fix(mcp): validate wallet addresses and restrict balance API to EVM

apps/mcp/src/index.ts

@@ -10,6 +10,7 @@ import env, { getPort, getTrustedOrigins, isDevelopment } from "./env.js";
 import { auth, db } from "./lib/auth.js";
 import { getBalancesSummary } from "./lib/balance-tracker.js";
 import { isNetworkSupported, type UnifiedNetwork } from "./lib/3rd-parties/cdp/wallet/networks.js";
+import { isEvmNetwork, isValidEvmAddress } from "./lib/validation/address.js";
 import { SecurityHook } from "./lib/proxy/hooks/security-hook.js";
 import { X402WalletHook } from "./lib/proxy/hooks/x402-wallet-hook.js";
 import { VLayerHook } from "./lib/proxy/hooks/vlayer-hook.js";
@@ -138,6 +139,9 @@ app.post("/api/onramp/url", async (c) => {
         if (!walletAddress) {
             return c.json({ error: "Missing walletAddress" }, 400);
         }
+        if (!isValidEvmAddress(walletAddress)) {
+            return c.json({ error: "Invalid walletAddress: expected a valid EVM address" }, 400);
+        }
 
         const url = await createOneClickBuyUrl(walletAddress, {
             network: typeof body.network === "string" && body.network ? body.network : undefined,
@@ -225,6 +229,14 @@ app.get("/api/balance", async (c) => {
             network = "base" as UnifiedNetwork;
         }
 
+        if (!isEvmNetwork(network)) {
+            return c.json({ error: `Network "${network}" is not supported by the balance tracker (EVM only)` }, 400);
+        }
+
+        if (!isValidEvmAddress(walletAddress)) {
+            return c.json({ error: "Invalid walletAddress: expected a valid EVM address" }, 400);
+        }
+
         const summary = await getBalancesSummary(walletAddress as any, network);
 
         const serializeNative = (n: any) => n ? {

apps/mcp/src/lib/validation/address.ts

@@ -0,0 +1,10 @@
+import { isAddress } from "viem";
+import { getNetworkConfig, type UnifiedNetwork } from "../3rd-parties/cdp/wallet/networks.js";
+
+export function isValidEvmAddress(address: string): boolean {
+    return isAddress(address);
+}
+
+export function isEvmNetwork(network: UnifiedNetwork): boolean {
+    return getNetworkConfig(network)?.architecture === "evm";
+}