall through to the safe floor.
-    }
-    return 0;
-}
-async function assertWithinSplCap(mint, rawAmount, chainId = 900) {
+/** The cap is evaluated at exactly the decimals the instruction will carry; the caller passes the value it just verified against the chain. */
+function assertWithinSplCap(rawAmount, decimals) {
     const cap = (process.env.AGENTWALLET_MAX_TX_TOKEN || '').trim();
     if (!cap)
         return;
     if (!/^\d+(\.\d+)?$/.test(cap)) {
         throw new Error(`AGENTWALLET_MAX_TX_TOKEN must be a decimal number, got "${cap}".`);
     }
-    const decimals = await resolveMintDecimals(mint, chainId);
     const [whole, frac = ''] = cap.split('.');
     const capRaw = BigInt(whole + frac.padEnd(decimals, '0').slice(0, decimals));
     if (rawAmount > capRaw) {
@@ -228,6 +208,41 @@ async function assertWithinSplCap(mint, rawAmount, chainId = 900) {
             `Raise the cap deliberately if this is intended.`);
     }
 }
+const CONFIRM_TIMEOUT_MS = 90_000;
+/**
+ * Sign, broadcast and confirm. The signature reported is the one computed
+ * here, never the node's answer (a node that returned a different string had
+ * the agent confirming and reporting a signature that was not this
+ * transaction, round 4); anything that fails after the broadcast says so and
+ * carries the signature, so an agent does not retry a transfer that went out.
+ */
+async function sendSigned(conn, tx, payer) {
+    const { blockhash, lastValidBlockHeight } = await conn.getLatestBlockhash();
+    tx.recentBlockhash = blockhash;
+    tx.feePayer = payer.publicKey;
+    tx.sign(payer);
+    if (!tx.signature)
+        throw new Error('The transaction could not be signed.');
+    const local = bs58.encode(tx.signature);
+    const reported = await conn.sendRawTransaction(tx.serialize());
+    const after = (what) => new Error(`Transaction ${local} was BROADCAST but ${what}. Check it on an explorer before retrying: a retry is a second transfer.`);
+    if (reported !== local)
+        throw after(`the RPC answered with a different signature (${String(reported).slice(0, 90)}), so the node cannot be trusted about its fate`);
+    const confirm = conn.confirmTransaction({ signature: local, blockhash, lastValidBlockHeight }, 'confirmed');
+    const timeout = new Promise((_, reject) => setTimeout(() => reject(after(`was not confirmed within ${CONFIRM_TIMEOUT_MS / 1000} s`)), CONFIRM_TIMEOUT_MS).unref());
+    let result;
+    try {
+        result = await Promise.race([confirm, timeout]);
+    }
+    catch (e) {
+        if (e instanceof Error && /was BROADCAST/.test(e.message))
+            throw e;
+        throw after(`confirmation failed: ${e instanceof Error ? e.message : JSON.stringify(e)}`);
+    }
+    if (result.value.err)
+        throw after(`it failed on chain: ${JSON.stringify(result.value.err)}`);
+    return local;
+}
 /* ── Reads ───────────────────────────────────────────────────────── */
 export async function localSolBalance(chainId = 900) {
     const conn = connection(chainId);
@@ -344,7 +359,7 @@ export async function localSolTransfer(to, lamports, chainId = 900) {
         toPubkey: new PublicKey(to),
         lamports: Number(amount),
     }));
-    const signature = await sendAndConfirmTransaction(conn, tx, [payer]);
+    const signature = await sendSigned(conn, tx, payer);
     return {
         signature,
         from: payer.publicKey.toBase58(),
@@ -396,22 +411,23 @@ export async function localSplTransfer(mintStr, to, rawAmount, decimals, chainId
     // The cluster is verified before the cap reads decimals from it, so the
     // decimals cache is never filled from a node serving another chain.
     await assertCluster(conn, chainId);
-    await assertWithinSplCap(mintStr, BigInt(rawAmount), chainId);
-    const payer = getSolanaKeypair();
-    const mint = new PublicKey(mintStr);
-    const recipient = new PublicKey(to);
-    await assertRecipientIsWallet(conn, recipient);
-    const { tokenProgram, ataSize } = await mintLayout(conn, mint);
     // The caller scaled the amount by `decimals`. That value must be the mint's
     // real one: substituting the real value into the instruction (as 1.13.0
     // did) let a wrong guess through, because the amount had already been
     // scaled by the guess and TransferChecked only sees the real byte
-    // (2026-10-04 audit). A mismatch refuses.
+    // (2026-10-04 audit). A mismatch refuses. Read ONCE, and the cap below is
+    // evaluated at this same value (round 4).
     const real = await mintDecimalsStrict(mintStr, chainId);
     if (real === null)
         throw new Error(`Could not read the decimals of mint ${mintStr} from the chain; refusing to guess the scale of the amount.`);
     if (decimals !== real)
         throw new Error(`decimals ${decimals} was passed but mint ${mintStr} has ${real} decimals; refusing to scale the amount by the wrong factor.`);
+    assertWithinSplCap(BigInt(rawAmount), real);
+    const payer = getSolanaKeypair();
+    const mint = new PublicKey(mintStr);
+    const recipient = new PublicKey(to);
+    await assertRecipientIsWallet(conn, recipient);
+    const { tokenProgram, ataSize } = await mintLayout(conn, mint);
     const sourceAta = associatedTokenAddress(payer.publicKey, mint, tokenProgram);
     const destAta = associatedTokenAddress(recipient, mint, tokenProgram);
     const tx = new Transaction();
@@ -430,13 +446,16 @@ export async function localSplTransfer(mintStr, to, rawAmount, decimals, chainId
         // outflow the SOL cap must see (0.002 SOL a time adds up over many sends).
         // Rent follows the account's real size, which for Token-2022 is above 165;
         // SOL already sitting at the address reduces what the payer tops up.
-        const rent = await conn.getMinimumBalanceForRentExemption(ataSize);
-        const shortfall = Math.max(0, rent - (destInfo?.lamports ?? 0));
-        assertWithinSolCap(BigInt(shortfall));
+        // The node's rent figure is floored at the cluster constant and the SOL the
+        // node says already sits at the address is not credited: both are numbers a
+        // lying RPC used to zero so the create went out under the cap (round 4).
+        const claimed = Number(await conn.getMinimumBalanceForRentExemption(ataSize));
+        const rent = Math.max(Number.isFinite(claimed) ? Math.trunc(claimed) : 0, (128 + ataSize) * 6960);
+        assertWithinSolCap(BigInt(rent));
         tx.add(createAtaIdempotentIx(payer.publicKey, destAta, recipient, mint, tokenProgram));
     }
     tx.add(transferCheckedIx(tokenProgram, sourceAta, mint, destAta, payer.publicKey, BigInt(rawAmount), decimals));
-    const signature = await sendAndConfirmTransaction(conn, tx, [payer]);
+    const signature = await sendSigned(conn, tx, payer);
     return {
         signature,
         from: payer.publicKey.toBase58(),

package/build/local-wallet.d.ts

@@ -49,14 +49,15 @@ export declare function localNativeBalance(chainId: number): Promise<{
     mode: string;
 }>;
 export declare function localTokenBalance(chainId: number, token: Address): Promise<{
+    mode: string;
+    warning?: string | undefined;
     address: `0x${string}`;
     chain_id: number;
     token: `0x${string}`;
     symbol: string;
-    decimals: number;
+    decimals: number | null;
     balance_raw: string;
-    balance: string;
-    mode: string;
+    balance: string | null;
 }>;
 export interface LocalSendResult {
     tx_hash: string;
@@ -66,6 +67,9 @@ export interface LocalSendResult {
     chain_id: number;
     mode: 'local';
     signed_locally: true;
+    gas?: string;
+    max_fee_per_gas?: string;
+    worst_case_fee?: string;
 }
 /**
  * What a decimals() probe learned about an address. The four outcomes are
@@ -89,7 +93,20 @@ type DecimalsProbe = number | 'unusable' | 'not-a-token' | 'unreachable';
 /** An eth_call failure is a revert only when the node says so; every other failure is "could not ask". */
 export declare function classifyDecimalsError(err: unknown): DecimalsProbe;
 export declare function permit2AddressFor(chainId: number): string;
-export declare function localSend(chainId: number, to: Address, valueWei: bigint, data?: Hex): Promise<LocalSendResult>;
+/** Caller-chosen gas parameters (wei / gas units as decimal strings); honoured, then bounded by the fee cap. */
+export interface FeeOverrides {
+    gas?: string;
+    maxFeePerGas?: string;
+    maxPriorityFeePerGas?: string;
+}
+/**
+ * The most a transaction may burn in fees: gas x maxFeePerGas, in native units.
+ * Without it a node that answered a 47,000 gwei tip or a 30M gas estimate took
+ * the whole balance as fees on a cap-compliant 0.001 ETH transfer (round 4).
+ * Default 0.01; AGENTWALLET_MAX_FEE_NATIVE raises or lowers it.
+ */
+export declare function feeCapWei(): bigint;
+export declare function localSend(chainId: number, to: Address, valueWei: bigint, data?: Hex, fees?: FeeOverrides): Promise<LocalSendResult>;
 /** ERC-20 transfer, encoded locally. */
 export declare function localTransferToken(chainId: number, token: Address, to: Address, rawAmount: string): Promise<LocalSendResult>;
 /** ERC-20 approve, encoded locally. */

package/build/local-wallet.js

@@ -15,7 +15,7 @@
  * on the custodial path and say so explicitly rather than silently downgrading.
  */
 import { readFileSync, statSync } from 'node:fs';
-import { createPublicClient, createWalletClient, http, encodeFunctionData, parseAbi, formatUnits, } from 'viem';
+import { createPublicClient, createWalletClient, http, encodeFunctionData, parseAbi, formatUnits, keccak256, } from 'viem';
 import { privateKeyToAccount } from 'viem/accounts';
 import { nonceManager } from 'viem/nonce';
 import { lookupTrustedDecimals, maxAuthWindowSeconds } from './x402-payment.js';
@@ -109,16 +109,31 @@ const DEFAULT_RPC = {
 export function resolveRpcUrl(chainId) {
     const perChain = (process.env[`AGENTWALLET_RPC_${chainId}`] || '').trim();
     if (perChain)
-        return perChain;
+        return assertRpcScheme(perChain, `AGENTWALLET_RPC_${chainId}`);
     const generic = (process.env.AGENTWALLET_RPC_URL || '').trim();
     if (generic)
-        return generic;
+        return assertRpcScheme(generic, 'AGENTWALLET_RPC_URL');
     const fallback = DEFAULT_RPC[chainId];
     if (fallback)
         return fallback;
     throw new Error(`No RPC endpoint for chain ${chainId} in local mode. ` +
         `Set AGENTWALLET_RPC_${chainId} to an endpoint you trust.`);
 }
+/** An RPC over plain http to anything but loopback is the hostile-node model in full; refused like the API URL is. */
+function assertRpcScheme(url, name) {
+    let u;
+    try {
+        u = new URL(url);
+    }
+    catch {
+        throw new Error(`${name} is not a URL: "${url}".`);
+    }
+    const loopback = u.hostname === 'localhost' || u.hostname === '127.0.0.1' || u.hostname === '[::1]';
+    if (u.protocol !== 'https:' && !(u.protocol === 'http:' && loopback)) {
+        throw new Error(`${name} must be https (got ${u.protocol}//${u.host}); plain http is allowed only for localhost.`);
+    }
+    return url;
+}
 /**
  * Chain ids each RPC URL has been seen to serve, so an operator pointing
  * AGENTWALLET_RPC_URL at one node for every chain, or mistyping a per-chain
@@ -187,16 +202,21 @@ const ERC20_ABI = parseAbi([
 export async function localTokenBalance(chainId, token) {
     const { pub } = clients(chainId);
     const address = getLocalAddress();
-    const [raw, decimals, symbol] = await Promise.all([
+    const [raw, decimalsRaw, symbol] = await Promise.all([
         pub.readContract({ address: token, abi: ERC20_ABI, functionName: 'balanceOf', args: [address] }),
-        pub.readContract({ address: token, abi: ERC20_ABI, functionName: 'decimals' }).catch(() => 18),
+        pub.readContract({ address: token, abi: ERC20_ABI, functionName: 'decimals' }).catch(() => null),
         pub.readContract({ address: token, abi: ERC20_ABI, functionName: 'symbol' }).catch(() => ''),
     ]);
+    // A decimals() of 2^20 handed to viem's formatUnits held the whole server for
+    // minutes (quadratic trailing-zero trim, round 4): only 0..36 is formatted.
+    const d = Number(decimalsRaw);
+    const safe = Number.isInteger(d) && d >= 0 && d <= 36 ? d : null;
     return {
         address, chain_id: chainId, token, symbol,
-        decimals: Number(decimals),
+        decimals: safe,
         balance_raw: raw.toString(),
-        balance: formatUnits(raw, Number(decimals)),
+        balance: safe === null ? null : formatUnits(raw, safe),
+        ...(safe === null ? { warning: 'the token reported decimals outside 0..36 (or none); only the raw balance is shown' } : {}),
         mode: 'local',
     };
 }
@@ -261,8 +281,11 @@ async function probeTokenDecimals(chainId, token) {
         return 'unusable'; // answered, but not one uint8 word
     const d = Number(BigInt(result));
     // Reject nonsense rather than trusting it; an out-of-range value would
-    // widen the ceiling exactly like the old assumption did.
-    if (Number.isInteger(d) && d >= 0 && d <= 36) {
+    // widen the ceiling exactly like the old assumption did. Above 18 the RPC is
+    // the only witness and a lie there scales the cap by 10^18 (a node saying 36
+    // for mainnet WETH, round 4): such tokens must be pinned with
+    // AGENTWALLET_TOKEN_DECIMALS.
+    if (Number.isInteger(d) && d >= 0 && d <= 18) {
         decimalsCache.set(key, d);
         return d;
     }
@@ -435,7 +458,25 @@ async function assertWithinTokenCap(chainId, to, data, valueWei = 0n) {
         }
     }
 }
-export async function localSend(chainId, to, valueWei, data) {
+function parseUint(v, what) {
+    if (!/^\d{1,40}$/.test(v))
+        throw new Error(`${what} must be a non-negative integer string, got "${v}".`);
+    return BigInt(v);
+}
+/**
+ * The most a transaction may burn in fees: gas x maxFeePerGas, in native units.
+ * Without it a node that answered a 47,000 gwei tip or a 30M gas estimate took
+ * the whole balance as fees on a cap-compliant 0.001 ETH transfer (round 4).
+ * Default 0.01; AGENTWALLET_MAX_FEE_NATIVE raises or lowers it.
+ */
+export function feeCapWei() {
+    const raw = (process.env.AGENTWALLET_MAX_FEE_NATIVE || '0.01').trim();
+    if (!/^\d+(\.\d+)?$/.test(raw))
+        throw new Error(`AGENTWALLET_MAX_FEE_NATIVE must be a decimal number, got "${raw}".`);
+    const [whole, frac = ''] = raw.split('.');
+    return BigInt(whole + frac.padEnd(18, '0').slice(0, 18));
+}
+export async function localSend(chainId, to, valueWei, data, fees) {
     assertWithinNativeCap(valueWei);
     if (data && data !== '0x') {
         if (!/^0x([0-9a-fA-F]{2})*$/.test(data))
@@ -443,20 +484,73 @@ export async function localSend(chainId, to, valueWei, data) {
         await assertWithinTokenCap(chainId, to, data, valueWei);
     }
     await assertRpcServesChain(chainId);
-    const { wallet } = clients(chainId);
-    const hash = await wallet.sendTransaction({
-        to,
-        value: valueWei,
-        ...(data ? { data } : {}),
+    const { pub, wallet } = clients(chainId);
+    const account = getLocalAccount();
+    const base = { account, to, value: valueWei, ...(data ? { data } : {}) };
+    // Gas: the caller's figure when given (it used to be read and dropped,
+    // round 4), otherwise the node's estimate.
+    const gas = fees?.gas ? parseUint(fees.gas, 'gas_limit') : await pub.estimateGas(base);
+    // Fees: the caller's figures when given, otherwise the node's; either way the
+    // worst case gas x maxFeePerGas must fit the fee cap before anything is signed.
+    let maxFeePerGas;
+    let maxPriorityFeePerGas;
+    let gasPrice;
+    if (fees?.maxFeePerGas) {
+        maxFeePerGas = parseUint(fees.maxFeePerGas, 'max_fee');
+        maxPriorityFeePerGas = fees.maxPriorityFeePerGas ? parseUint(fees.maxPriorityFeePerGas, 'priority_fee') : maxFeePerGas;
+    }
+    else {
+        try {
+            const est = await pub.estimateFeesPerGas();
+            maxFeePerGas = est.maxFeePerGas;
+            maxPriorityFeePerGas = fees?.maxPriorityFeePerGas ? parseUint(fees.maxPriorityFeePerGas, 'priority_fee') : est.maxPriorityFeePerGas;
+        }
+        catch {
+            gasPrice = (await pub.estimateFeesPerGas({ type: 'legacy' })).gasPrice; // a chain without EIP-1559
+        }
+    }
+    if (maxFeePerGas !== undefined && maxPriorityFeePerGas !== undefined && maxPriorityFeePerGas > maxFeePerGas)
+        maxPriorityFeePerGas = maxFeePerGas;
+    const perGas = maxFeePerGas ?? gasPrice ?? 0n;
+    const worst = gas * perGas;
+    const feeCap = feeCapWei();
+    if (worst > feeCap) {
+        throw new Error(`Blocked by local guard: the transaction could burn up to ${formatUnits(worst, 18)} native in fees (gas ${gas} x ${formatUnits(perGas, 9)} gwei), ` +
+            `above AGENTWALLET_MAX_FEE_NATIVE (${formatUnits(feeCap, 18)}). A node answering an absurd fee or gas estimate is the usual cause; ` +
+            `pass gas_limit / max_fee / priority_fee explicitly, or the operator can raise the cap.`);
+    }
+    // Sign here, hash here, then hand the bytes to the node: the hash reported is
+    // the one computed from the signed transaction, never the node's answer.
+    const address = getLocalAddress();
+    const nonce = await account.nonceManager.consume({ address, chainId, client: pub });
+    const request = await wallet.prepareTransactionRequest({
+        ...base, gas, nonce, chainId,
+        ...(gasPrice !== undefined ? { type: 'legacy', gasPrice } : { type: 'eip1559', maxFeePerGas: maxFeePerGas, maxPriorityFeePerGas: maxPriorityFeePerGas }),
     });
+    const signed = await wallet.signTransaction(request);
+    const localHash = keccak256(signed);
+    let reported;
+    try {
+        reported = await pub.sendRawTransaction({ serializedTransaction: signed });
+    }
+    catch (e) {
+        account.nonceManager.reset({ address, chainId });
+        throw new Error(`Broadcast of transaction ${localHash} (nonce ${nonce}) failed: ${e.message.split('\n')[0]}. The transaction is signed and MAY be live if the node forwarded it before answering; check the hash on an explorer before retrying.`);
+    }
+    if (reported.toLowerCase() !== localHash.toLowerCase()) {
+        throw new Error(`Transaction ${localHash} (nonce ${nonce}) was BROADCAST, but the node answered with a different hash (${String(reported).slice(0, 80)}), so it cannot be trusted about its fate. Verify ${localHash} on an explorer before retrying.`);
+    }
     return {
-        tx_hash: hash,
-        from: getLocalAddress(),
+        tx_hash: localHash,
+        from: address,
         to,
         value: valueWei.toString(),
         chain_id: chainId,
         mode: 'local',
         signed_locally: true,
+        gas: gas.toString(),
+        max_fee_per_gas: (maxFeePerGas ?? gasPrice ?? 0n).toString(),
+        worst_case_fee: formatUnits(worst, 18),
     };
 }
 /** ERC-20 transfer, encoded locally. */

package/build/x402-payment.d.ts

@@ -1,19 +1,3 @@
-/**
- * Pure helpers for x402 auto-pay amount/token derivation.
- *
- * Isolated from the server bootstrap in index.ts so the funds-sensitive amount
- * math can be unit-tested without starting the MCP server.
- *
- * SECURITY INVARIANT: token decimals must NEVER come from the 402 response.
- * A resource server controls `asset`, `payTo`, `maxAmountRequired` AND
- * `requiredDecimals`. If the cap is scaled using server-declared decimals, the
- * server can inflate the cap arbitrarily: declaring 18 decimals for 6-decimal
- * USDC turns a "1 USDC" cap into 10^18 base units, so a request for
- * 1,000,000,000,000 units (1,000,000 USDC) passes a 1 USDC cap. Reported by
- * ARC Security Research, 2026-08-02, against 1.10.1. Decimals are now resolved
- * from a trusted source and the declared value is only ever used to detect a
- * mismatch and refuse.
- */
 export interface X402AcceptLike {
     maxAmountRequired: string;
     requiredDecimals?: number;

package/build/x402-payment.js

@@ -14,6 +14,7 @@
  * from a trusted source and the declared value is only ever used to detect a
  * mismatch and refuse.
  */
+import { wrappedNativeAddress } from './wrapped-native.js';
 /**
  * Decimals for assets that x402 endpoints actually settle in, keyed by
  * chain id then lowercased contract address (or SPL mint on Solana).
@@ -283,6 +284,11 @@ export function lookupTrustedDecimals(chainId, token) {
     const pinned = pinnedDecimals(chainId, token);
     if (pinned !== null)
         return pinned;
+    // Every chain's wrapped native coin is 18 decimals (WETH9 clones; the local
+    // guard asserts it). The registry carried WETH for Base only, so mainnet WETH
+    // was priced by the RPC, which could say 36 (2026-10-04 round 4).
+    if (wrappedNativeAddress(chainId)?.toLowerCase() === token.toLowerCase())
+        return 18;
     const spl = TRUSTED_SPL_DECIMALS[token];
     if (typeof spl === 'number')
         return spl;

package/package.json

@@ -1,7 +1,8 @@
 {
   "name": "agentwallet-mcp",
   "mcpName": "io.github.hifriendbot/agentwallet",
-  "version": "1.13.9",
+  "repository": { "type": "git", "url": "https://github.com/hifriendbot/agentwallet-mcp" },
+  "version": "1.13.11",
   "description": "MCP server for AgentWallet: self-custody local signing on EVM and Solana, or hosted wallets. Sign, broadcast, pay x402 invoices, and accept x402 payments.",
   "type": "module",
   "main": "build/index.js",
@@ -16,7 +17,7 @@
   "scripts": {
     "build": "tsc",
     "start": "node build/index.js",
-    "test": "node test/x402-payment.test.mjs && node test/eip3009.test.mjs && node test/permit2-risk.test.mjs && node test/token-cap.test.mjs && node test/spl-cap.test.mjs && node test/unknown-decimals-cap.test.mjs && node test/decimals-range-cap.test.mjs && node test/local-mode.test.mjs && node test/ssrf-guard.test.mjs && node test/x402-policy.test.mjs && node test/local-guard-shape.test.mjs && node test/allowance-total-cap.test.mjs && node test/autopay-scheme.test.mjs && node test/spl-recipient-guard.test.mjs && node test/approval-binding.test.mjs && node test/ata-rent-size.test.mjs && node test/final-url-guard.test.mjs && node test/audit-1135.test.mjs && node test/local-no-autopay.test.mjs && node test/audit-1136.test.mjs && node test/delete-confirm.test.mjs && node test/audit-1138.test.mjs && node test/audit-1139.test.mjs",
+    "test": "node test/x402-payment.test.mjs && node test/eip3009.test.mjs && node test/permit2-risk.test.mjs && node test/token-cap.test.mjs && node test/spl-cap.test.mjs && node test/unknown-decimals-cap.test.mjs && node test/decimals-range-cap.test.mjs && node test/local-mode.test.mjs && node test/ssrf-guard.test.mjs && node test/x402-policy.test.mjs && node test/local-guard-shape.test.mjs && node test/allowance-total-cap.test.mjs && node test/autopay-scheme.test.mjs && node test/spl-recipient-guard.test.mjs && node test/approval-binding.test.mjs && node test/ata-rent-size.test.mjs && node test/final-url-guard.test.mjs && node test/audit-1135.test.mjs && node test/local-no-autopay.test.mjs && node test/audit-1136.test.mjs && node test/delete-confirm.test.mjs && node test/audit-1138.test.mjs && node test/audit-1139.test.mjs && node test/audit-11310.test.mjs && node test/audit-11311.test.mjs",
     "prepublishOnly": "npm run build"
   },
   "keywords": [