{"protocolVersion":"0.3.0","name":"TollWarden","description":"Call this before your agent settles any x402 payment to check it for fraud. TollWarden answers 'is this payment safe to send?' and 'is this 402 offer safe to pay?' — catching payments to attacker-controlled addresses injected into content the agent just read (prompt-injection-triggered payments), replayed authorizations, overpayment vs the quote, secrets leaking through payment metadata, fake/lookalike USDC contracts, and address poisoning. Returns allow/flag/block with machine-readable reasons and an Ed25519-signed verdict a wallet can enforce. Non-custodial: never holds keys or funds; wraps whatever wallet/facilitator the agent already uses.","url":"https://paysafe-agent.com","provider":{"organization":"TollWarden","url":"https://paysafe-agent.com"},"version":"1.5.0","capabilities":{"streaming":false,"pushNotifications":false},"defaultInputModes":["application/json"],"defaultOutputModes":["application/json"],"skills":[{"id":"scan_outgoing_payment","name":"Check a payment before sending it","description":"Call before the agent settles an outgoing x402 payment. Answers 'is this safe to send?' — catches paying an address that came from injected content the agent just read, replayed nonces, overpayment vs the quote, secrets/PII in payment metadata, fake/lookalike USDC contracts, address poisoning, and reported counterparties. Returns allow/flag/block.","tags":["security","payments","x402","firewall","fraud-detection","prompt-injection","scam-prevention","wallet-security","agent-safety"],"examples":["Before I pay this, is it safe?","Check this $0.05 USDC payment to 0xabc… for fraud before I settle it","Should I pay this address? It came from a webpage I just read."]},{"id":"scan_incoming_payment","name":"Check a 402 offer before paying it","description":"Call before the agent pays a 402 offer / payment request it received. Answers 'is this offer safe to pay?' — checks the resource URL for spoofing (IP hosts, punycode, shorteners, credential demands), price sanity, replay, and counterparty reputation. Returns allow/flag/block.","tags":["security","payments","x402","firewall","fraud-detection","phishing","scam-prevention"],"examples":["Is this 402 quote from api.example.com safe to pay?","This site is asking me to pay — is it legit?"]},{"id":"counterparty_reputation","name":"Check or report a counterparty address","description":"Look up whether a counterparty address has been reported (scam, non-delivery, prompt injection, overcharge, impersonation, replay abuse), and file your own report for free after a bad experience.","tags":["reputation","payments","x402","fraud-detection","scam-database","blocklist"],"examples":["Has anyone reported 0xdef… for non-delivery?","Is this address known to be a scam?","Report 0xbad… — I paid and got nothing."]}],"payments":{"protocol":"x402","network":"eip155:8453","pricing":{"POST /v1/scan/outgoing":"$0.01 (less on a plan — see /v1/plans)","POST /v1/scan/incoming":"$0.01 (less on a plan — see /v1/plans)","GET /v1/reputation/{address}":"$0.01","POST /v1/reputation/report":"free","GET /v1/plans":"free","POST /v1/plans/subscribe":"x402-paid at the chosen plan's price"},"freeTier":"first 100 calls per API key","plansCatalog":"https://paysafe-agent.com/v1/plans","manifest":"https://paysafe-agent.com/.well-known/x402"}}