TollWarden

TollWarden

A payment security firewall for [x402](https://x402.org) — screen every micropayment before it settles.

-0052FF)

Agents that pay over x402 get drained in predictable ways: secrets leak through payment metadata, captured authorizations get replayed, quoted prices get inflated, and poisoned web content tricks agents into paying addresses they never planned to pay. TollWarden is one POST before settlement that checks for all of it and returns allow / flag / block with machine-readable, per-check reasons — in ~0.6 ms.

TollWarden is advisory and non-custodial: it never touches private keys, wallets, or funds. It wraps around whatever facilitator and wallet your agent already uses. And it's a first-class x402 seller itself — its endpoints are paid via the official x402 middleware, settle through the Coinbase CDP facilitator, and carry Bazaar discovery metadata.

Agent decides to pay ──► POST /v1/scan/outgoing ──► allow ──► wallet settles

│ ├──► flag ──► agent pauses / confirms intent └──► block ──► wallet refuses (reason attached)

Use it in 30 seconds

npm install @tollwarden/client    # TypeScript/Node

pip install tollwarden # Python

import { TollWardenClient, TollWardenBlockedError } from "@tollwarden/client";

const tollwarden = new TollWardenClient({ agentId: "my-agent" }); // free API key auto-minted, 100 free scans

tollwarden.observe(fetchedPageText, { sourceUrl }); // tag what your agent just read → injection detection await tollwarden.guardOutgoing(payment); // throws TollWardenBlockedError on a block verdict

New here? [Protect your x402 agent in 5 minutes →](QUICKSTART.md)

The SDK (sdk/, zero dependencies) also verifies every verdict's Ed25519 attestation against a pinned key, tracks your free-call quota, and can subscribe to plans autonomously. Wallet authors get standalone verifyAttestation() / computePaymentCommitment() — and the enforcement kit: new TollWardenEnforcer({ trustedKeyHex }).guardSigner(account) wraps any viem/ethers signer so it physically refuses to sign an x402 payment authorization without a fresh, payment-bound allow-verdict.

Framework integrations

Building on an agent framework? TollWarden ships drop-in packages that give your agent "scan before you pay" in about two lines — a toolset plus a provenance mechanism that auto-tags what the agent reads, so the prompt-injection-triggered-payment detector works without any prompt engineering:

Each exposes the same three tools (scan / check reputation / report) and a framework-native way to feed what the agent read into injection detection. LangChain uses a callback, CrewAI an after-tool-call hook and the Vercel AI SDK an onStepFinish handler, and all three tag it automatically. NeMo and AgentKit take it as an explicit content argument, and the AgentKit action also fills in the payer from the agent's own wallet. Every package also ships a guarded_payment / guardedPayment wrapper for enforcement by construction (the payment executor never runs on a block verdict), and the NeMo one accepts an async executor. See each package's README for the two-line setup, or its page under tollwarden.com/integrations.

What it catches

The AI agent payment security guide walks through the attacks these checks answer, one failure mode at a time, with each check's limits.

Core detectors

Zero-latency hardening tier — checks that hold even when the calling agent's narration is compromised:

| Deep content analysis | Encoded/obfuscated injection payloads decoded and rescanned: base64 (both alphabets, line-wrapped, space-chunked, double-encoded), hex, percent-encoding, HTML entities, JS/JSON \x/\u escapes, Unicode tag-character smuggling ("invisible ASCII"), zero-width and homoglyph obfuscation (Cyrillic, Greek, IPA, small capitals, dotless-i — plus a mixed-script-word signal for lookalikes the fold table does not know), leetspeak (1gn0re) and letter-spacing (i g n o r e). Every pass is linear in the 200 KB content cap and guarded by a latency test. Bypassed below MICRO_BYPASS_USD (default $0.005) per payment, but drip-resistant: once cumulative scanned spend to a counterparty crosses the same threshold, the deep tier runs an