agentwallet-mcp 1.14.10 → 1.14.11

package/README.md

@@ -369,6 +369,7 @@ A per-transaction cap bounds one signature. It cannot see that the five hundredt
   "per_host": { "*.example.com": { "daily": "2", "per_payment": "0.25" } },
   "recipients": { "deny": ["0x0000000000000000000000000000000000000000"] },
   "chains": { "allow": [8453, 900] },
+  "contracts": { "allow": ["8453:0x2626664c2603336E57B271c5C0b26F421741e481"] },
   "approval": { "above": "0.50", "max": "20" },
   "tools": { "allow": ["pay_x402", "quote_x402", "discover_x402", "get_balance", "list_payments", "spend_policy", "wallet_mode"] }
 }
@@ -376,10 +377,11 @@ A per-transaction cap bounds one signature. It cannot see that the five hundredt
 
 - **`budget`**: rolling dollar budgets (last 24 hours, last 30 days, lifetime) across every chain, counting x402 payments, stablecoin transfers and stablecoin approvals in registry stablecoins. A spend the budget cannot price (a token outside the registry) is refused while a budget is set, unless `"unpriced_spends": "allow"`. An SPL send is priced at the mint's own decimals; a `token_decimals` hint that disagrees with the mint is refused before any request is made.
 - **`native_budget`**: the same per chain, in the chain's own coin, counting native transfers, native x402 payments and the native value sent into any contract (`wrap_eth`, `send_transaction` with value and calldata), including value carried on a token transfer or approval call (a payable token contract keeps it, so it is a second spend, to that contract) and, in local Solana mode, the rent an SPL send pays to create the recipient's token account (the recipient owns that account and can close it for the lamports; the ledger records it as its own line, method `rent`, to the recipient, and `assets.allow` does not need to list `native` for it). The dollar budget has no price for the chain's coin, so on a chain with no `native_budget` entry a native spend is an unpriced spend: refused while a `budget` or a `per_host` ceiling is set, unless `"unpriced_spends": "allow"`. Give every chain the wallet spends on an entry.
-- **Approvals are spends.** An ERC-20 allowance (`approve_token`, `approve_permit2`, `increaseAllowance`, `increaseApproval`, either `approveAndCall`, Permit2 `approve`, a signed `permit` in its EIP-2612, DAI or Permit2 shape, or the same calldata through `send_transaction`) is what the spender will take later, so it is priced, checked and reserved on the ledger when it is granted, the spender is checked against the recipient lists, and an unlimited approval (2^128 base units or more) is refused, since no budget can count it; grant an exact amount. An operator grant (`setApprovalForAll`, ERC-777 `authorizeOperator`, EIP-6909 `setOperator`) is unbounded by construction and refused the same way. Every token mover the standards define is a spend to its recipient: ERC-20 `transfer` and `transferFrom`, the ERC-677 and ERC-1363 `transferAndCall` and `transferFromAndCall` shapes, the ERC-223 `transfer` with data, ERC-777 `send` and `operatorSend`, and the ERC-721, ERC-1155 and EIP-6909 transfers, which no budget can price and so are refused under a dollar budget unless `unpriced_spends` is `"allow"`, with the recipient checked either way. A redemption of the wallet's own position is a spend too: ERC-4626 `redeem` and `withdraw` are spends of the vault to the receiver (unpriced, like an NFT), and Aave `Pool.withdraw` is a transfer of the underlying to the receiver. A zero-value call to any other contract (a router, a bridge, a protocol whose payout shape is not listed here) reserves nothing: it can only pull what an approval already granted, or pay out a position in a shape the policy does not know, so a policy that holds positions elsewhere should set `recipients.allow`. The exception is Permit2 itself: a call to it that the policy cannot price (`permitBatch`, `transferFrom`, `permitTransferFrom`, `lockdown`, nonce invalidation, or an unknown selector) is refused under a policy, since each moves tokens or changes what may be moved.
+- **Approvals are spends.** An ERC-20 allowance (`approve_token`, `approve_permit2`, `increaseAllowance`, `increaseApproval`, either `approveAndCall`, Permit2 `approve`, a signed `permit` in its EIP-2612, DAI or Permit2 shape, or the same calldata through `send_transaction`) is what the spender will take later, so it is priced, checked and reserved on the ledger when it is granted, the spender is checked against the recipient lists, and an unlimited approval (2^128 base units or more) is refused, since no budget can count it; grant an exact amount. An operator grant (`setApprovalForAll`, ERC-777 `authorizeOperator`, EIP-6909 `setOperator`) is unbounded by construction and refused the same way. Every token mover the standards define is a spend to its recipient: ERC-20 `transfer` and `transferFrom`, the ERC-677 and ERC-1363 `transferAndCall` and `transferFromAndCall` shapes, the ERC-223 `transfer` with data, ERC-777 `send` and `operatorSend`, and the ERC-721, ERC-1155 and EIP-6909 transfers, which no budget can price and so are refused under a dollar budget unless `unpriced_spends` is `"allow"`, with the recipient checked either way. A redemption of the wallet's own position is a spend too: ERC-4626 `redeem` and `withdraw` are spends of the vault to the receiver (unpriced, like an NFT), and Aave `Pool.withdraw` is a transfer of the underlying to the receiver. A call to any other contract (a router, a bridge, a protocol whose payout shape is not listed here) is refused under a policy unless the contract is in `contracts.allow` or `unknown_calls` is `"allow"`, since 1.14.11: the policy cannot tell what such a call moves, so the operator decides which contracts may receive one. A listed contract's unpriced call reserves nothing beyond the native value it carries: it can only pull what an approval already granted, or pay out a position in a shape the policy does not know, so a policy that lists protocol contracts should set `recipients.allow` too. Permit2 is never admitted this way: a call to it that the policy cannot price (`permitBatch`, `transferFrom`, `permitTransferFrom`, `lockdown`, nonce invalidation, or an unknown selector) is refused under a policy whatever the lists say, since each moves tokens or changes what may be moved.
 - **`hosts`**, **`per_host`**: which endpoints `pay_x402` may pay, and how much per host per day, per month and per payment. A denied host is never contacted, not even for a quote. A host is matched by its canonical DNS name (lowercase, the root label's trailing dot removed), so `api.example.com.` and its percent-encoded spelling are `api.example.com` to every list and to the ledger's per-host sums.
-- **`recipients`**: where funds may go (transfers, x402 `payTo`, approval spenders, contracts that receive native value). The allow list covers those funds destinations; the contract a zero-value call is aimed at (a token being approved, a router) is checked against the deny list and the chain list.
+- **`recipients`**: where funds may go (transfers, x402 `payTo`, approval spenders, contracts that receive native value). The allow list covers those funds destinations; the contract a call is aimed at (a token being approved, a router) is checked against the deny list, the chain list and the `contracts` lists.
 - **`chains`**, **`assets`**: allow lists; an asset entry can be scoped `"8453:0x..."` or be the word `native`.
+- **`contracts`**, **`unknown_calls`**: what the wallet may call with calldata the policy cannot price. The policy prices the token movers, approvals, permits and redemptions listed under "Approvals are spends" below; any other calldata (a swap, a bridge, a protocol call) is refused under a policy unless the contract is in `contracts.allow` (entries scoped `"8453:0x..."` or bare), because a shape the policy does not know could be moving anything. `"unknown_calls": "allow"` restores the pre-1.14.11 behaviour of passing such calls as zero-value contract calls, with their native value still counted. `contracts.deny` refuses every call to a contract, priced or not. Without a policy nothing is refused on this ground.
 - **`approval`**: above `above`, every x402 payment is put to the human at the MCP client through [elicitation](https://modelcontextprotocol.io/specification/2025-06-18/client/elicitation) (the client shows the amount, token, recipient and resource and asks yes or no; a client that declared no elicitation support cannot answer, so the payment is refused). In local mode an accepted answer may admit a payment above the per-payment cap, up to `max`. Budgets are never lifted by anyone's approval.
 - **`tools`**: the tools the model sees. A payer-only deployment exposes seven; the rest are not registered. `wallet_mode` and `spend_policy` are always present so the operator can see what the server is.
 

package/build/index.js

@@ -28,13 +28,13 @@ import { deriveX402Payment, isWithinCap, lookupTrustedDecimals, assertDeclaredDe
 import { createHash } from 'node:crypto';
 import { isLocalMode, getLocalAddress, localWalletRecord, localSend, localNativeBalance, localTokenBalance, localSignMessage, resolveRpcUrl, } from './local-wallet.js';
 import { localSignAuthorization, localEthCall, localGetCode, localSignPermit2Upto, probeTokenDecimals, assertRpcServesChain } from './local-wallet.js';
-import { WRAPPED_NATIVE } from './wrapped-native.js';
+import { WRAPPED_NATIVE, wrappedNativeAddress } from './wrapped-native.js';
 import { buildUptoAuthorization, uptoPayload, permit2AllowanceCalldata, permit2ApproveCalldata, decodeUint, permit2Address, } from './x402-permit2.js';
 import { assessTokenRisk } from './token-risk.js';
 import { isLegacyAgentWalletAccept, requiredAmount, buildAuthorization, buildPaymentPayload, buildPaymentPayloadRaw, paymentHeaderFor, parsePaymentRequired, parseSettlement, pickOption, knownTokenDomain, decodeAbiString as decodeDomainString, parseEip7702Delegation, erc1271ProbeCalldata, classifyErc1271Probe, settlementVerdict, legacyReceiptAllowed, sanitizeRequired, } from './x402-eip3009.js';
 import { isSolanaLocalMode, getSolanaAddress, solanaWalletRecord, localSolBalance, localSplBalance, localSolTransfer, localSplTransfer, resolveSolanaRpc, mintDecimalsStrict, splAccountRent, } from './local-solana.js';
 import { localSimulate } from './local-wallet.js';
-import { loadPolicy, describePolicy, hostAllowed, recipientAllowed, targetAllowed, chainAllowed, assetAllowed, perHostRule, toolAllowed, hostOf, budgetReport, units as policyUnits, human as policyHuman, rawToUnits, } from './policy.js';
+import { loadPolicy, describePolicy, hostAllowed, recipientAllowed, targetAllowed, unknownCallAllowed, chainAllowed, assetAllowed, perHostRule, toolAllowed, hostOf, budgetReport, units as policyUnits, human as policyHuman, rawToUnits, } from './policy.js';
 import { Ledger } from './ledger.js';
 import { markMaybeLive, isMaybeLive, carryMaybeLive, connectionNeverMade } from './maybe-live.js';
 import { discover } from './discovery.js';
@@ -121,6 +121,8 @@ function spendVerdict(input) {
 function usdOf(chainId, asset, raw, decimals) {
     return autopayAssetAllowed(chainId, asset).via === 'stablecoin' ? policyHuman(rawToUnits(raw, decimals)) : null;
 }
+/** WETH9 deposit() and withdraw(uint256): known shapes when aimed at the chain's own wrapped-native contract (wrap_eth, unwrap_eth). */
+const WRAPPED_NATIVE_SELECTORS = new Set(['d0e30db0', '2e1a7d4d']);
 /* Calldata the policy prices: which word holds the amount, which the recipient
    or spender, and for Permit2.approve which the token (there `to` is Permit2).
    The same functions the local token cap prices, so the two guards agree. */
@@ -318,8 +320,15 @@ async function describeSend(body, chainId) {
                 `refused rather than treated as a plain contract call. Use Permit2 approve or a single permit, each of which is reserved as an approval. Nothing was signed.`);
         }
     }
-    if (data && data !== '0x')
-        return { kind: 'contract', to, asset: '', raw: value, decimals: nativeDecimals(chainId) };
+    if (data && data !== '0x') {
+        // A shape the table does not know. Under a policy it is refused unless
+        // the operator listed the contract (assertSendTarget, 1.14.11); the
+        // chain's wrapped-native deposit and withdraw are known shapes, since
+        // wrap_eth and unwrap_eth build them.
+        const selector = /^0x[0-9a-fA-F]{8}/.test(data) ? data.slice(0, 10).toLowerCase() : data.slice(0, 10);
+        const isWrapped = to.toLowerCase() === wrappedNativeAddress(chainId) && WRAPPED_NATIVE_SELECTORS.has(selector.slice(2));
+        return { kind: 'contract', to, asset: '', raw: value, decimals: nativeDecimals(chainId), ...(isWrapped ? {} : { unknown: selector }) };
+    }
     return { kind: 'native', to, asset: '', raw: value, decimals: nativeDecimals(chainId) };
 }
 /** The ledger method a decoded send is recorded under, unless the caller named one. */
@@ -337,15 +346,28 @@ function assertSendTarget(d, chainId) {
     if (!c.ok)
         throw new Error(c.reason + ' Nothing was signed.');
     if (d.kind === 'contract' || d.kind === 'approval') {
-        const t = targetAllowed(POL(), d.kind === 'approval' ? d.asset : d.to);
+        const t = targetAllowed(POL(), d.kind === 'approval' ? d.asset : d.to, chainId);
+        if (!t.ok)
+            throw new Error(t.reason + ' Nothing was signed.');
+    }
+    if (d.kind === 'token' && d.asset) {
+        const t = targetAllowed(POL(), d.asset, chainId); // the token or vault being moved; contracts.deny binds it
         if (!t.ok)
             throw new Error(t.reason + ' Nothing was signed.');
     }
     if (d.carried) {
-        const t = targetAllowed(POL(), d.carried.to); // the contract that keeps the value
+        const t = targetAllowed(POL(), d.carried.to, chainId); // the contract that keeps the value
         if (!t.ok)
             throw new Error(t.reason + ' Nothing was signed.');
     }
+    // Calldata the table cannot price is the operator's call, not the table's
+    // (1.14.11). Without a policy nothing changes: the local caps and the
+    // hosted signer judge the call on their own terms, as before.
+    if (d.unknown && POLICY.path) {
+        const u = unknownCallAllowed(POL(), chainId, d.to, d.unknown);
+        if (!u.ok)
+            throw new Error(u.reason + ' Nothing was signed.');
+    }
 }
 /**
  * The spends a decoded send makes against the policy, in the order they are
@@ -1377,7 +1399,7 @@ function resolveChainId(network) {
 const AddressSchema = z.string().regex(/^(0x[a-fA-F0-9]{40}|[1-9A-HJ-NP-Za-km-z]{32,44})$/, 'Must be a 0x-prefixed 40-hex EVM address or a base58 Solana address');
 const server = new McpServer({
     name: 'agentwallet',
-    version: '1.14.10',
+    version: '1.14.11',
 }, {
     instructions: `AgentWallet gives AI agents their own blockchain wallets. ${anyLocalMode()
         ? 'This server runs in LOCAL (self-custody) mode: the operator supplied the key, signing happens in this process, and the only spend guards are the environment caps (AGENTWALLET_MAX_TX_NATIVE / _TOKEN / _SOL per transaction, AGENTWALLET_MAX_AUTOPAY and AGENTWALLET_AUTOPAY_ASSETS for x402, AGENTWALLET_X402_MAX_TIMEOUT for authorization windows). There is no server-side pause, daily limit or approval email; pause_wallet, unpause_wallet and delete_wallet are refused.'

package/build/policy.d.ts

@@ -35,6 +35,14 @@ export declare const PolicySchema: z.ZodObject<{
     assets: z.ZodOptional<z.ZodObject<{
         allow: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strict>>;
+    contracts: z.ZodOptional<z.ZodObject<{
+        allow: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        deny: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>>;
+    unknown_calls: z.ZodOptional<z.ZodEnum<{
+        allow: "allow";
+        refuse: "refuse";
+    }>>;
     approval: z.ZodOptional<z.ZodObject<{
         above: z.ZodOptional<z.ZodString>;
         max: z.ZodOptional<z.ZodString>;
@@ -96,7 +104,22 @@ export declare function recipientAllowed(p: Policy, to: string): {
     reason: string;
 };
 /** A contract target (approve, wrap, arbitrary calldata): the deny list only; an allow list is about where funds go. */
-export declare function targetAllowed(p: Policy, to: string): {
+export declare function targetAllowed(p: Policy, to: string, chainId?: number): {
+    ok: true;
+} | {
+    ok: false;
+    reason: string;
+};
+/**
+ * May the wallet send calldata the policy cannot price to this contract?
+ * Since 1.14.11 the answer under a policy is no unless the operator listed
+ * the contract or set unknown_calls to "allow": the classifier is a table of
+ * known shapes, and every shape it did not know was, until then, a
+ * zero-value call that reserved nothing (nineteen disclosure rows between
+ * 2026-10-14 and 2026-11-02 were that one gap). The open set is now the
+ * operator's decision, not the table's.
+ */
+export declare function unknownCallAllowed(p: Policy, chainId: number, to: string, selector: string): {
     ok: true;
 } | {
     ok: false;

package/build/policy.js

@@ -35,6 +35,10 @@ export const PolicySchema = z.object({
     recipients: z.object({ allow: z.array(Address).max(1000).optional(), deny: z.array(Address).max(1000).optional() }).strict().optional(),
     chains: z.object({ allow: z.array(z.number().int().positive()).max(100).optional() }).strict().optional(),
     assets: z.object({ allow: z.array(AssetRef).max(500).optional() }).strict().optional(),
+    /** Contracts the wallet may call with calldata the policy cannot price (a router, a bridge, a protocol). Entries may be scoped "chainId:0x...". deny refuses any call to the contract, priced or not. */
+    contracts: z.object({ allow: z.array(AssetRef).max(1000).optional(), deny: z.array(AssetRef).max(1000).optional() }).strict().optional(),
+    /** What to do with calldata the policy cannot price, aimed at a contract not in contracts.allow. Default refuse (1.14.11); "allow" restores the pre-1.14.11 behaviour of passing it as a zero-value call. */
+    unknown_calls: z.enum(['refuse', 'allow']).optional(),
     /** Ask the human (MCP elicitation) above `above`; in local mode an accepted ask may admit up to `max`, above the per-payment cap. */
     approval: z.object({ above: Dec.optional(), max: Dec.optional(), timeout_seconds: z.number().int().min(30).max(3600).optional() }).strict().optional(),
     tools: z.object({ allow: z.array(z.string().regex(/^[a-z_0-9]+$/)).max(100).optional(), deny: z.array(z.string().regex(/^[a-z_0-9]+$/)).max(100).optional() }).strict().optional(),
@@ -102,6 +106,12 @@ export function parsePolicy(text) {
         throw new Error('policy field hosts.allow: an empty allow list would refuse every host; remove it or list hosts.');
     if (p.recipients?.allow && p.recipients.allow.length === 0)
         throw new Error('policy field recipients.allow: an empty allow list would refuse every recipient; remove it or list addresses.');
+    if (p.contracts?.allow && p.contracts.allow.length === 0)
+        throw new Error('policy field contracts.allow: an empty allow list is the default (unpriced calls refused); remove it or list contracts.');
+    for (const k of ['allow', 'deny'])
+        for (const e of p.contracts?.[k] || [])
+            if (e.endsWith('native'))
+                throw new Error(`policy field contracts.${k}: "${e}" is not a contract.`);
     return p;
 }
 /** Load the policy named by AGENTWALLET_POLICY (none set: EMPTY). The ledger path comes from AGENTWALLET_LEDGER, then the policy, then a default next to the policy when a budget needs one. */
@@ -181,11 +191,40 @@ export function recipientAllowed(p, to) {
     return { ok: true };
 }
 /** A contract target (approve, wrap, arbitrary calldata): the deny list only; an allow list is about where funds go. */
-export function targetAllowed(p, to) {
+export function targetAllowed(p, to, chainId) {
     if (p.recipients?.deny?.some(x => sameAddress(x, to)))
         return { ok: false, reason: `policy denies contract target ${to} (recipients.deny).` };
+    if (chainId !== undefined && p.contracts?.deny?.some(e => contractRefMatches(e, chainId, to)))
+        return { ok: false, reason: `policy denies contract ${to} on chain ${chainId} (contracts.deny).` };
     return { ok: true };
 }
+/** "8453:0xabc" matches that contract on that chain; a bare address matches it on every chain. */
+function contractRefMatches(entry, chainId, to) {
+    const i = entry.indexOf(':');
+    if (i < 0)
+        return sameAddress(entry, to);
+    return Number(entry.slice(0, i)) === chainId && sameAddress(entry.slice(i + 1), to);
+}
+/**
+ * May the wallet send calldata the policy cannot price to this contract?
+ * Since 1.14.11 the answer under a policy is no unless the operator listed
+ * the contract or set unknown_calls to "allow": the classifier is a table of
+ * known shapes, and every shape it did not know was, until then, a
+ * zero-value call that reserved nothing (nineteen disclosure rows between
+ * 2026-10-14 and 2026-11-02 were that one gap). The open set is now the
+ * operator's decision, not the table's.
+ */
+export function unknownCallAllowed(p, chainId, to, selector) {
+    if (p.contracts?.allow?.some(e => contractRefMatches(e, chainId, to)))
+        return { ok: true };
+    if ((p.unknown_calls ?? 'refuse') === 'allow')
+        return { ok: true };
+    return {
+        ok: false,
+        reason: `policy: calldata selector ${selector} to ${to} on chain ${chainId} is not a shape the policy can price (a transfer, an approval, a permit, a redemption), and the policy does not list the contract in contracts.allow; ` +
+            `refused rather than passed as a zero-value call. The operator can add "${chainId}:${to}" to contracts.allow, or set unknown_calls to "allow" to let every unpriced call through as before 1.14.11.`,
+    };
+}
 export function chainAllowed(p, chainId) {
     if (p.chains?.allow && !p.chains.allow.includes(chainId))
         return { ok: false, reason: `policy does not allow chain ${chainId}: it is not in chains.allow.` };
@@ -245,6 +284,8 @@ export function describePolicy(lp) {
         recipients: p.recipients ? { allow: p.recipients.allow?.length ?? null, deny: p.recipients.deny?.length ?? null } : null,
         chains: p.chains ?? null,
         assets: p.assets ?? null,
+        contracts: p.contracts ? { allow: p.contracts.allow?.length ?? null, deny: p.contracts.deny?.length ?? null } : null,
+        unknown_calls: lp.path ? (p.unknown_calls ?? 'refuse') : 'allow (no policy set)',
         approval: p.approval ?? null,
         tools: p.tools ?? null,
         ledger: lp.ledgerPath,

package/package.json

@@ -5,7 +5,7 @@
     "type": "git",
     "url": "git+https://github.com/hifriendbot/agentwallet-mcp.git"
   },
-  "version": "1.14.10",
+  "version": "1.14.11",
   "description": "MCP server for AgentWallet: self-custody local signing on EVM and Solana, or hosted wallets. Sign, broadcast, pay x402 invoices, and accept x402 payments.",
   "type": "module",
   "main": "build/index.js",