fix: add production hardening for security and reliability

Security Fixes:
- Add 10mb JSON body size limit to prevent DoS attacks
- Validate EVM_ACCOUNT_INDEX to prevent NaN injection
- Add HTTP server timeouts (120s request, 65s keepalive)

Reliability Fixes:
- Implement session cleanup (30min timeout, check every 5min)
- Update session timestamps on activity to prevent premature cleanup
- Prevent memory leaks from abandoned sessions

These changes ensure the server is production-ready and resilient.

Author: claude

src/core/services/wallet.ts

@@ -12,7 +12,15 @@ import { privateKeyToAccount, mnemonicToAccount, type HDAccount, type PrivateKey
 export const getConfiguredAccount = (): HDAccount | PrivateKeyAccount => {
     const privateKey = process.env.EVM_PRIVATE_KEY;
     const mnemonic = process.env.EVM_MNEMONIC;
-    const accountIndex = parseInt(process.env.EVM_ACCOUNT_INDEX || '0');
+    const accountIndexStr = process.env.EVM_ACCOUNT_INDEX || '0';
+    const accountIndex = parseInt(accountIndexStr, 10);
+
+    // Validate account index
+    if (isNaN(accountIndex) || accountIndex < 0 || !Number.isInteger(accountIndex)) {
+        throw new Error(
+            `Invalid EVM_ACCOUNT_INDEX: "${accountIndexStr}". Must be a non-negative integer.`
+        );
+    }
 
     if (privateKey) {
         // Use private key if provided

src/server/http-server.ts

@@ -12,10 +12,30 @@ console.error(`Configured to listen on ${HOST}:${PORT}`);
 
 // Setup Express
 const app = express();
-app.use(express.json());
+app.use(express.json({ limit: '10mb' })); // Prevent DoS attacks with huge payloads
 
-// Track active transports by session ID
+// Track active transports by session ID with cleanup
 const transports = new Map<string, StreamableHTTPServerTransport>();
+const sessionTimestamps = new Map<string, number>();
+const SESSION_TIMEOUT_MS = 30 * 60 * 1000; // 30 minutes
+
+// Cleanup stale sessions periodically
+setInterval(() => {
+  const now = Date.now();
+  for (const [sessionId, timestamp] of sessionTimestamps.entries()) {
+    if (now - timestamp > SESSION_TIMEOUT_MS) {
+      console.error(`Cleaning up stale session: ${sessionId}`);
+      const transport = transports.get(sessionId);
+      if (transport) {
+        transport.close().catch(err =>
+          console.error(`Error closing stale session ${sessionId}:`, err)
+        );
+      }
+      transports.delete(sessionId);
+      sessionTimestamps.delete(sessionId);
+    }
+  }
+}, 5 * 60 * 1000); // Check every 5 minutes
 
 // Initialize the MCP server
 let server: McpServer | null = null;
@@ -44,6 +64,7 @@ app.post("/mcp", async (req: Request, res: Response) => {
   if (sessionId && transports.has(sessionId)) {
     // Reuse existing transport for this session
     transport = transports.get(sessionId)!;
+    sessionTimestamps.set(sessionId, Date.now()); // Update last activity
     console.error(`Reusing transport for session: ${sessionId}`);
   } else if (!sessionId) {
     // New session - create transport with session ID generator
@@ -52,10 +73,12 @@ app.post("/mcp", async (req: Request, res: Response) => {
       onsessioninitialized: (newSessionId) => {
         console.error(`Session initialized: ${newSessionId}`);
         transports.set(newSessionId, transport);
+        sessionTimestamps.set(newSessionId, Date.now());
       },
       onsessionclosed: (closedSessionId) => {
         console.error(`Session closed: ${closedSessionId}`);
         transports.delete(closedSessionId);
+        sessionTimestamps.delete(closedSessionId);
       }
     });
 
@@ -191,3 +214,7 @@ const httpServer = app.listen(PORT, HOST, () => {
   console.error(`Server error: ${err}`);
   process.exit(1);
 });
+
+// Set server timeout to prevent hanging connections
+httpServer.timeout = 120000; // 2 minutes
+httpServer.keepAliveTimeout = 65000; // 65 seconds