verify402-mcp 1.0.6 → 1.0.7

package/README.md

@@ -10,13 +10,13 @@ dedicated hot wallet funded with **Base Sepolia testnet USDC** (`eip155:84532`).
 The analysis reads mainnet chain data, but the demo never settles mainnet
 payments. The bridge never signs or sends a trade.
 
-> **Published package note:** `verify402-mcp@1.0.6` is published to npm and
+> **Published package note:** `verify402-mcp@1.0.7` is published to npm and
 > defaults paid calls to Base Sepolia testnet (`eip155:84532`) for the public
 > demo. Base mainnet (`eip155:8453`) requires an explicit `VERIFY402_NETWORKS`
 > opt-in in a separate deployment and is not enabled by this release. The
-> previously published `1.0.5` package is immutable; `1.0.4` is also immutable
-> and used Base mainnet by default. Do not republish or overwrite either
-> version.
+> previously published `1.0.6` package is immutable; `1.0.5` and `1.0.4` are
+> also immutable, and `1.0.4` used Base mainnet by default. Do not republish or
+> overwrite any of them.
 
 ## Tools
 
@@ -41,6 +41,15 @@ resource is CAUTION `resource_identity_unverified` and `resource identity` is
 listed in `notChecked`. The bridge forwards this policy to the server; the
 server enforces it.
 
+Two optional caller-supplied checks are forwarded as-is:
+
+- `payment.idempotencyKey` + `policy.obligation.settledKeys` rejects a key the
+  caller already settled; `policy.obligation.spentUsd` + `grantUsd` rejects
+  cumulative spend over the grant. The bridge does **not** persist this state.
+- `policy.sellerPayoutWallets` binds `payTo` to the seller's known payout
+  addresses. A mismatch is BLOCK. This is a caller binding, not independent
+  proof that the seller controls the wallet.
+
 The gate is advisory at this layer: the bridge does not hold the agent's
 transaction key and cannot stop an agent that ignores the answer. Enforcement
 belongs in the executor that signs — verify the receipt, then sign. See
@@ -201,9 +210,10 @@ Once configured, your agent automatically sees the tools in its context. You can
   can authorize; they do **not** protect a compromised private key.
 - `preflight_gate` is a check, not a guarantee. Read `notChecked`: it does not
   screen recipient reputation or sanctions, audit contracts, simulate full
-  balance deltas, audit the counterparty, scan tool descriptions or responses
-  for prompt injection, or protect against MEV. It catches the measurable
-  signing mistakes, not every scam.
+  balance deltas, audit the counterparty, independently prove payee ownership,
+  persist an obligation ledger across processes, scan tool descriptions or
+  responses for prompt injection, or protect against MEV. It catches the
+  measurable signing mistakes, not every scam.
 - Use the [reference executor](https://github.com/a32116150-ctrl/verify402/blob/master/examples/preflight-guard.mjs)
   when you want enforcement rather than advice.
 

package/index.mjs

@@ -42,7 +42,7 @@ installConsoleRedaction();
 const IS_MAIN = isMainModule();
 if (IS_MAIN) config();
 
-const VERSION = "1.0.6";
+const VERSION = "1.0.7";
 const EVM_PRIVATE_KEY = process.env.EVM_PRIVATE_KEY;
 // Normalise once so the axios base URL, the payment policy prefix, and the
 // per-tool expected resource are all the same string (no trailing slash).
@@ -222,7 +222,9 @@ const DESCRIPTIONS = {
     "operator before signing. The receipt expires (default 90s): call again rather than reuse it. " +
     "Free. Pass `from` (the wallet that will sign) to enable simulation and balance checks. For " +
     "kind=transaction, chainId is REQUIRED (400 missing_chain without it). For payment intents " +
-    "with no `from` or no proof, the response is PASS with structural_only:true and names what was not checked.",
+    "with no `from` or no proof, the response is PASS with structural_only:true and names what was not checked. " +
+    "Optional caller-supplied checks: policy.sellerPayoutWallets binds payTo to the seller's payout addresses; " +
+    "policy.obligation checks a local settled-key ledger and cumulative spend against a grant. The gate does not persist either state.",
   verify_arbitrage:
     "Ask verify402 whether a cross-venue arbitrage opportunity is REAL, right now. " +
     "Quotes come from Uniswap's canonical QuoterV2 and each DEX router at one pinned block. " +
@@ -268,6 +270,7 @@ async function main() {
         amount: z.string().describe("RAW amount in the asset's smallest unit, as a string"),
         payTo: z.string().describe("Recipient address from the 402 challenge"),
         resource: z.string().optional().describe("The resource URL the payment is for"),
+        idempotencyKey: z.string().max(256).optional().describe("Caller-local payment idempotency key (not the paid-route x-idempotency-key header); enables the policy.obligation replay check"),
         maxTimeoutSeconds: z.number().optional().describe("maxTimeoutSeconds from the 402 challenge"),
         extra: z.object({
           validAfter: z.number().optional(),
@@ -289,6 +292,13 @@ async function main() {
         allowedAssets: z.array(z.string()).optional().describe("Allowlist of payment assets"),
         allowedFacilitators: z.array(z.string()).optional().describe("Allowlist of x402 facilitators"),
         expectedResource: z.string().optional().describe("The exact resource URL the agent intends to pay for"),
+        allowedResourceHosts: z.array(z.string()).optional().describe("Bare hostnames allowed in payment.resource; a foreign host is BLOCK"),
+        sellerPayoutWallets: z.array(z.string()).optional().describe("Caller-supplied seller payout addresses; a payTo mismatch is BLOCK. This is a binding, not independent ownership proof"),
+        obligation: z.object({
+          settledKeys: z.array(z.string()).optional().describe("Payment idempotency keys already settled"),
+          spentUsd: z.number().nonnegative().optional().describe("Already spent under the grant, in USD"),
+          grantUsd: z.number().nonnegative().optional().describe("Total grant in USD; spentUsd and grantUsd must be supplied together"),
+        }).optional().describe("Caller-supplied local obligation state. The public gate does not persist it"),
         forbidUnlimitedApproval: z.boolean().optional().describe("Turn an unlimited approve into a BLOCK"),
         maxTimeoutSeconds: z.number().optional().describe("Reject challenges with a longer timeout"),
       }).optional().describe("Operator policy. Omit for structural checks only."),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "verify402-mcp",
-  "version": "1.0.6",
+  "version": "1.0.7",
   "mcpName": "io.github.a32116150-ctrl/verify402-mcp",
   "description": "MCP server for verify402: a free, fail-closed preflight gate before signing, plus five paid on-chain checks paid per call via x402.",
   "type": "module",