agentwallet-mcp 1.14.7 → 1.14.9

package/README.md

@@ -43,7 +43,7 @@ Use `AGENTWALLET_KEYFILE=/path/to/key` instead if you would rather keep the key
 
 `AGENTWALLET_MAX_TX_NATIVE` is a per-transaction ceiling in native units (ETH, MATIC and so on). In hosted mode the server enforces limits; in local mode there is no server, so these guards are the only ones there are. Set them.
 
-`AGENTWALLET_MAX_TX_TOKEN` is the equivalent ceiling for ERC-20 movement, in human units of the token. **Set this one too if you hold stablecoins.** The native cap cannot see a token transfer: an ERC-20 send carries `value = 0` with the amount in the calldata, so `AGENTWALLET_MAX_TX_NATIVE` alone leaves a USDC balance uncapped. `AGENTWALLET_MAX_TX_TOKEN` covers `transfer`, `transferFrom`, `approve`, `increaseAllowance`, Permit2 `approve`, and `deposit()` / `withdraw(uint256)` on the chain's own wrapped-native contract (so `wrap_eth` and `unwrap_eth` keep working under the cap), the approvals because an unbounded allowance is a drain waiting to happen. Any other calldata sent to a token contract or to Permit2 is refused while the cap is set, because the guard cannot price it; set `AGENTWALLET_ALLOW_UNKNOWN_TOKEN_CALLS=1` to allow such calls deliberately. `increaseAllowance` is judged on the resulting total: the current allowance is read first and the call refuses if it cannot be, so two compliant increments cannot stack a standing allowance above the cap. Calls to other contracts (routers, bridges) pass, since they can only pull what an approval already allowed; a contract counts as "other" only when it demonstrably declines `decimals()`, so an absurd or malformed answer, or an RPC that cannot be reached, refuses rather than allows. Decimals are resolved locally from the trusted registry, then the token's own `decimals()`; a token that resolves neither way is evaluated at 0 decimals, the only value that cannot fail open. For a token outside the registry the RPC is the only source of decimals, and an RPC you do not control could scale the amount and the cap together; pin such tokens with `AGENTWALLET_TOKEN_DECIMALS` (for example `8453:0x<token>=6`) and the pin is used everywhere the RPC's answer would have been.
+`AGENTWALLET_MAX_TX_TOKEN` is the equivalent ceiling for ERC-20 movement, in human units of the token. **Set this one too if you hold stablecoins.** The native cap cannot see a token transfer: an ERC-20 send carries `value = 0` with the amount in the calldata, so `AGENTWALLET_MAX_TX_NATIVE` alone leaves a USDC balance uncapped. `AGENTWALLET_MAX_TX_TOKEN` covers `transfer`, `transferFrom`, `approve`, `increaseAllowance`, EIP-2612 `permit`, Permit2 `approve`, and `deposit()` / `withdraw(uint256)` on the chain's own wrapped-native contract (so `wrap_eth` and `unwrap_eth` keep working under the cap), the approvals because an unbounded allowance is a drain waiting to happen. ERC-721 and ERC-1155 calldata (`setApprovalForAll`, `safeTransferFrom`) is refused while the cap is set, since nothing prices an NFT; without the cap it passes the way an ERC-20 transfer of any size does, except that an operator grant is an unlimited approval and is refused everywhere by default (see `AGENTWALLET_ALLOW_UNLIMITED_APPROVAL`). Any other calldata sent to a token contract or to Permit2 is refused while the cap is set, because the guard cannot price it; set `AGENTWALLET_ALLOW_UNKNOWN_TOKEN_CALLS=1` to allow such calls deliberately. `increaseAllowance` is judged on the resulting total: the current allowance is read first and the call refuses if it cannot be, so two compliant increments cannot stack a standing allowance above the cap. Calls to other contracts (routers, bridges) pass, since they can only pull what an approval already allowed; a contract counts as "other" only when it demonstrably declines `decimals()`, so an absurd or malformed answer, or an RPC that cannot be reached, refuses rather than allows. Decimals are resolved locally from the trusted registry, then the token's own `decimals()`; a token that resolves neither way is evaluated at 0 decimals, the only value that cannot fail open. For a token outside the registry the RPC is the only source of decimals, and an RPC you do not control could scale the amount and the cap together; pin such tokens with `AGENTWALLET_TOKEN_DECIMALS` (for example `8453:0x<token>=6`) and the pin is used everywhere the RPC's answer would have been.
 
 ### Solana local signing
 
@@ -340,6 +340,7 @@ Which guards apply depends on who holds the key.
 - `AGENTWALLET_MAX_FEE_NATIVE`: the most one transaction may burn in fees, gas x max fee per gas, in native units (default `0.01`). The value cap alone did not bound fees: a node answering an absurd tip or gas estimate could take the whole balance as priority fee on a cap-compliant transfer. Caller-supplied `gas_limit` / `max_fee` / `priority_fee` are honoured and then bounded by this cap
 - `AGENTWALLET_MAX_TX_TOKEN`: ceiling per ERC-20 transfer or approval, in human units of the token
 - `AGENTWALLET_ALLOW_UNKNOWN_TOKEN_CALLS`: set to `1` to let calldata the token cap cannot price reach a token contract or Permit2 (refused by default while the cap is set)
+- `AGENTWALLET_ALLOW_UNLIMITED_APPROVAL`: set to `1` to let an unlimited ERC-20 allowance (`approve_token` with `"max"`, `approve_permit2` with no amount) or an NFT operator grant (`setApprovalForAll`) through while no spend policy is set; refused by default, and always refused under a policy
 - `AGENTWALLET_TOKEN_DECIMALS`: pin decimals for tokens outside the registry (`8453:0x<token>=6,<mint>=9`); a pin is used for amounts and caps instead of asking the RPC
 - `AGENTWALLET_MAX_TX_SOL`: ceiling per native SOL transfer (also charged for the rent of a recipient token account an SPL send has to create). It does not cover SPL token amounts: `AGENTWALLET_MAX_TX_TOKEN` does, on Solana as on EVM
 - `AGENTWALLET_MAX_AUTOPAY`: ceiling per x402 auto-payment in stablecoin units (default `1`); `AGENTWALLET_AUTOPAY_ASSETS` opts native or non-stable assets in; `AGENTWALLET_X402_MAX_TIMEOUT` bounds how long a signed authorization stays valid (default 3600 seconds)
@@ -375,7 +376,7 @@ A per-transaction cap bounds one signature. It cannot see that the five hundredt
 
 - **`budget`**: rolling dollar budgets (last 24 hours, last 30 days, lifetime) across every chain, counting x402 payments, stablecoin transfers and stablecoin approvals in registry stablecoins. A spend the budget cannot price (a token outside the registry) is refused while a budget is set, unless `"unpriced_spends": "allow"`. An SPL send is priced at the mint's own decimals; a `token_decimals` hint that disagrees with the mint is refused before any request is made.
 - **`native_budget`**: the same per chain, in the chain's own coin, counting native transfers and the native value sent into any contract (`wrap_eth`, `send_transaction` with value and calldata), including value carried on a token transfer or approval call (a payable token contract keeps it, so it is a second spend, to that contract) and, in local Solana mode, the rent an SPL send pays to create the recipient's token account (the recipient owns that account and can close it for the lamports; the ledger records it as its own line, method `rent`, to the recipient, and `assets.allow` does not need to list `native` for it).
-- **Approvals are spends.** An ERC-20 allowance (`approve_token`, `approve_permit2`, `increaseAllowance`, `approveAndCall`, Permit2 `approve`, or the same calldata through `send_transaction`) is what the spender will take later, so it is priced, checked and reserved on the ledger when it is granted, the spender is checked against the recipient lists, and an unlimited approval (2^128 base units or more) is refused outright, since no budget can count it; grant an exact amount. A zero-value call to any other contract (a router, a bridge) reserves nothing: it can only pull what an approval already granted.
+- **Approvals are spends.** An ERC-20 allowance (`approve_token`, `approve_permit2`, `increaseAllowance`, `approveAndCall`, Permit2 `approve`, a signed `permit` in its EIP-2612, DAI or Permit2 shape, or the same calldata through `send_transaction`) is what the spender will take later, so it is priced, checked and reserved on the ledger when it is granted, the spender is checked against the recipient lists, and an unlimited approval (2^128 base units or more) is refused, since no budget can count it; grant an exact amount. An NFT operator grant (`setApprovalForAll`, ERC-777 `authorizeOperator`) is unbounded by construction and refused the same way, and an ERC-721 or ERC-1155 transfer is a spend of the collection to the recipient that no budget can price, so it is refused under a dollar budget unless `unpriced_spends` is `"allow"`, with the recipient checked either way. A zero-value call to any other contract (a router, a bridge) reserves nothing: it can only pull what an approval already granted. The exception is Permit2 itself: a call to it that the policy cannot price (`permitBatch`, `transferFrom`, `permitTransferFrom`, `lockdown`, nonce invalidation, or an unknown selector) is refused under a policy, since each moves tokens or changes what may be moved.
 - **`hosts`**, **`per_host`**: which endpoints `pay_x402` may pay, and how much per host per day, per month and per payment. A denied host is never contacted, not even for a quote. A host is matched by its canonical DNS name (lowercase, the root label's trailing dot removed), so `api.example.com.` and its percent-encoded spelling are `api.example.com` to every list and to the ledger's per-host sums.
 - **`recipients`**: where funds may go (transfers, x402 `payTo`, approval spenders, contracts that receive native value). The allow list covers those funds destinations; the contract a zero-value call is aimed at (a token being approved, a router) is checked against the deny list and the chain list.
 - **`chains`**, **`assets`**: allow lists; an asset entry can be scoped `"8453:0x..."` or be the word `native`.

package/build/index.js

@@ -13,13 +13,15 @@ import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { z } from 'zod';
 // Validation errors used to echo an unknown key or enum value unbounded, a reflector for a second-stage injection (round 6).
-z.setErrorMap((issue, ctx) => {
-    const cut = (v) => { const t = String(v); return t.length > 80 ? t.slice(0, 80) + '…' : t; };
-    if (issue.code === 'unrecognized_keys')
-        return { message: `Unrecognized key(s) in object: ${issue.keys.map(k => `'${cut(k)}'`).join(', ')}` };
-    if (issue.code === 'invalid_enum_value')
-        return { message: `Invalid enum value. Expected ${issue.options.map(o => `'${o}'`).join(' | ')}, received '${cut(issue.received)}'` };
-    return { message: ctx.defaultError };
+z.config({
+    customError: (issue) => {
+        const cut = (v) => { const t = String(v); return t.length > 80 ? t.slice(0, 80) + '…' : t; };
+        if (issue.code === 'unrecognized_keys')
+            return `Unrecognized key(s) in object: ${issue.keys.map((k) => `'${cut(k)}'`).join(', ')}`;
+        if (issue.code === 'invalid_value')
+            return `Invalid enum value. Expected ${issue.values.map((o) => `'${String(o)}'`).join(' | ')}, received '${cut(issue.input)}'`;
+        return undefined;
+    },
 });
 import { assertPublicUrl, safeFetch, finalUrlOf } from './ssrf-guard.js';
 import { deriveX402Payment, isWithinCap, lookupTrustedDecimals, assertDeclaredDecimals, nativeDecimals, SOLANA_CHAIN_IDS, assetLabel, autopayAssetAllowed, autopayEnvCap, effectiveAutopayCap, maxAuthWindowSeconds, parseDecimalPins, approvalRefusal, authorizationResource, resolveNetworkChainId, normalizeRawAmount, parseAutopayAssets, assetSupportsExact, approvalResourceUrl, } from './x402-payment.js';
@@ -132,8 +134,68 @@ const SPEND_LAYOUTS = {
     '39509351': { kind: 'approval', what: 'increaseAllowance', toIndex: 0, amountIndex: 1 }, // increaseAllowance(address,uint256)
     cae9ca51: { kind: 'approval', what: 'approveAndCall', toIndex: 0, amountIndex: 1 }, // approveAndCall(address,uint256,bytes)
     '87517c45': { kind: 'approval', what: 'Permit2 approve', toIndex: 1, amountIndex: 2, tokenIndex: 0, permit2Only: true }, // Permit2.approve(address,address,uint160,uint48)
+    // ERC-721 / ERC-1155 movers and operator grants (reported privately
+    // 2026-10-26, 1.14.8): none of these was decoded, so an NFT approval or
+    // transfer fell through to 'contract' with value 0 and reached the signer
+    // under a policy with no budget line, no ledger line and no recipient check.
+    // An operator grant is an unbounded approval by construction (`operator`;
+    // amountIndex -1 means there is no amount word, otherwise the bool at that
+    // word says grant or revoke). A transfer moves a token no budget can price
+    // (`nft`; amountIndex -1 means one token), so under a dollar budget it is an
+    // unpriced spend, refused unless unpriced_spends allows it, and its
+    // recipient is checked either way.
+    a22cb465: { kind: 'approval', what: 'setApprovalForAll', toIndex: 0, amountIndex: 1, nft: true, operator: true }, // setApprovalForAll(address,bool)
+    '959b8c3f': { kind: 'approval', what: 'ERC-777 authorizeOperator', toIndex: 0, amountIndex: -1, operator: true }, // authorizeOperator(address)
+    '42842e0e': { kind: 'token', what: 'ERC-721 safeTransferFrom', toIndex: 1, amountIndex: -1, nft: true }, // safeTransferFrom(address,address,uint256)
+    b88d4fde: { kind: 'token', what: 'ERC-721 safeTransferFrom', toIndex: 1, amountIndex: -1, nft: true }, // safeTransferFrom(address,address,uint256,bytes)
+    f242432a: { kind: 'token', what: 'ERC-1155 safeTransferFrom', toIndex: 1, amountIndex: 3, nft: true }, // safeTransferFrom(address,address,uint256,uint256,bytes)
+    '2eb2c2d6': { kind: 'token', what: 'ERC-1155 safeBatchTransferFrom', toIndex: 1, amountIndex: 3, nft: true, batch: true }, // safeBatchTransferFrom(address,address,uint256[],uint256[],bytes)
+    // Signed allowances (reported privately 2026-11-01, 1.14.9): permit() sets
+    // allowance[owner][spender] exactly as approve() does, and the wallet can
+    // produce the owner's signature in-process, so one send_transaction both
+    // signs and broadcasts a standing allowance. None of these was decoded, so
+    // a permit fell through as a zero-value contract call with no budget line,
+    // no ledger line, no spender check and no unlimited refusal: the 1.14.1
+    // bypass again, through a selector that fix did not cover. The owner word
+    // is not compared with the wallet: a permit relayed for another owner is
+    // counted as if it were the wallet's own, which over-counts, never under.
+    d505accf: { kind: 'approval', what: 'EIP-2612 permit', toIndex: 1, amountIndex: 2 }, // permit(address,address,uint256,uint256,uint8,bytes32,bytes32)
+    '8fcbaf0c': { kind: 'approval', what: 'DAI permit', toIndex: 1, amountIndex: 4, operator: true }, // permit(address,address,uint256,uint256,bool,uint8,bytes32,bytes32): allowed=true is unbounded by construction
+    '2b67b570': { kind: 'approval', what: 'Permit2 permit', toIndex: 5, amountIndex: 2, tokenIndex: 1, permit2Only: true }, // Permit2.permit(address,((address,uint160,uint48,uint48),address,uint256),bytes): PermitSingle is static, so inlined
+};
+/* The rest of Permit2's surface, by selector: permitBatch, transferFrom (two
+   shapes), lockdown, permitTransferFrom and permitWitnessTransferFrom (two
+   each), invalidateNonces and invalidateUnorderedNonces. Each moves tokens or
+   changes what may be moved, in shapes this table does not price (a batch is
+   several allowances in one call), so under a policy such a call to the
+   chain's Permit2 is refused rather than let through as a zero-value call to
+   "some contract" (1.14.9). The local token cap has refused the same calls
+   since the 2026-10-04 audit. */
+const PERMIT2_OTHER = {
+    '2a2d80d1': 'permit (batch)', '36c78516': 'transferFrom', '0d58b1db': 'transferFrom (batch)', cc53287f: 'lockdown',
+    '30f28b7a': 'permitTransferFrom', edd9444b: 'permitTransferFrom (batch)', '137c29fe': 'permitWitnessTransferFrom', fe8ec1a7: 'permitWitnessTransferFrom (batch)',
+    '3ff9dcb1': 'invalidateNonces', '65d9723c': 'invalidateUnorderedNonces',
 };
 const UNBOUNDED_APPROVAL = 1n << 128n;
+const UINT256_MAX = (1n << 256n) - 1n;
+/**
+ * The sum of the `amounts` array of an ERC-1155 safeBatchTransferFrom, read
+ * through the caller's word reader so a short word refuses the whole call.
+ * `offsetWord` holds the array's byte offset from the start of the arguments.
+ */
+function batchTotal(wordAt, offsetWord) {
+    const offset = BigInt('0x' + wordAt(offsetWord));
+    if (offset % 32n !== 0n || offset > 1n << 20n)
+        throw new Error('policy: calldata for ERC-1155 safeBatchTransferFrom has a malformed amounts offset; refused rather than treated as a plain contract call. Nothing was signed.');
+    const base = Number(offset / 32n);
+    const count = BigInt('0x' + wordAt(base));
+    if (count > 4096n)
+        throw new Error('policy: calldata for ERC-1155 safeBatchTransferFrom names more than 4096 amounts; refused. Nothing was signed.');
+    let total = 0n;
+    for (let i = 0; i < Number(count); i++)
+        total += BigInt('0x' + wordAt(base + 1 + i));
+    return total;
+}
 async function describeSend(body, chainId) {
     if (body.token_mint) {
         const mint = String(body.token_mint);
@@ -175,14 +237,27 @@ async function describeSend(body, chainId) {
             };
             const token = layout.tokenIndex === undefined ? to : '0x' + wordAt(layout.tokenIndex).slice(24);
             const counterparty = '0x' + wordAt(layout.toIndex).slice(24);
-            const amount = BigInt('0x' + wordAt(layout.amountIndex));
             // The call's own value does not vanish because the calldata was
             // recognised: the contract keeps whatever rides along. It is a second
             // spend, native, to the contract (reported privately 2026-10-23, 1.14.4).
             const carried = BigInt(value) > 0n ? { raw: value, to } : undefined;
+            if (layout.operator) {
+                // setApprovalForAll(operator, false) takes a grant away and moves
+                // nothing: a zero-value call to the collection, reserving nothing.
+                const granted = layout.amountIndex < 0 || BigInt('0x' + wordAt(layout.amountIndex)) !== 0n;
+                if (!granted)
+                    return { kind: 'contract', to, asset: '', raw: value, decimals: nativeDecimals(chainId) };
+                return { kind: 'approval', to: counterparty, asset: token, raw: UINT256_MAX.toString(), decimals: 0, unbounded: true, ...(carried ? { carried } : {}) };
+            }
+            const amount = layout.amountIndex < 0 ? 1n : layout.batch ? batchTotal(wordAt, layout.amountIndex) : BigInt('0x' + wordAt(layout.amountIndex));
             if (layout.kind === 'approval' && amount >= UNBOUNDED_APPROVAL) {
                 return { kind: 'approval', to: counterparty, asset: token, raw: amount.toString(), decimals: 0, unbounded: true, ...(carried ? { carried } : {}) };
             }
+            if (layout.nft) {
+                // A collection has no decimals and no price: whole tokens, unpriced,
+                // to the recipient, recorded under the collection's address.
+                return { kind: layout.kind, to: counterparty, asset: token, raw: amount.toString(), decimals: 0, ...(carried ? { carried } : {}) };
+            }
             // Decimals matter here only to price a registry stablecoin (resolved
             // offline) and to print the ledger amount. A token the registry and the
             // node cannot place is unpriced whatever its decimals, so a failed lookup
@@ -198,6 +273,13 @@ async function describeSend(body, chainId) {
             }
             return { kind: layout.kind, to: counterparty, asset: token, raw: amount.toString(), decimals, ...(carried ? { carried } : {}) };
         }
+        // Every priced layout has returned by now; a Permit2 target here is a call
+        // the table does not know.
+        if (isPermit2 && POLICY.path) {
+            const other = PERMIT2_OTHER[data.slice(2, 10).toLowerCase()];
+            throw new Error(`policy: calldata selector 0x${data.slice(2, 10)} aimed at Permit2 is ${other ? `Permit2 ${other}` : 'not a Permit2 call this policy can price'}, which moves tokens or changes what may be moved in a shape the policy cannot count; ` +
+                `refused rather than treated as a plain contract call. Use Permit2 approve or a single permit, each of which is reserved as an approval. Nothing was signed.`);
+        }
     }
     if (data && data !== '0x')
         return { kind: 'contract', to, asset: '', raw: value, decimals: nativeDecimals(chainId) };
@@ -238,12 +320,25 @@ function assertSendTarget(d, chainId) {
  * carried on a token or approval call is a second spend, native, to the
  * called contract (1.14.4); the rent a local SPL send pays for the recipient's
  * token account is a native spend to the recipient, method 'rent' (1.14.7).
- * Throws for an unbounded approval under a policy.
+ * Throws for an unbounded approval: under a policy always, and otherwise
+ * unless the operator allowed it.
  */
+const unlimitedApprovalsAllowed = () => !POLICY.path && process.env.AGENTWALLET_ALLOW_UNLIMITED_APPROVAL === '1';
+const unlimitedApprovalsReport = () => POLICY.path
+    ? 'refused (a spend policy is set; no budget can count an unlimited allowance)'
+    : unlimitedApprovalsAllowed() ? 'allowed by the operator (AGENTWALLET_ALLOW_UNLIMITED_APPROVAL=1)' : 'refused by default (the operator can set AGENTWALLET_ALLOW_UNLIMITED_APPROVAL=1 while no policy is set)';
 function spendInputsOf(d, chainId, tool, wallet, ctx = {}) {
-    if (d.kind === 'approval' && d.unbounded && POLICY.path) {
-        throw new Error(`policy: an unlimited approval of ${assetLabel(chainId, d.asset)} to ${d.to} cannot be counted against any budget, and under a spend policy every approval is a bounded spend. ` +
-            `Approve an exact amount instead. Nothing was signed.`);
+    if (d.kind === 'approval' && d.unbounded) {
+        // The README promised an unlimited approval was "refused outright" while
+        // the code refused it only under a policy (reported privately 2026-10-26,
+        // 1.14.8). Now the default everywhere; only the operator opens it, and
+        // only where no policy is set.
+        if (POLICY.path)
+            throw new Error(`policy: an unlimited approval of ${assetLabel(chainId, d.asset)} to ${d.to} cannot be counted against any budget, and under a spend policy every approval is a bounded spend. ` +
+                `Approve an exact amount instead. Nothing was signed.`);
+        if (!unlimitedApprovalsAllowed())
+            throw new Error(`an unlimited approval of ${assetLabel(chainId, d.asset)} to ${d.to} is refused by default: it is a standing grant over the whole balance. ` +
+                `Approve an exact amount instead. Only the operator can allow unlimited approvals (AGENTWALLET_ALLOW_UNLIMITED_APPROVAL=1, never under a spend policy). Nothing was signed.`);
     }
     const base = { tool, mode: anyLocalMode() ? 'local' : 'hosted', wallet: anyLocalMode() ? 'local' : wallet, chainId, host: ctx.host ?? null, resource: ctx.resource ?? null };
     const out = [];
@@ -1066,7 +1161,7 @@ function validateGuardEnv() {
         throw new Error(`Unknown environment variable ${k}. AgentWallet refuses to start on an unrecognised AGENTWALLET_* name so that a misspelled cap cannot run uncapped. Known names: ${[...KNOWN_ENV].join(', ')}, AGENTWALLET_RPC_<chainId>, AGENTWALLET_SOLANA_RPC_<chainId>.`);
     }
 }
-const KNOWN_ENV = new Set(["AGENTWALLET_ALLOW_UNKNOWN_TOKEN_CALLS", "AGENTWALLET_API_URL", "AGENTWALLET_APPROVALS", "AGENTWALLET_AUTOPAY_ASSETS", "AGENTWALLET_CHAIN_ID", "AGENTWALLET_DASHBOARD_URL", "AGENTWALLET_KEYFILE", "AGENTWALLET_KEYFILE_PASSPHRASE", "AGENTWALLET_KEYFILE_PASSPHRASE_FILE", "AGENTWALLET_LEDGER", "AGENTWALLET_LEGACY_PAYWALL_ORIGINS", "AGENTWALLET_MAX_AUTOPAY", "AGENTWALLET_MAX_AUTOPAY_PER_HOUR", "AGENTWALLET_MAX_FEE_NATIVE", "AGENTWALLET_MAX_TX_NATIVE", "AGENTWALLET_MAX_TX_SOL", "AGENTWALLET_MAX_TX_TOKEN", "AGENTWALLET_PASS", "AGENTWALLET_PERMIT2_AUTO_APPROVE", "AGENTWALLET_POLICY", "AGENTWALLET_PRIVATE_KEY", "AGENTWALLET_RPC_URL", "AGENTWALLET_SOLANA_KEY", "AGENTWALLET_SOLANA_KEYFILE", "AGENTWALLET_SOLANA_RPC", "AGENTWALLET_TOKEN_DECIMALS", "AGENTWALLET_TOKEN_RISK", "AGENTWALLET_USER", "AGENTWALLET_WALLET_ID", "AGENTWALLET_WEBHOOK_SECRET", "AGENTWALLET_WEBHOOK_URL", "AGENTWALLET_X402_MAX_TIMEOUT"]);
+const KNOWN_ENV = new Set(["AGENTWALLET_ALLOW_UNKNOWN_TOKEN_CALLS", "AGENTWALLET_ALLOW_UNLIMITED_APPROVAL", "AGENTWALLET_API_URL", "AGENTWALLET_APPROVALS", "AGENTWALLET_AUTOPAY_ASSETS", "AGENTWALLET_CHAIN_ID", "AGENTWALLET_DASHBOARD_URL", "AGENTWALLET_KEYFILE", "AGENTWALLET_KEYFILE_PASSPHRASE", "AGENTWALLET_KEYFILE_PASSPHRASE_FILE", "AGENTWALLET_LEDGER", "AGENTWALLET_LEGACY_PAYWALL_ORIGINS", "AGENTWALLET_MAX_AUTOPAY", "AGENTWALLET_MAX_AUTOPAY_PER_HOUR", "AGENTWALLET_MAX_FEE_NATIVE", "AGENTWALLET_MAX_TX_NATIVE", "AGENTWALLET_MAX_TX_SOL", "AGENTWALLET_MAX_TX_TOKEN", "AGENTWALLET_PASS", "AGENTWALLET_PERMIT2_AUTO_APPROVE", "AGENTWALLET_POLICY", "AGENTWALLET_PRIVATE_KEY", "AGENTWALLET_RPC_URL", "AGENTWALLET_SOLANA_KEY", "AGENTWALLET_SOLANA_KEYFILE", "AGENTWALLET_SOLANA_RPC", "AGENTWALLET_TOKEN_DECIMALS", "AGENTWALLET_TOKEN_RISK", "AGENTWALLET_USER", "AGENTWALLET_WALLET_ID", "AGENTWALLET_WEBHOOK_SECRET", "AGENTWALLET_WEBHOOK_URL", "AGENTWALLET_X402_MAX_TIMEOUT"]);
 /**
  * Register a tool whose arguments are strict: an unknown key (max_payemnt for
  * max_payment) is an error that names it, not a silently dropped guard. The
@@ -1192,7 +1287,7 @@ function resolveChainId(network) {
 const AddressSchema = z.string().regex(/^(0x[a-fA-F0-9]{40}|[1-9A-HJ-NP-Za-km-z]{32,44})$/, 'Must be a 0x-prefixed 40-hex EVM address or a base58 Solana address');
 const server = new McpServer({
     name: 'agentwallet',
-    version: '1.14.7',
+    version: '1.14.9',
 }, {
     instructions: `AgentWallet gives AI agents their own blockchain wallets. ${anyLocalMode()
         ? 'This server runs in LOCAL (self-custody) mode: the operator supplied the key, signing happens in this process, and the only spend guards are the environment caps (AGENTWALLET_MAX_TX_NATIVE / _TOKEN / _SOL per transaction, AGENTWALLET_MAX_AUTOPAY and AGENTWALLET_AUTOPAY_ASSETS for x402, AGENTWALLET_X402_MAX_TIMEOUT for authorization windows). There is no server-side pause, daily limit or approval email; pause_wallet, unpause_wallet and delete_wallet are refused.'
@@ -1537,12 +1632,12 @@ tool('call_contract', 'Execute a read-only call against a smart contract (eth_ca
 // ─── Tool: approve_token ────────────────────────────────────────
 tool('approve_token', 'Approve a spender contract to transfer ERC-20 tokens on your behalf. ' +
     'Required before interacting with any DeFi protocol (DEXs, lending, etc.). ' +
-    'Use amount "max" for unlimited approval, or specify an exact amount. ' +
-    'Under a spend policy an approval is a spend: it counts against the budgets, the spender is checked as a recipient, and "max" is refused.', {
+    'Specify an exact amount. "max" (an unlimited allowance) is refused by default and always under a spend policy; only the operator can allow it, with AGENTWALLET_ALLOW_UNLIMITED_APPROVAL=1 while no policy is set. ' +
+    'Under a spend policy an approval is a spend: it counts against the budgets and the spender is checked as a recipient.', {
     wallet_id: z.number().int().describe('Wallet ID'),
     token: z.string().regex(/^0x[a-fA-F0-9]{40}$/).describe('ERC-20 token contract address'),
     spender: z.string().regex(/^0x[a-fA-F0-9]{40}$/).describe('Contract address to approve as spender'),
-    amount: z.string().describe('Amount to approve in human-readable format (e.g. "1000"), or "max" for unlimited'),
+    amount: z.string().describe('Amount to approve in human-readable format (e.g. "1000"); "max" means unlimited and is refused unless the operator allowed it'),
     chain_id: z.number().int().describe('Chain ID'),
     decimals: z.number().int().min(0).max(36).optional().describe('Token decimals. Resolved from the registry or the token contract when omitted; if given, it must match'),
 }, async ({ wallet_id, token, spender, amount, chain_id, decimals: givenDecimals }) => {
@@ -2442,8 +2537,8 @@ tool('check_approval', 'Status of a payment approval created when pay_x402 excee
     'Returns pending, approved, denied or expired. Once approved, call pay_x402 again with approval_id.', { approval_id: z.string().describe('Approval id returned by pay_x402') }, async ({ approval_id }) => jsonResponse(await api(`/approvals/${encodeURIComponent(approval_id)}`, 'GET', undefined, { 'X-AGW-SKIP-X402': 'true' })));
 // ─── Tool: approve_permit2 ──────────────────────────────────────
 tool('approve_permit2', 'One-time ERC-20 approval of a token to the Permit2 contract, needed before paying x402 "upto" endpoints with that token. ' +
-    'A normal on-chain transaction (needs gas). By default approves the maximum, the ecosystem norm, so it never has to be repeated; ' +
-    'pass amount to grant a bounded allowance instead (required under AGENTWALLET_MAX_TX_TOKEN and under a spend policy, both of which refuse a max approval; under a policy the allowance counts against the budgets). ' +
+    'A normal on-chain transaction (needs gas). Pass amount to grant a bounded allowance; with no amount it asks for the maximum, which is refused by default, under AGENTWALLET_MAX_TX_TOKEN, and always under a spend policy (where the allowance counts against the budgets). ' +
+    'Only the operator can allow a maximum approval, with AGENTWALLET_ALLOW_UNLIMITED_APPROVAL=1 while no policy is set. ' +
     'Permit2 itself only moves what each signed authorization allows.', {
     wallet_id: z.number().int().describe('Wallet ID'),
     token: z.string().regex(/^0x[a-fA-F0-9]{40}$/).describe('ERC-20 token address (e.g. USDC on Base)'),
@@ -2907,6 +3002,7 @@ tool('wallet_mode', 'Report whether this server is signing locally (self-custody
             api_base: redactUrl(API_BASE),
             spend_policy: POLICY.path ? { path: POLICY.path, sha256: POLICY.hash, name: POLICY.policy.name ?? null, ledger: POLICY.ledgerPath, see: 'spend_policy' } : 'none (AGENTWALLET_POLICY not set)',
             client_guards: {
+                unlimited_approvals: unlimitedApprovalsReport(),
                 autopay_cap_usd: autopayEnvCap(),
                 internal_autopay_armed: Boolean(X402_WALLET_ID),
                 max_autopay_per_hour: AUTOPAY_PER_HOUR,
@@ -2933,6 +3029,7 @@ tool('wallet_mode', 'Report whether this server is signing locally (self-custody
         x402_max_timeout_seconds: maxAuthWindowSeconds(),
         per_tx_cap_token: (process.env.AGENTWALLET_MAX_TX_TOKEN || '').trim() || 'not set (ERC-20 and SPL transfers are uncapped)',
         allow_unknown_token_calls: process.env.AGENTWALLET_ALLOW_UNKNOWN_TOKEN_CALLS === '1',
+        unlimited_approvals: unlimitedApprovalsReport(),
         token_decimals_pins: parseDecimalPins(process.env.AGENTWALLET_TOKEN_DECIMALS).size,
         token_risk_lookup: process.env.AGENTWALLET_TOKEN_RISK !== '0',
         permit2_auto_approve: process.env.AGENTWALLET_PERMIT2_AUTO_APPROVE === '1',

package/build/local-wallet.js

@@ -351,6 +351,13 @@ const CAP_LAYOUTS = {
     '9bd9bbc6': { amountIndex: 1, what: 'token transfer (ERC-777 send)' }, // send(address,uint256,bytes)
     '62ad1b83': { amountIndex: 2, what: 'token transfer (ERC-777 operatorSend)' }, // operatorSend(address,address,uint256,bytes,bytes)
     '87517c45': { amountIndex: 2, tokenIndex: 0, what: 'Permit2 approval' }, // Permit2.approve(address,address,uint160,uint48)
+    // EIP-2612 permit sets the allowance exactly as approve does, with the
+    // owner's signature in the calldata (the local key can produce it), so it
+    // is priced as an approval (1.14.9, reported privately 2026-11-01). The DAI
+    // permit (0x8fcbaf0c, a bool grant) and Permit2.permit stay unpriced here
+    // and are refused by the rule below, as every unpriced call to a token or to
+    // Permit2 is; the spend policy classifies both.
+    d505accf: { amountIndex: 2, what: 'approval (EIP-2612 permit)' }, // permit(address,address,uint256,uint256,uint8,bytes32,bytes32)
     // WETH9 calls, priced only when `to` is the chain's own wrapped-native
     // contract (wrappedNativeOnly). deposit() carries its amount as msg.value,
     // not in calldata, hence amountIndex -1; withdraw(uint256) has it at word 0.
@@ -404,7 +411,7 @@ async function assertWithinTokenCap(chainId, to, data, valueWei = 0n) {
                 ? `the RPC for chain ${chainId} could not be reached to classify the target, so the guard cannot tell a token from a router`
                 : `the target is ${isPermit2 ? 'Permit2' : 'a token contract'} and this calldata is not one AGENTWALLET_MAX_TX_TOKEN can price`;
             throw new Error(`Blocked by local guard: calldata selector 0x${selector} refused rather than let through uncapped: ${why}. ` +
-                `Use transfer, transferFrom, approve, increaseAllowance, Permit2 approve, ` +
+                `Use transfer, transferFrom, approve, increaseAllowance, EIP-2612 permit, Permit2 approve, ` +
                 `or deposit/withdraw on the chain's wrapped-native contract, ` +
                 `or ask the operator, who alone can set AGENTWALLET_ALLOW_UNKNOWN_TOKEN_CALLS=1.`);
         }

package/build/policy.d.ts

@@ -2,197 +2,50 @@ import { z } from 'zod';
 export declare const PolicySchema: z.ZodObject<{
     version: z.ZodLiteral<1>;
     name: z.ZodOptional<z.ZodString>;
-    /** Rolling budgets in stablecoin (dollar) units across every chain: x402 payments and stablecoin transfers. */
     budget: z.ZodOptional<z.ZodObject<{
         daily: z.ZodOptional<z.ZodString>;
         monthly: z.ZodOptional<z.ZodString>;
         total: z.ZodOptional<z.ZodString>;
-    }, "strict", z.ZodTypeAny, {
-        total?: string | undefined;
-        daily?: string | undefined;
-        monthly?: string | undefined;
-    }, {
-        total?: string | undefined;
-        daily?: string | undefined;
-        monthly?: string | undefined;
-    }>>;
-    /** Rolling budgets for the chain's own coin, keyed by chain id, in that coin's units. */
+    }, z.core.$strict>>;
     native_budget: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
         daily: z.ZodOptional<z.ZodString>;
         monthly: z.ZodOptional<z.ZodString>;
         total: z.ZodOptional<z.ZodString>;
-    }, "strict", z.ZodTypeAny, {
-        total?: string | undefined;
-        daily?: string | undefined;
-        monthly?: string | undefined;
-    }, {
-        total?: string | undefined;
-        daily?: string | undefined;
-        monthly?: string | undefined;
-    }>>>;
-    /** What to do with a spend the budget cannot price (a token outside the registry). Default refuse when a budget is set. */
-    unpriced_spends: z.ZodOptional<z.ZodEnum<["refuse", "allow"]>>;
-    hosts: z.ZodOptional<z.ZodObject<{
-        allow: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-        deny: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-    }, "strict", z.ZodTypeAny, {
-        allow?: string[] | undefined;
-        deny?: string[] | undefined;
-    }, {
-        allow?: string[] | undefined;
-        deny?: string[] | undefined;
+    }, z.core.$strict>>>;
+    unpriced_spends: z.ZodOptional<z.ZodEnum<{
+        allow: "allow";
+        refuse: "refuse";
     }>>;
-    /** Per-host ceilings for x402 payments, dollar units. */
+    hosts: z.ZodOptional<z.ZodObject<{
+        allow: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        deny: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>>;
     per_host: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
         daily: z.ZodOptional<z.ZodString>;
         monthly: z.ZodOptional<z.ZodString>;
         per_payment: z.ZodOptional<z.ZodString>;
-    }, "strict", z.ZodTypeAny, {
-        daily?: string | undefined;
-        monthly?: string | undefined;
-        per_payment?: string | undefined;
-    }, {
-        daily?: string | undefined;
-        monthly?: string | undefined;
-        per_payment?: string | undefined;
-    }>>>;
+    }, z.core.$strict>>>;
     recipients: z.ZodOptional<z.ZodObject<{
-        allow: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-        deny: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-    }, "strict", z.ZodTypeAny, {
-        allow?: string[] | undefined;
-        deny?: string[] | undefined;
-    }, {
-        allow?: string[] | undefined;
-        deny?: string[] | undefined;
-    }>>;
+        allow: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        deny: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>>;
     chains: z.ZodOptional<z.ZodObject<{
-        allow: z.ZodOptional<z.ZodArray<z.ZodNumber, "many">>;
-    }, "strict", z.ZodTypeAny, {
-        allow?: number[] | undefined;
-    }, {
-        allow?: number[] | undefined;
-    }>>;
+        allow: z.ZodOptional<z.ZodArray<z.ZodNumber>>;
+    }, z.core.$strict>>;
     assets: z.ZodOptional<z.ZodObject<{
-        allow: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-    }, "strict", z.ZodTypeAny, {
-        allow?: string[] | undefined;
-    }, {
-        allow?: string[] | undefined;
-    }>>;
-    /** Ask the human (MCP elicitation) above `above`; in local mode an accepted ask may admit up to `max`, above the per-payment cap. */
+        allow: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>>;
     approval: z.ZodOptional<z.ZodObject<{
         above: z.ZodOptional<z.ZodString>;
         max: z.ZodOptional<z.ZodString>;
         timeout_seconds: z.ZodOptional<z.ZodNumber>;
-    }, "strict", z.ZodTypeAny, {
-        max?: string | undefined;
-        above?: string | undefined;
-        timeout_seconds?: number | undefined;
-    }, {
-        max?: string | undefined;
-        above?: string | undefined;
-        timeout_seconds?: number | undefined;
-    }>>;
+    }, z.core.$strict>>;
     tools: z.ZodOptional<z.ZodObject<{
-        allow: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-        deny: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-    }, "strict", z.ZodTypeAny, {
-        allow?: string[] | undefined;
-        deny?: string[] | undefined;
-    }, {
-        allow?: string[] | undefined;
-        deny?: string[] | undefined;
-    }>>;
-    /** Ledger path; relative paths resolve against the policy file's directory. */
+        allow: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        deny: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>>;
     ledger: z.ZodOptional<z.ZodString>;
-}, "strict", z.ZodTypeAny, {
-    version: 1;
-    name?: string | undefined;
-    approval?: {
-        max?: string | undefined;
-        above?: string | undefined;
-        timeout_seconds?: number | undefined;
-    } | undefined;
-    budget?: {
-        total?: string | undefined;
-        daily?: string | undefined;
-        monthly?: string | undefined;
-    } | undefined;
-    native_budget?: Record<string, {
-        total?: string | undefined;
-        daily?: string | undefined;
-        monthly?: string | undefined;
-    }> | undefined;
-    unpriced_spends?: "allow" | "refuse" | undefined;
-    hosts?: {
-        allow?: string[] | undefined;
-        deny?: string[] | undefined;
-    } | undefined;
-    per_host?: Record<string, {
-        daily?: string | undefined;
-        monthly?: string | undefined;
-        per_payment?: string | undefined;
-    }> | undefined;
-    recipients?: {
-        allow?: string[] | undefined;
-        deny?: string[] | undefined;
-    } | undefined;
-    chains?: {
-        allow?: number[] | undefined;
-    } | undefined;
-    assets?: {
-        allow?: string[] | undefined;
-    } | undefined;
-    tools?: {
-        allow?: string[] | undefined;
-        deny?: string[] | undefined;
-    } | undefined;
-    ledger?: string | undefined;
-}, {
-    version: 1;
-    name?: string | undefined;
-    approval?: {
-        max?: string | undefined;
-        above?: string | undefined;
-        timeout_seconds?: number | undefined;
-    } | undefined;
-    budget?: {
-        total?: string | undefined;
-        daily?: string | undefined;
-        monthly?: string | undefined;
-    } | undefined;
-    native_budget?: Record<string, {
-        total?: string | undefined;
-        daily?: string | undefined;
-        monthly?: string | undefined;
-    }> | undefined;
-    unpriced_spends?: "allow" | "refuse" | undefined;
-    hosts?: {
-        allow?: string[] | undefined;
-        deny?: string[] | undefined;
-    } | undefined;
-    per_host?: Record<string, {
-        daily?: string | undefined;
-        monthly?: string | undefined;
-        per_payment?: string | undefined;
-    }> | undefined;
-    recipients?: {
-        allow?: string[] | undefined;
-        deny?: string[] | undefined;
-    } | undefined;
-    chains?: {
-        allow?: number[] | undefined;
-    } | undefined;
-    assets?: {
-        allow?: string[] | undefined;
-    } | undefined;
-    tools?: {
-        allow?: string[] | undefined;
-        deny?: string[] | undefined;
-    } | undefined;
-    ledger?: string | undefined;
-}>;
+}, z.core.$strict>;
 export type Policy = z.infer<typeof PolicySchema>;
 export declare const PRECISION = 18;
 /** Decimal string to an integer at 18 places. */

package/package.json

@@ -5,7 +5,7 @@
     "type": "git",
     "url": "git+https://github.com/hifriendbot/agentwallet-mcp.git"
   },
-  "version": "1.14.7",
+  "version": "1.14.9",
   "description": "MCP server for AgentWallet: self-custody local signing on EVM and Solana, or hosted wallets. Sign, broadcast, pay x402 invoices, and accept x402 payments.",
   "type": "module",
   "main": "build/index.js",
@@ -20,7 +20,7 @@
   "scripts": {
     "build": "tsc",
     "start": "node build/index.js",
-    "test": "node test/x402-payment.test.mjs && node test/eip3009.test.mjs && node test/permit2-risk.test.mjs && node test/token-cap.test.mjs && node test/spl-cap.test.mjs && node test/unknown-decimals-cap.test.mjs && node test/decimals-range-cap.test.mjs && node test/local-mode.test.mjs && node test/ssrf-guard.test.mjs && node test/x402-policy.test.mjs && node test/local-guard-shape.test.mjs && node test/allowance-total-cap.test.mjs && node test/autopay-scheme.test.mjs && node test/spl-recipient-guard.test.mjs && node test/approval-binding.test.mjs && node test/ata-rent-size.test.mjs && node test/final-url-guard.test.mjs && node test/audit-1135.test.mjs && node test/local-no-autopay.test.mjs && node test/audit-1136.test.mjs && node test/delete-confirm.test.mjs && node test/audit-1138.test.mjs && node test/audit-1139.test.mjs && node test/audit-11310.test.mjs && node test/audit-11311.test.mjs && node test/audit-11312.test.mjs && node test/audit-11313.test.mjs && node test/audit-11316.test.mjs && node test/spend-policy.test.mjs && node test/policy-path-resolution.test.mjs",
+    "test": "node test/x402-payment.test.mjs && node test/eip3009.test.mjs && node test/permit2-risk.test.mjs && node test/token-cap.test.mjs && node test/spl-cap.test.mjs && node test/unknown-decimals-cap.test.mjs && node test/decimals-range-cap.test.mjs && node test/local-mode.test.mjs && node test/ssrf-guard.test.mjs && node test/x402-policy.test.mjs && node test/local-guard-shape.test.mjs && node test/allowance-total-cap.test.mjs && node test/autopay-scheme.test.mjs && node test/spl-recipient-guard.test.mjs && node test/approval-binding.test.mjs && node test/ata-rent-size.test.mjs && node test/final-url-guard.test.mjs && node test/audit-1135.test.mjs && node test/local-no-autopay.test.mjs && node test/audit-1136.test.mjs && node test/delete-confirm.test.mjs && node test/audit-1138.test.mjs && node test/audit-1139.test.mjs && node test/audit-11310.test.mjs && node test/audit-11311.test.mjs && node test/audit-11312.test.mjs && node test/audit-11313.test.mjs && node test/audit-11316.test.mjs && node test/spend-policy.test.mjs && node test/policy-path-resolution.test.mjs && node test/server-json-env.test.mjs",
     "prepublishOnly": "npm run build"
   },
   "keywords": [
@@ -59,12 +59,12 @@
     "node": ">=22.19.0"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.30.1",
+    "@modelcontextprotocol/sdk": "^1.32.2",
     "@solana/web3.js": "^1.99.0",
     "bs58": "^6.0.0",
-    "undici": "^8.11.2",
+    "undici": "^8.12.3",
     "viem": "^2.56.9",
-    "zod": "^3.24.0"
+    "zod": "^4.6.7"
   },
   "devDependencies": {
     "@types/node": "^20.0.0",