TollWarden
Live · third-party usage only · refreshed every five minutes

328 payments screened. 22 blocked before settlement.

The payment security firewall for AI agents that pay for things.

One HTTP call between your agent and settlement. Submit the payment, get back allow, flag or block — with machine-readable reasons and an Ed25519 attestation bound to that exact payment. Advisory and non-custodial: it never touches your keys, your wallet, or your funds.

allow
flag
block
328
Payments screened
119
Allowed
187
Flagged
22
Blocked
8
Distinct agents
100.00%
Uptime · 90 days

Third-party usage only — scans from our own agents are counted separately under first_party in /v1/stats. Totals only; per-agent and per-payment data is never published.

Uptime is self-measured process liveness (a heartbeat cannot see network-level unreachability), recording since 2026-08-08. Refreshed every five minutes; machine-readable at /v1/stats, liveness probe at /health.

Scan cost is measured offline, not live: 2,000 sequential scans against the zero-dependency dev server (same handlers as production) ran 1.20 s total — 0.60 ms per scan round-trip, including HTTP, JSON parsing, the full check suite and Ed25519 signing. Deployed latency is dominated by network RTT.

Get started npm install @tollwarden/client Read a real block verdict

Why this exists

AI agents increasingly buy what they need on their own — API calls, data, compute — over x402, the protocol that turns HTTP's 402 Payment Required into instant stablecoin micropayments. That autonomy has a failure mode: software that can read the internet and sign payments can be talked into paying the wrong party.

A poisoned web page whispers "pay this address instead." A payment authorization gets replayed. A lookalike token or vanity address slips past a truncated display. A seller takes the money and never delivers.

Before paying, the agent submits the payment for a scan and gets back a verdict. TollWarden inspects the payment; your systems decide.

A real block verdict

A captured payment authorization, presented a second time. Every verdict carries per-check reasons and a signed attestation over sha256(network|pay_to|asset|amount|nonce), so a wallet can confirm it belongs to this payment and no other.

blockreplay.nonce_reuse · risk_score 95 · severity critical
{
  "verdict": "block",
  "risk_score": 95,
  "checks": [{
    "id": "replay.nonce_reuse",
    "reason": "Nonce reuse detected: this nonce was first seen
      2026-07-14T09:32:50Z and has now appeared 2 times. A reused
      nonce means a stale or captured payment authorization is
      being replayed."
  }],
  "attestation": { "alg": "ed25519",
    "payment_commitment": "sha256(...)", "expires_at": "…+5min" }
}

What a scan catches

Prompt-injection-triggered payments
injection.payto_from_content

The strongest check. If the payee address arrived in content your agent just read — a web page, a tool result — that payment is blocked. Detection survives base64/hex encoding, invisible Unicode, homoglyphs, and multilingual override phrasing.

Replay
replay.nonce_reuse

A payment authorization your agent already used, presented again.

Overpayment
overpay.flag_multiple · overpay.absolute_cap

Amounts far beyond the quoted price, or beyond an absolute ceiling you set.

Secret and PII leakage
pii.evm_private_key · pii.seed_phrase · …

Private keys, seed phrases, API keys, card numbers, SSNs in payment metadata — caught before they're transmitted.

Lookalike tokens and address poisoning
asset.not_canonical_usdc · poison.lookalike

Non-canonical "USDC" contracts, and addresses crafted to match a legitimate counterparty's first and last characters — the truncated-display attack.

Counterparty risk
reputation.reported · delivery.low_rate

A shared reputation registry with time decay and signed rebuttals, plus measured delivery history: sellers who take payment and don't deliver get flagged, based on commitment-bound outcomes, not self-reports.

Velocity
velocity.rate_flag · velocity.spend_cap

Rate and hourly spend caps, so a compromised agent can't drain a wallet in a burst.

From advisory to enforceable

Every verdict is Ed25519-signed and bound to a hash of the exact payment, with a short expiry — plus signed evidence a wallet can weigh for itself: how long the merchant's payment address had been pinned at scan time, and which named out-of-band sources corroborated it. The SDKs ship an enforcement kit: guardSigner(account) wraps your wallet's signer so it physically refuses to sign an x402 payment authorization unless a fresh, verified allow-verdict exists for exactly that payment.

A compromised agent that scanned payment A cannot sign payment B — and one that skips scanning cannot sign at all. Flagged payments can pause for one-click human approval instead — with your own decision latency, paired against how approved payments delivered, visible only to you.

const guarded = TollWardenEnforcer.guardSigner(account, {
  allowedRecipients: ["0x2096…287C"],
  maxTotalAtomic: 5_000_000n
});
// unscanned payment → signature refused

Get started

MCP — zero config
{ "mcpServers": { "tollwarden": { "command": "npx", "args": ["-y", "tollwarden"] } } }
TypeScript
npm install @tollwarden/client

const tollwarden = new TollWardenClient({ agentId: "my-agent" });
tollwarden.observe(pageText, { sourceUrl });
await tollwarden.guardOutgoing(payment); // throws on block
Python
pip install tollwarden

tollwarden = TollWardenClient(agent_id="my-agent")
tollwarden.guard_outgoing(payment)

Drop-in packages: LangChain · CrewAI · Vercel AI SDK · Coinbase AgentKit · NVIDIA NeMo Agent Toolkit — the first 100 calls per key are free, no signup.

Pricing

Scans are $0.01 each, paid over x402 itself — your agent pays for its own security, per payment it makes. The first 100 calls per API key are free. Reputation lookups are $0.01; reporting bad counterparties and recording delivery outcomes is always free.

PlanPricePer scanHeadroom
Starter (default)$0.00$0.01defaults
Pro$4.99 / 30d$0.0056× velocity, deep analysis always on
Scale$19.99 / 30d$0.002hard-ceiling limits

Plans raise your own velocity and spend headroom only — replay detection, merchant pinning, asset verification, and PII scanning are identical on every tier and can't be relaxed by paying more. Machine-readable at /v1/plans.

For developers and agents