Spec Driven Development
by formulahendry
MCP Server that facilitates spec-driven development workflows, not just Vibe Coding.
Runs on your computer★ 440MITUpdated 14 months ago
Install
TollWarden
Overview
Description from the maker (original English)
Screens x402 payments before settlement for injected payee addresses and sellers who never deliver.
PopNx MCP’s three pillars
These three are never merged into one score: opinions, measurements and popularity are different things.
- User voiceiNo reviews yetReviews open together with accounts in a later step
- Our basic checksi1 of 1 passedChecked from public information; code not scanned yet
- UsageiNot measured yet★ –
What you can do with it
We have not written a plain-language summary for this one yet. Below are the facts we read from the registry.
- Connection: Runs on your computer
- Transport: stdio
- Category: Other
Install
Pick the AI app you use, then copy the settings.
Before you install
- Basic checks: 1 of 1 passed
- Runs on your computer with your user’s permissions (files, network, apps).
- The registry lists no key to fill in.
You need
- npmNode.js installed (for the npx command)
Which app do you use?
Pick your app above. We remember it, so next time the button says “Install in …”.
Open Claude Desktop → Settings → Developer → Edit Config, and paste this into claude_desktop_config.json
{
"mcpServers": {
"tollwarden": {
"command": "npx",
"args": [
"-y",
"tollwarden"
]
}
}
}Run this in your terminal
claude mcp add tollwarden -- npx -y tollwardenOr copy the settings yourself
Paste into .cursor/mcp.json in your project, or ~/.cursor/mcp.json
{
"mcpServers": {
"tollwarden": {
"command": "npx",
"args": [
"-y",
"tollwarden"
]
}
}
}Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.
Or copy the settings yourself
Paste into .vscode/mcp.json in your project
{
"servers": {
"tollwarden": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"tollwarden"
]
}
}
}Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.
This one runs on your computer, and ChatGPT can only connect to servers on the internet. Pick another app.
Your choice stays on this device in a cookie; no account needed.
These settings are generated from the maker’s registry entry. If the README says otherwise, follow the README.
What it can do
Runs on your computer; the tool list appears in your AI app after you install it.
Basic checksi
We check information anyone can see; we have not read the code. Checks that do not apply are left out of the count. · Checked Nov 7, 2026
- ✓ Pass
Maker matches the repo
The registry name was verified against the domain tollwarden.com (the registry checks domain ownership)
- … Not checked yet
Still maintained
We have not read this repo from GitHub yet
- … Not checked yet
Has a licence
We have not read this repo from GitHub yet
- – Not applicable
Endpoint responds
This one runs on your computer; there is no internet endpoint
- – Not applicable
Sign-in with OAuth
Runs on your computer and uses local settings instead
- … Not checked yet
No hidden instructions in tool descriptions
Runs on your computer; we can only read tool lists from internet endpoints
Compared with others in Otheri
- More stars than 0% of the other 32602 servers in this category
- Published to the registry more recently than 47% of the other 32602 servers in this category
- Basic checks equal to or better than 100% of the other 32602 servers in this category
Compared with every active server in this category in the registry. Stars count only when the publisher owns the repo.
Common questions
Is TollWarden safe?
It passed 1 of 1 applicable basic checks. We have not read the code. Before adding a key or token, see what access the server asks for and use a key with only the permissions you need.
What keys or codes does it need?
The registry does not list a required key, though some servers ask you to sign in on first use.
Does it run on my computer or in the cloud?
It runs on your computer. Your AI app starts it when needed, and data does not pass through the maker’s servers (unless it calls an online service itself).
Is it still maintained?
The GitHub repo last changed –, and the latest version (1.6.0) reached the registry last month.
Which apps can use it?
Apps that support MCP, such as Claude Desktop, Claude Code, Cursor and VS Code. You also need Node.js on your computer.
What can I use instead?
In the same category: Spec Driven Development, Remote Desktop Commander, Rystic
Alternatives
Servers in the same category from other makers, sorted by stars.
Reading a card:★ GitHub starsiThree pillars: reviews · checks · usageiUpdated = latest version published to the registryi
Remote Desktop Commander
by desktop-commander
Remote Desktop Commander: use files, terminal and processes on your own computers from any AI app.
Runs in the cloud★ 211Updated 2 days ago
Install
Rystic
by Rystic-Inc
Start, seed, clock, inspect and diff Rystic API simulators from your agent.
Runs on your computerUpdated today
Install
README from the maker
Open the README
Copied from the maker’s repo as written. PopNx MCP has not reviewed or endorsed it. HTML, images and scripts are removed. Links lead off this site.
TollWarden
A payment security firewall for [x402](https://x402.org) — screen every micropayment before it settles.
Agents that pay over x402 get drained in predictable ways: secrets leak through payment metadata, captured authorizations get replayed, quoted prices get inflated, and poisoned web content tricks agents into paying addresses they never planned to pay. TollWarden is one POST before settlement that checks for all of it and returns allow / flag / block with machine-readable, per-check reasons — in ~0.6 ms.
TollWarden is advisory and non-custodial: it never touches private keys, wallets, or funds. It wraps around whatever facilitator and wallet your agent already uses. And it's a first-class x402 seller itself — its endpoints are paid via the official x402 middleware, settle through the Coinbase CDP facilitator, and carry Bazaar discovery metadata.
Agent decides to pay ──► POST /v1/scan/outgoing ──► allow ──► wallet settles│ ├──► flag ──► agent pauses / confirms intent └──► block ──► wallet refuses (reason attached)
Use it in 30 seconds
npm install @tollwarden/client # TypeScript/Nodepip install tollwarden # Python
import { TollWardenClient, TollWardenBlockedError } from "@tollwarden/client";const tollwarden = new TollWardenClient({ agentId: "my-agent" }); // free API key auto-minted, 100 free scans
tollwarden.observe(fetchedPageText, { sourceUrl }); // tag what your agent just read → injection detection await tollwarden.guardOutgoing(payment); // throws TollWardenBlockedError on a block verdict
New here? [Protect your x402 agent in 5 minutes →](QUICKSTART.md)
The SDK (sdk/, zero dependencies) also verifies every verdict's Ed25519 attestation against a pinned key, tracks your free-call quota, and can subscribe to plans autonomously. Wallet authors get standalone verifyAttestation() / computePaymentCommitment() — and the enforcement kit: new TollWardenEnforcer({ trustedKeyHex }).guardSigner(account) wraps any viem/ethers signer so it physically refuses to sign an x402 payment authorization without a fresh, payment-bound allow-verdict.
Framework integrations
Building on an agent framework? TollWarden ships drop-in packages that give your agent "scan before you pay" in about two lines — a toolset plus a provenance mechanism that auto-tags what the agent reads, so the prompt-injection-triggered-payment detector works without any prompt engineering:
| Framework | Package | Install |
|---|---|---|
| LangChain | langchain-tollwarden | pip install langchain-tollwarden |
| CrewAI | crewai-tollwarden | pip install crewai-tollwarden |
| NeMo Agent Toolkit | nemo-tollwarden | pip install nemo-tollwarden |
| Coinbase AgentKit | agentkit-tollwarden | pip install agentkit-tollwarden |
| Vercel AI SDK | @tollwarden/ai-sdk | npm install @tollwarden/ai-sdk |
Each exposes the same three tools (scan / check reputation / report) and a framework-native way to feed what the agent read into injection detection. LangChain uses a callback, CrewAI an after-tool-call hook and the Vercel AI SDK an onStepFinish handler, and all three tag it automatically. NeMo and AgentKit take it as an explicit content argument, and the AgentKit action also fills in the payer from the agent's own wallet. Every package also ships a guarded_payment / guardedPayment wrapper for enforcement by construction (the payment executor never runs on a block verdict), and the NeMo one accepts an async executor. See each package's README for the two-line setup, or its page under tollwarden.com/integrations.
What it catches
The AI agent payment security guide walks through the attacks these checks answer, one failure mode at a time, with each check's limits.
Core detectors
| Check | What it catches |
|---|---|
| PII / secret detection | EVM private keys, seed phrases, AWS/OpenAI/Anthropic/GitHub/Slack keys, JWTs, ?api_key= URL credentials, SSNs, Luhn-validated card numbers, emails, phones — in resource_url, description, reason, and metadata, *before* they're transmitted |
| Replay detection | Nonce reuse (stale or captured payment authorizations), scoped network:payer:nonce, configurable TTL window |
| Duplicate purchase | The same purchase authorized twice. x402 clients sign a fresh authorization for every 402 they see, so a retried request arrives as a second valid payment with a new nonce, which nonce-replay checks admit and which can settle alongside the first. An outgoing scan that matches your previous scan of the same purchase (payer, pay_to, asset, amount, resource_url) within 60 s under a different authorization is flagged replay.duplicate_purchase. On API-key scans the flag names the earlier scan_id. Anonymous scope is client-declared, so there the flag never echoes another caller's id. A pre-sign scan and the post-sign scan of the same authorization count once. Deliberate repeats clear it: pass the earlier scan's scan_id as context.repeat_of (one attempt at a time), or report the earlier attempt's outcome as delivered, which the SDK payment wrappers do automatically when a paid call succeeds. not_delivered does not clear it, because that is the attempt that gets retried. Flag-only, since TollWarden sees scans, not settlements, and cannot know the first one settled. A blocked payment records nothing |
| Overpayment detection | Above a configurable multiple of expected price (flag ≥3×, block ≥10×) plus an absolute ceiling |
| Prompt-injection-triggered payments | Payments whose *decision* originated from content the agent just read (tool result / fetched page) rather than its own planning step; escalates on weighted injection tells in that content (override/redirect phrasing across a broad verb/object corpus and in 8 languages: English, Spanish, Portuguese, French, German, Russian, Chinese, Japanese; spoofed system/chat-template/Guidance markers, smuggled model boundary tokens, fabricated conversation turns, concealment, business-email-compromise phrasing — "our payment address has changed, no need to verify" — and urgency pressure), with extra weight when a tell sits near an address-like token. Scored the way injections are shaped: weak tells only add up when they cluster, pressure alone (urgency, transcript form, hidden characters) never blocks, and a human's own "pay X to 0x…" instruction is not scored against them. Content is scanned both raw and with HTML tags, entities and markdown emphasis stripped, so **Ignore** all previous instructions reads as the sentence it renders as. Blocks when the pay_to address itself came from that content — even split across lines or separators, missing its 0x, or laced with invisible characters |
| Resource URL risk (incoming) | IP-literal hosts, punycode/homoglyphs, link shorteners, user@host tricks, non-HTTPS, credential demands ("send your seed phrase") |
| Counterparty reputation | Shared post-hoc report registry, cross-checked on every scan; reporting is always free. Blocked injection scans also feed it automatically: a wallet caught being planted in just-read content (or used as vanity-bait) is flagged on every agent's future scans of it — one detection becomes network-wide protection (flag-only; scan inputs are client-supplied) |
| Delivery outcomes | Measured, commitment-bound delivery history per counterparty — a clean payment to a seller who never ships still fails you. Sellers with low delivery rates or repeated no-ships get flagged (never blocked: H-2 applies to measured history too) |
Zero-latency hardening tier — checks that hold even when the calling agent's narration is compromised:
| Check | What it catches |
|---|---|
| Velocity limits | ≥N scans/min (flag; block at 2×), cumulative hourly spend cap — rate and spend are observed facts, not self-reports. Scoped to the account behind your API key, so a fresh agent_id per request opens no new window; only anonymous scans fall back to agent_id/payer. A payment TollWarden blocks still takes a rate slot but adds nothing to the hourly spend, so a seller's absurd quote, refused at the ceiling, does not lock you out of paying anyone else for the next hour |
| First-contact size cap | First payment to a never-seen counterparty above a threshold |
| Asset verification | asset contract that isn't canonical USDC on the declared network (lookalike-token attack). The network may be a CAIP-2 id or an x402 v1 name (base, base-sepolia, polygon, ethereum); both reach the same check |
| Merchant pinning (TOFU) | Two tiers. Your account's own pin: pay_to rotation on a domain *you* have paid before → block — nobody else can have written that record. Shared observation: the first address *any* caller presented for the domain; a mismatch there is a flag ("another caller saw a different address"), because both sides are client input — it becomes a block only once the non-blocking CDP Bazaar cross-check has verified the pinned address as the domain's merchant. Pin age and the named corroboration sources ship as signed attestation fields (see below), so a wallet can tell a four-minute-old pin from a six-month-old one instead of trusting both equally |
| Address poisoning | pay_to that matches a counterparty you have paid, your own pinned merchant, or a CDP-verified pin on its first + last characters but differs in the middle — the truncated-display ("0x2096…287C") vanity-address attack → block. A lookalike of an address some *other* caller merely presented → flag, so a stranger cannot seed a vanity "pin" and get your honest payment blocked as the lookalike. Also catches bait: a near-copy of the recipient or a trusted address *planted in the content the agent just read*. Blocked payments are rolled back out of trust state, so repeat attempts keep detecting |
| ScoutScore trust signal (opt-in) | Merchant domains rated LOW/VERY_LOW by ScoutScore (spam farms, template clones, dead endpoints) → flag, clearly labeled as an external third-party signal. Lookups are async + cached (zero scan latency), share the domain only, and can never block on their own. Enable with SCOUTSCORE=on |
| Known-bad list | O(1) membership against a curated/synced badlist |
| Deep content analysis | Encoded/obfuscated injection payloads decoded and rescanned: base64 (both alphabets, line-wrapped, space-chunked, double-encoded), hex, percent-encoding, HTML entities, JS/JSON \x/\u escapes, Unicode tag-character smuggling ("invisible ASCII"), zero-width and homoglyph obfuscation (Cyrillic, Greek, IPA, small capitals, dotless-i — plus a mixed-script-word signal for lookalikes the fold table does not know), leetspeak (1gn0re) and letter-spacing (i g n o r e). Every pass is linear in the 200 KB content cap and guarded by a latency test. Bypassed below MICRO_BYPASS_USD (default $0.005) per payment, but drip-resistant: once cumulative scanned spend to a counterparty crosses the same threshold, the deep tier runs an
Only the beginning is shown; read the rest in the repo