fix(mcp): isolate MPP challenge amounts per concurrent call

Replace shared mutable `lastChallengeAmount` with AsyncLocalStorage
so concurrent tool calls through the MCP proxy each track their own
payment amount without races.

Author: tenequm

CHANGELOG.md

@@ -2,6 +2,12 @@
 
 All notable changes to this project will be documented in this file.
 
+## [0.11.5] - 2026-04-07
+
+### Fixed
+
+- Fix race condition in MPP MCP proxy: concurrent tool calls no longer overwrite each other's payment amounts (replaced shared mutable variable with AsyncLocalStorage per-call context)
+
 ## [0.11.4] - 2026-04-03
 
 ### Added
@@ -64,6 +70,7 @@ All notable changes to this project will be documented in this file.
 - Strip `outputSchema` from proxied MCP tool definitions
 - Downgrade @modelcontextprotocol/sdk to 1.27.1 for compatibility
 
+[0.11.5]: https://github.com/cascade-protocol/x402-proxy/compare/v0.11.4...v0.11.5
 [0.11.4]: https://github.com/cascade-protocol/x402-proxy/compare/v0.11.3...v0.11.4
 [0.11.3]: https://github.com/cascade-protocol/x402-proxy/compare/v0.11.2...v0.11.3
 [0.11.2]: https://github.com/cascade-protocol/x402-proxy/compare/v0.11.1...v0.11.2

packages/x402-proxy/package.json

@@ -1,7 +1,7 @@
 {
   "name": "x402-proxy",
   "private": true,
-  "version": "0.11.4",
+  "version": "0.11.5",
   "description": "curl for x402 and MPP paid APIs with MCP proxy support. Auto-pays HTTP 402 on Base, Solana, and Tempo.",
   "type": "module",
   "sideEffects": false,

packages/x402-proxy/src/commands/mcp.ts

@@ -1,5 +1,6 @@
 declare const __VERSION__: string;
 
+import { AsyncLocalStorage } from "node:async_hooks";
 import { buildCommand, type CommandContext } from "@stricli/core";
 import { TEMPO_NETWORK } from "../handler.js";
 import { appendHistory, displayNetwork, formatAmount, type TxRecord } from "../history.js";
@@ -455,15 +456,17 @@ Wallet is auto-generated on first run. No env vars needed.`,
       const account = privateKeyToAccount(wallet.evmKey as `0x${string}`);
       const maxDeposit = config?.mppSessionBudget ?? "1";
 
-      // Wrap tempo methods to capture payment amounts from challenges
-      let lastChallengeAmount: number | undefined;
+      // Per-call async context to capture payment amounts without races.
+      // Each concurrent callTool gets its own store via AsyncLocalStorage.
+      const challengeAmountStore = new AsyncLocalStorage<{ amount?: number }>();
       const tempoMethods = tempo({ account, maxDeposit });
       const wrappedMethods = tempoMethods.map((m) => ({
         ...m,
         createCredential: async (params: { challenge: { request: Record<string, unknown> } }) => {
           const req = params.challenge.request as { amount?: string; decimals?: number };
-          if (req.amount) {
-            lastChallengeAmount = Number(req.amount) / 10 ** (req.decimals ?? 6);
+          const store = challengeAmountStore.getStore();
+          if (req.amount && store) {
+            store.amount = Number(req.amount) / 10 ** (req.decimals ?? 6);
           }
           return (m.createCredential as (p: unknown) => Promise<string>)(params);
         },
@@ -515,31 +518,32 @@ Wallet is auto-generated on first run. No env vars needed.`,
 
       localServer.setRequestHandler(CallToolRequestSchema, async (request) => {
         const { name, arguments: args } = request.params;
-        const result = await mppClient.callTool({ name, arguments: args ?? {} });
-
-        // Record MPP payment if receipt present
-        if (result.receipt) {
-          const record: TxRecord = {
-            t: Date.now(),
-            ok: true,
-            kind: "mpp_payment",
-            net: TEMPO_NETWORK,
-            from: wallet.evmAddress ?? "unknown",
-            tx: result.receipt.reference,
-            amount: lastChallengeAmount,
-            token: "USDC",
-            label: `mcp:${name}`,
-          };
-          appendHistory(getHistoryPath(), record);
-          const amountStr =
-            lastChallengeAmount !== undefined ? formatAmount(lastChallengeAmount, "USDC") : "";
-          warn(
-            `  MPP payment for tool "${name}" (Tempo)${amountStr ? ` \u00b7 ${amountStr}` : ""}`,
-          );
-          lastChallengeAmount = undefined;
-        }
+        const store = { amount: undefined as number | undefined };
+        return challengeAmountStore.run(store, async () => {
+          const result = await mppClient.callTool({ name, arguments: args ?? {} });
+
+          // Record MPP payment if receipt present
+          if (result.receipt) {
+            const record: TxRecord = {
+              t: Date.now(),
+              ok: true,
+              kind: "mpp_payment",
+              net: TEMPO_NETWORK,
+              from: wallet.evmAddress ?? "unknown",
+              tx: result.receipt.reference,
+              amount: store.amount,
+              token: "USDC",
+              label: `mcp:${name}`,
+            };
+            appendHistory(getHistoryPath(), record);
+            const amountStr = store.amount !== undefined ? formatAmount(store.amount, "USDC") : "";
+            warn(
+              `  MPP payment for tool "${name}" (Tempo)${amountStr ? ` \u00b7 ${amountStr}` : ""}`,
+            );
+          }
 
-        return normalizeCallToolResult(result as CallToolResultLike);
+          return normalizeCallToolResult(result as CallToolResultLike);
+        });
       });
 
       if (remoteResources.length > 0) {