The NEAR JSON-RPC adapter is a critical bridge. It's a primary attack surface for resource exhaustion and data injection if left with defaults. Most deployments I've reviewed are dangerously permissive.

Focus on these three areas: request throttling, method filtering, and output sanitization.

**1. Enforce Strict Rate Limits**
The adapter must not be an open proxy. Implement limits per user/session, not just global. Use a sliding window algorithm. Example config for a reverse proxy (like NGINX) in front of the adapter:

```nginx
limit_req_zone $binary_remote_addr zone=near_adapter:10m rate=10r/s;

location /near_jsonrpc/ {
limit_req zone=near_adapter burst=20 nodelay;
proxy_pass http://adapter-service:3000;
}
```
Key points:
* Zone size (`10m`) should hold all active IPs.
* Start with a low rate (`10r/s`).
* The `burst` allows for some leeway, but `nodelay` applies the base rate immediately.

**2. Filter Allowed JSON-RPC Methods**
The enclave does not need access to every NEAR RPC method. Whitelist only what's necessary. Implement this at the adapter layer, not just the client. Example middleware logic:

```javascript
const ALLOWED_METHODS = new Set([
'query',
'block',
'status',
'broadcast_tx_commit'
]);

function methodFilter(req, res, next) {
if (req.body?.method && ALLOWED_METHODS.has(req.body.method)) {
next();
} else {
res.status(403).json({ error: 'Method not permitted' });
}
}
```
Deny lists will fail. Update the whitelist based on the agent's specific on-chain interaction requirements.

**3. Sanitize and Limit Query Inputs**
The `query` method is particularly vulnerable. Enforce constraints on:
* `request_type` - Allow only `call_function` or `view_account`.
* `account_id` - Validate against a known pattern.
* `args_base64` - Decode and validate structure/size before forwarding.
* `finality` - Pin to `final` or a specific block height range.

Set low, sane defaults for `max_gas` and output data size limits in the adapter's configuration. The NEAR RPC will respect these, and it prevents a single malformed query from consuming all resources.

Do not rely on the NEAR network's own rate limits. Your adapter is the first line of defense. These controls are non-negotiable for any production integration.