v1.2.0 — Security hardening & MCP standards update

An enhanced, security-hardened fork of Worldpay/worldpay-mcp. This release adds a comprehensive documentation set plus a security-hardening and MCP-standards-update pass over upstream e674e2a. Independent; not affiliated with Worldpay.

Full writeup: SECURITY-HARDENING.md

Security (from an independent audit: 2 critical, 4 high, 10 medium, 6 low — all fixed)

• SSRF / credential-leak fix — manage_payment validates commandHref is same-origin as WORLDPAY_URL before attaching credentials.
• HTTP transport authentication — bearer token required on /mcp (fail-closed), DNS-rebinding protection, localhost bind, non-* CORS, per-session server instances, session cap + TTL.
• Card-data / PCI — create_delegate_token accepts network tokens only (no raw PAN/CVC); logs redact card/CVC/billing/hrefs; upstream error bodies sanitized.
• Per-call timeouts, encoded paymentId, tighter validation, UUID/idempotent transactionReference.

MCP standards

• SDK 1.26 → 1.30; MCP tool annotations on all 9 tools; transport security best practices (spec 2025-11-25).

Quality

• 22 tests (up from 5) incl. SSRF-guard, redaction, schema-rejection and HTTP-auth suites · ESLint + Prettier · CI on Node 20 & 22 · multi-stage non-root Docker.

Install the official upstream package from npm; this repository is a documented, hardened variant for review.