agentwallet-mcp 1.7.5 → 1.8.0

package/README.md

@@ -160,7 +160,7 @@ AgentWallet natively supports the [x402 open payment standard](https://x402.org)
 4. Retries the request with proof of payment
 5. Returns the final response
 
-**Always set `max_payment` to control spending:**
+**Set `max_payment` to control spending:**
 
 ```
 pay_x402(
@@ -170,7 +170,9 @@ pay_x402(
 )
 ```
 
-Supports ERC-20 tokens, SPL tokens, and native tokens on EVM and Solana. Compatible with x402 V1 and V2 (CAIP-2 chain identifiers).
+`max_payment` is enforced as a hard per-payment cap. If you omit it, `pay_x402` falls back to `AGENTWALLET_MAX_AUTOPAY` (default `1`), the same cap the auto-pay path uses, so a malicious or compromised 402 endpoint can never authorize an unbounded payment. Set `max_payment` explicitly (or raise `AGENTWALLET_MAX_AUTOPAY`) to allow a larger single payment.
+
+Supports ERC-20 tokens, SPL tokens, and native tokens on EVM and Solana. Compatible with x402 V1 and V2 (CAIP-2 chain identifiers), and reads the token address from the standard x402 `asset` field (falling back to `extra.token`).
 
 ## x402 Acceptance
 

package/build/index.js

@@ -12,7 +12,7 @@
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { z } from 'zod';
-import { deriveX402Payment } from './x402-payment.js';
+import { deriveX402Payment, isWithinCap } from './x402-payment.js';
 // ─── Configuration ──────────────────────────────────────────────
 const API_BASE = process.env.AGENTWALLET_API_URL || 'https://hifriendbot.com/wp-json/agentwallet/v1';
 const API_USER = process.env.AGENTWALLET_USER || '';
@@ -221,7 +221,7 @@ function resolveChainId(network) {
 // ─── Server ──────────────────────────────────────────────────────
 const server = new McpServer({
     name: 'agentwallet',
-    version: '1.7.2',
+    version: '1.8.0',
 }, {
     instructions: `AgentWallet gives AI agents their own blockchain wallets. Private keys are encrypted server-side and never exposed — agents sign and broadcast transactions without ever touching raw keys.
 
@@ -744,7 +744,10 @@ server.tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the
     headers: z.string().optional().describe('Optional JSON string of additional request headers'),
     body: z.string().optional().describe('Optional request body for POST/PUT requests'),
     max_payment: z.string().optional().describe('Maximum payment in human-readable format (e.g. "1.00" for 1 USDC). ' +
-        'Rejects payments above this amount. Strongly recommended to prevent overspending.'),
+        'Rejects payments above this amount. If omitted, a default cap of ' +
+        'AGENTWALLET_MAX_AUTOPAY (default "1") is applied, so an untrusted 402 ' +
+        'endpoint can never authorize an unbounded payment. Set this explicitly ' +
+        'to allow a larger single payment.'),
     prefer_chain: z.number().int().optional().describe('Preferred chain ID if the server accepts payment on multiple chains ' +
         '(e.g. 8453 for Base, 1 for Ethereum)'),
 }, async ({ url, wallet_id, method, headers: headersJson, body: reqBody, max_payment, prefer_chain }) => {
@@ -826,35 +829,45 @@ server.tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the
     }
     // Calculate human-readable amount
     const amount = formatUnits(option.maxAmountRequired, option.requiredDecimals);
-    // Step 4: Check spending limit
-    if (max_payment) {
-        const maxRaw = parseUnits(max_payment, option.requiredDecimals);
-        if (BigInt(option.maxAmountRequired) > BigInt(maxRaw)) {
-            return jsonResponse({
-                status: 402,
-                payment_required: true,
-                payment_made: false,
-                error: `Payment of ${amount} ${option.extra?.name || 'tokens'} exceeds your max_payment limit of ${max_payment}`,
-                required_amount: amount,
-                max_allowed: max_payment,
-                token: option.extra?.name || 'native',
-                network: option.network,
-                chain_id: chainId,
-                pay_to: option.payTo,
-                description: option.description,
-            });
-        }
+    // Step 4: Enforce a hard per-payment cap. ALWAYS applied — if the caller
+    // omits max_payment we fall back to AGENTWALLET_MAX_AUTOPAY (default "1"),
+    // mirroring the internal auto-pay path (deriveX402Payment). Without this, an
+    // untrusted or compromised x402 endpoint could return an arbitrarily large
+    // maxAmountRequired and drain the wallet. The cap is never silently skipped.
+    const capSource = max_payment ? 'max_payment' : 'AGENTWALLET_MAX_AUTOPAY';
+    const effectiveMax = max_payment || process.env.AGENTWALLET_MAX_AUTOPAY || '1';
+    if (!isWithinCap(option.maxAmountRequired, option.requiredDecimals, effectiveMax)) {
+        return jsonResponse({
+            status: 402,
+            payment_required: true,
+            payment_made: false,
+            error: `Payment of ${amount} ${option.extra?.name || 'tokens'} exceeds the ` +
+                `${effectiveMax} cap (from ${capSource}).` +
+                (max_payment ? '' : ' No max_payment was provided, so the default cap was applied. ' +
+                    'Pass max_payment (or raise AGENTWALLET_MAX_AUTOPAY) to allow a larger payment.'),
+            required_amount: amount,
+            max_allowed: effectiveMax,
+            cap_source: capSource,
+            token: option.extra?.name || 'native',
+            network: option.network,
+            chain_id: chainId,
+            pay_to: option.payTo,
+            description: option.description,
+        });
     }
+    // Standard x402 puts the token address in `asset`; AgentWallet's own server
+    // currently emits it under extra.token. Prefer the standard field, fall back.
+    const tokenAddress = option.asset || option.extra?.token || '';
     // Step 5: Execute payment
     let txResult;
     if (isSolanaChain(chainId)) {
         // Solana payment
-        if (option.extra?.token) {
+        if (tokenAddress) {
             // SPL token payment (e.g. USDC on Solana)
             txResult = (await api(`/wallets/${wallet_id}/send`, 'POST', {
                 to: option.payTo,
                 value: option.maxAmountRequired,
-                token_mint: option.extra.token,
+                token_mint: tokenAddress,
                 token_decimals: option.requiredDecimals,
                 chain_id: chainId,
             }));
@@ -868,11 +881,11 @@ server.tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the
             }));
         }
     }
-    else if (option.extra?.token) {
+    else if (tokenAddress) {
         // EVM ERC-20 token payment (e.g. USDC)
         const calldata = '0xa9059cbb' + padAddress(option.payTo) + encodeUint256(option.maxAmountRequired);
         txResult = (await api(`/wallets/${wallet_id}/send`, 'POST', {
-            to: option.extra.token,
+            to: tokenAddress,
             value: '0',
             data: calldata,
             chain_id: chainId,
@@ -921,7 +934,7 @@ server.tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the
         payment_made: true,
         amount,
         token: option.extra?.name || 'native',
-        token_address: option.extra?.token || null,
+        token_address: option.asset || option.extra?.token || null,
         network: option.network,
         chain_id: chainId,
         pay_to: option.payTo,

package/build/x402-payment.d.ts

@@ -32,3 +32,17 @@ export declare function deriveX402Payment(accept: X402AcceptLike, maxAutopayHuma
     rawAmount: string;
     decimals: number;
 };
+/**
+ * Returns true if an x402 required amount (already in base/atomic units) is
+ * within a human-readable per-payment cap.
+ *
+ * Shared by both x402 payment paths so neither can authorize an unbounded
+ * transfer: the internal auto-pay path and the public pay_x402 MCP tool both
+ * gate on this. pay_x402 uses it (instead of deriveX402Payment's throw) so it
+ * can return a structured rejection to the calling agent.
+ *
+ * @param rawAmountRequired x402 maxAmountRequired, already in base units
+ * @param decimals          token decimals
+ * @param capHuman          cap in human-readable units of the asset (e.g. "1")
+ */
+export declare function isWithinCap(rawAmountRequired: string, decimals: number, capHuman: string): boolean;

package/build/x402-payment.js

@@ -44,3 +44,23 @@ export function deriveX402Payment(accept, maxAutopayHuman) {
     }
     return { tokenAddress, rawAmount, decimals };
 }
+/**
+ * Returns true if an x402 required amount (already in base/atomic units) is
+ * within a human-readable per-payment cap.
+ *
+ * Shared by both x402 payment paths so neither can authorize an unbounded
+ * transfer: the internal auto-pay path and the public pay_x402 MCP tool both
+ * gate on this. pay_x402 uses it (instead of deriveX402Payment's throw) so it
+ * can return a structured rejection to the calling agent.
+ *
+ * @param rawAmountRequired x402 maxAmountRequired, already in base units
+ * @param decimals          token decimals
+ * @param capHuman          cap in human-readable units of the asset (e.g. "1")
+ */
+export function isWithinCap(rawAmountRequired, decimals, capHuman) {
+    if (!/^\d+$/.test(rawAmountRequired)) {
+        throw new Error(`Invalid maxAmountRequired "${rawAmountRequired}" (expected an integer base-unit amount).`);
+    }
+    const capRaw = toBaseUnits(capHuman, decimals);
+    return BigInt(rawAmountRequired) <= BigInt(capRaw);
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "agentwallet-mcp",
   "mcpName": "io.github.hifriendbot/agentwallet",
-  "version": "1.7.5",
+  "version": "1.8.0",
   "description": "MCP server for AgentWallet: lets AI agents create wallets, sign transactions, broadcast on EVM + Solana, pay x402 invoices, and accept x402 payments",
   "type": "module",
   "main": "build/index.js",