fix: address password security review for x402_fetch

Intellihackz · Intellihackz · commit 3273b9d3ae9e · 2026-06-24T06:39:10.000+01:00
diff --git a/src/mcp/server.ts b/src/mcp/server.ts
@@ -819,7 +819,7 @@ server.tool(
   'and retrying the request. IMPORTANT: Real on-chain payment with real funds.',
   {
     address: injAddress.describe('The inj1... address of your trading wallet.'),
-    password: z.string().describe('Keystore password to decrypt the private key for signing.'),
+    password: z.string().describe('Keystore password to decrypt the private key for signing. SECURITY: Never log, store, or echo this. Use secret inputs only.'),
     url: z.string().url().describe('The URL of the x402-gated API endpoint.'),
   },
   async ({ address, password, url }) => {

Original file line number	Diff line number	Diff line change
`@@ -819,7 +819,7 @@ server.tool(`
`819`	`819`	`'and retrying the request. IMPORTANT: Real on-chain payment with real funds.',`
`820`	`820`	`{`
`821`	`821`	`address: injAddress.describe('The inj1... address of your trading wallet.'),`
`822`		`- password: z.string().describe('Keystore password to decrypt the private key for signing.'),`
	`822`	`+ password: z.string().describe('Keystore password to decrypt the private key for signing. SECURITY: Never log, store, or echo this. Use secret inputs only.'),`
`823`	`823`	`url: z.string().url().describe('The URL of the x402-gated API endpoint.'),`
`824`	`824`	`},`
`825`	`825`	`async ({ address, password, url }) => {`