blockrunai/blockrun-mcp

A multi-agent audit pass (finder fan-out across the payment path + freshly-merged Solana image code, each finding adversarially verified) surfaced six real issues — all fixed. Two are budget-gate bypasses on the most-used tools; one is an SSRF deny-list gap.

• fix(chat) — reserve the frontier worst-case for balanced/coding/default modes (the default chat path was reserving 6–20× too little, defeating the cap under concurrency).
• security(ssrf) — strip trailing dots so an FQDN (metadata.google.internal., localhost.) can't bypass the blockrun_image fetch deny-list.
• fix(phone,surf) — price on a normalized path so a query string / trailing slash can't downgrade an expensive route (e.g. the $5 phone/numbers/buy) to the $0.001 default while the gateway charges full.
• fix(image) — re-reserve the Solana quote against the budget before signing, so a marked-up settlement can't blow the cap (mirrors blockrun_video).
• fix(music) — keep the EIP-3009 authorization valid through the whole submit+poll window (was expiring at 300s, failing settlement for slow tracks).
• fix(speech,music) — book settled spend before parsing the response body, so a truncated body can't un-record a real on-chain charge.

103 tests (13 new) + typecheck + build + 18-tool stdio smoke green. No breaking changes.