presign-guard

presign-guard

· Live status ·

A pre-sign risk check for AI agents. Before an agent signs a transaction, approval, or EIP-712 signature, it pays a few cents per call over x402 and gets back a green / orange / red verdict with machine-readable reason codes. Optionally, it also gets a plain-language explanation in Dutch or English.

Watch the 1-minute explainer: presign-guard.fizzl.eu/media/explainer.mp4

New: the token verdict in 45 seconds: presign-guard.fizzl.eu/media/token.mp4

Part of Fizzl.

NEAR HACKATHON (track: AI Security & Defense)

The problem. On NEAR an AI agent can be given a function-call key: it can only call the methods it names on one contract, without a deposit, within a gas allowance. That is the right sandbox for an agent with money. But the transactions and NEAR Intents messages an agent signs can take that sandbox apart: a full-access key added, the account deleted, code deployed over the wallet, a key added to NEAR Intents, a swap that gives far more than it gets, a deposit into a look-alike of intents.near. An agent reading a tool result or a web page can be talked into signing any of them.

What we built for NEAR (in the hackathon window). presign-guard, an existing pre-sign check for EVM, Solana, XRPL, Algorand and Stellar, now checks NEAR before an agent signs:

• NEAR transactions (type: "near"): base64 borsh (unsigned or signed), wallet-selector JSON or several transactions; every action judged, meta transactions by their inner actions. Red for a full-access key added, the account deleted, code deployed over the wallet, the last full-access key deleted (read from the account), add_public_key on intents.near, a forced storage_unregister, fake USDC/USDT/wNEAR (ft_metadata), look-alike accounts. Details: NEAR transactions.
• NEAR Intents messages (nep413): the message an agent signs to trade, also inside execute_intents. Red for a token_diff that only gives, or gives back less than half its value at NEAR Intents' own 1Click prices (orange under 90%), a key added, fake tokens received, look-alike receivers; orange for another verifier than intents.near or a deadline days away.
• Every party screened against the OFAC SDN list; the same rules over MCP (presign_check, presign_quick_check).

The NEAR code: src/near-tx.js, test/near-tx.test.mjs, near/demo.mjs, and the wiring in src/presign-guard.js, src/mcp.js and src/discovery.js. Pull requests #259, #260 and #261; everything before them is the existing product (baseline). Libraries: @near-js/transactions and @near-js/utils (decoding only), FastNEAR's public RPC, NEAR Intents' 1Click API (dry quotes and token prices).

Try it (no keys, no money):

1. npm install && node near/demo.mjs: an agent gets a real NEAR Intents quote (1 wNEAR to USDC, dry: true), builds the message it would sign, and checks it and five attacks. See: the honest swap green; a quote tampered to 30% of the value red (NEAR_INTENTS_BAD_PRICE); a key slipped into the swap red (NEAR_INTENTS_KEY_ADDED); a deposit into intents-near.near red (NEAR_LOOKALIKE_ACCOUNT); a prompt-injected full-access key red (NEAR_FULL_ACCESS_KEY_ADDED); a function-call key for intents.near only green. Each case also shows the live server's verdict.
2. Free, no install: curl -s -X POST https://presign-guard.fizzl.eu/v1/check/quick -H 'content-type: application/json' -d '{"type":"near","tx":{"signerId":"alice.near","receiverId":"alice.near","actions":[{"type":"DeleteAccount","params":{"beneficiaryId":"thief.near"}}]}}' and see "verdict":"red".
3. npm test: the NEAR rules against a stand-in RPC (test/near-tx.test.mjs).

The full answer with reason codes (POST /v1/check) costs $0.01 over x402; the verdict-only /v1/check/quick and MCP presign_quick_check are free (10 an hour).

Use it in a few lines: presign-guard-wallet

For agents on viem, the npm package presign-guard-wallet wraps the wallet so every sendTransaction, writeContract and signTypedData is checked first: green signs, orange stops (or asks), red never signs. Each verdict's signed receipt is verified before the wallet acts.

import { guardWallet } from "presign-guard-wallet";

const wallet = guardWallet(walletClient, { pay, onOrange: "stop" }); // pay = an x402 fetch, $0.01 per check await wallet.writeContract({ address: token, abi, functionName: "approve", args: [spender, amount] });

npm install presign-guard-wallet viem @x402/fetch @x402/evm · source and options

Endpoints

Payment is x402 v2 with the exact scheme, on every paid route in USDC on Base, Solana, Monad, Polygon, Arbitrum, Avalanche, Algorand or Stellar, in USD₮0 on X Layer (eip155:196, token 0x779d…3736, settled by PayAI's facilitator), or in RLUSD on the XRP Ledger (xrpl:0, the same dollar amount, issuer rMxCKbEDwqr76QuheSUMdEGf4B9xJ8m5De; the payer signs an XRPL Payment with the challenge's extra.invoiceId as InvoiceID, see @x402/xrpl, and the server verifies and submits it itself). The 402 carries Bazaar discovery metadata (input example, input and output schema), and the challenge is mirrored into the JSON body for clients that don't read the PAYMENT-REQUIRED header. You are never charged for an error. Invalid requests (400) and upstream outages (503) cancel settlement, and they always return verdict: null, never a guessed verdict.

USDC on Polygon (eip155:137), Arbitrum (eip155:42161) and Avalanche C-Chain (eip155:43114) goes to PAY_TO, the same wallet as on Base; Coinbase's facilitator settles it where it lists the network, PayAI's otherwise (EXTRA_EVM_FACILITATOR_URL replaces PayAI). POLYGON_PAY_TO, ARBITRUM_PAY_TO and AVALANCHE_PAY_TO override the wallet, and off leaves that network out.

Credit packs

Agents that call presign-guard often can prepay: one x402 payment of $0.80 for 100 credits or $7.00 for 1000 credits (20% and 30% off), valid for a year. A credit is $0.01 of checks: POST /v1/check, GET /v1/token, GET /v1/screen and POST /v1/injection cost 1, GET /v1/approvals 2, POST /v1/check/explain 3.

# 1. Buy a pack (any x402 client); the answer holds your key

GET /v1/credits/100 -> { "credit_key": "pgc_…", "credits": 100, "expires_at": "…" }

2. Send the key instead of paying; no new payment needed

curl -X POST https://presign-guard.fizzl.eu/v1/check -H 'x-credit-key: pgc_…' -H 'content-type: application/json' -d '{…}'

-> the verdict (signed as usual), with headers x-credit-status: paid and x-credits-remaining: 99

3. Balance

curl https://presign-guard.fizzl.eu/v1/credits -H 'x-credit-key: pgc_…'

A call that fails (400 or 5xx) gives its credits back. With no key, a malformed or unknown key, or too few credits, the call gets the normal 402 (x-credit-status says why), so a client can always fall back to paying per call. Keep the key secret: anyone who has it can spend the credits, and it cannot be recovered (only a SHA-256 of it is stored). Credits work over HTTP; MCP tools are paid per call.

Packs are only offered when balances persist: set CREDITS_REDIS_URL (a persistent Redis, for example a free Upstash database; Render only). Without it the credit routes don't exist.

Open Wallet Standard (OWS) policy

OWS (MoonPay's wallet standard for agents, used by Ripple's XRPL AI Starter Kit) checks policies before it decrypts a key for an agent token (ows_key_…). Its built-in rules cover chains and expiry; anything that looks inside the transaction needs a custom executable, and OWS ships none. presign-guard is one: POST /v1/check also takes the PolicyContext OWS writes to the policy's stdin, and answers with the PolicyResult OWS reads from stdout, { "allow": …, "reason": … }, next to the usual verdict and reasons.

# ~/.ows/plugins/policies/presign-guard.sh (examples/ows/presign-guard.sh), chmod +x

exec curl -s --max-time 4.8 -X POST https://presign-guard.fizzl.eu/v1/check \ -H 'content-type: application/json' -H "x-credit-key: $(cat "$HOME/.ows/presign-guard.key")" --data-binary @-

Buy the credits with OWS itself: ows pay request pays our x402 402 (USDC on Base) and prints the credit key. Run it as the wallet's owner (with the wallet passphrase, not the agent token: the agent token's policy needs the credits first).

key=$(ows pay request --wallet my-wallet https://presign-guard.fizzl.eu/v1/credits/100 | jq -er