IntentFence Agent Action Firewall

IntentFence

IntentFence is a fail-closed authorization firewall for autonomous AI agents. Immediately before a consequential MCP, HTTP, A2A, or payment action, it binds the exact action and payload hash to explicit action/resource allowlists, spend and retention ceilings, and optional action-specific approval. It returns a five-minute ES256 receipt; the TypeScript and Python SDKs verify the receipt and local action digest before executing the caller-owned callback. IntentFence never executes downstream tools and should never receive credentials or wallet keys. It also provides MCP metadata scanning and x402 payment-safety checks.

• safe_to_proceed
• needs_review
• denied

Production: https://agentpass-protocol.rmalka06.chatgpt.site

x402scan: https://www.x402scan.com/server/c495c104-dba4-4764-86b1-96b8b0cda48b

Official MCP Registry: https://registry.modelcontextprotocol.io/v0.1/servers?search=io.github.razel369%2Fintentfence

Protocol surfaces

Fail-closed action authorization

The hosted MCP tools intentfence_authorize_action and intentfence_agent_risk_scan are available without an API key and are rate-limited. Authorization signs the exact caller-supplied action and policy digests for five minutes but does not validate the truth of a self-declared identity or approval source. Production callers must verify the receipt, re-hash the local action, and block on denial, review, expiry, mismatch, network failure, or verification failure. Use the TypeScript enforceAction or Python run_authorized helper to make that boundary executable.

The scanner evaluates caller-supplied MCP metadata only. It highlights missing schemas, annotations, action-bound approval, and financial limits, but does not execute tools, inspect source code, or certify security or compliance.

Official U.S. CPI costs 0.001 USDC; live readiness and wallet risk cost 0.002 USDC; signed preflight and exact-quote assessment cost 0.005 USDC on Base through x402. A successful call returns both the facilitator's PAYMENT-RESPONSE settlement header and an IntentFence ES256 compact-JWS receipt.

Wallet risk is the recommended first check before paying a Base recipient. It uses live Base RPC activity and GoPlus malicious-address intelligence. A safe_to_proceed result means no listed malicious flags were observed and the address was established on Base at assessment time; it does not prove identity, ownership, authorization, or future behavior.

Install the recurring pre-payment skill to attach that check to new Base recipients:

npx skills add razel369/intentfence --skill screen-base-wallets

The skill can run without interrupting an autonomous workflow only when the wallet owner already approved a standing 0.002 USDC screening budget and the wallet enforces it. It blocks the downstream payment on review, denial, missing settlement proof, invalid receipt, or service failure.

The live readiness check is the simplest first call when an agent only has an endpoint URL. It makes one bounded credential-free request, rejects private-network targets and redirects, validates the returned challenge, never pays the target, and signs the result for five minutes.

The quote assessment is the recommended check after an x402 merchant returns its unpaid challenge and before the agent signs the merchant payment. The agent supplies subject, target_url, optional method (GET, HEAD, or POST), the base64 payment_required header (maximum 16 KiB), and a policy with max_price_usdc plus an optional allowed_payees list. IntentFence validates x402 v2, exact scheme, Base mainnet, canonical Base USDC, price, payee, and exact resource binding. It requires the canonical USDC EIP-712 domain and sends Permit2, unknown transfer metadata, and active extensions to review. A safe_to_proceed result requires an explicit matching allowed_payees entry; omitting the list yields needs_review. IntentFence never fetches or pays the target. Every advertised payment option must satisfy every automatic check; mixed safe and unsafe option sets are denied.

Self-service production policy pack

An agent or developer can buy a complete production guard without an account, email, meeting, or sales call:

POST /api/policy-packs

The request selects openai-agents-js, cloudflare-agents, coinbase-agentkit, or mcp-gateway and supplies one exact action plus its allowlists, spend ceiling, retention limit, and optional approval policy. The first request returns an x402 challenge for exactly 1 USDC on Base. After settlement, the same response delivers a copy-ready TypeScript guard, signed action and policy receipt, allowed/denied/over-budget test vectors, and a fail-closed deployment checklist. The buyer must review the generated code and keep all credentials in its own runtime.

Install now

The hosted MCP endpoint is available without an API key:

https://agentpass-protocol.rmalka06.chatgpt.site/api/mcp

Install the local stdio MCP package

Agents and MCP clients that require a local process can run the immutable public 0.11.0 release directly. This does not require an npm account, repository clone, or IntentFence API key:

npx --yes --package https://github.com/razel369/intentfence/releases/download/mcp-v0.11.0/razel369-intentfence-mcp-0.11.0.tgz intentfence-mcp

The release artifact is built and tested by GitHub Actions. Its SHA-256 digest is f0cdf3df28da8a5c037e48193cbb4602744b5fb0b6c182d877abedb707b1e9f9. Use the hosted endpoint above when the client supports Streamable HTTP.

Install in an agent runtime

• OpenAI Agents SDK fail-closed guard
• Cloudflare Agents fail-closed guard
• Coinbase AgentKit pinned x402 checkout
• Generic MCP gateway guard

All adapters keep credentials in the caller runtime and execute the downstream action only after the exact local action digest and ES256 receipt verify.

Opt-in one-call payment for local agents

The local stdio package can handle the x402 challenge, sign it, retry the tool call, and return the settled result without requiring special MCP-client support. Automatic payment is disabled unless all three values below are set:

INTENTFENCE_EVM_PRIVATE_KEY=<buyer-controlled 0x-prefixed key>

INTENTFENCE_MAX_AUTO_PAYMENT_USDC=0.005 INTENTFENCE_AUTO_PAYMENT_BUDGET_USDC=0.05

Supply the key through the agent runtime's secret manager or process environment; never commit it to an MCP configuration file. The package signs only exact Base-mainnet USDC requirements addressed to the published IntentFence recipient, rejects any payment above the per-call ceiling, and reserves every attempted signature against the process-lifetime budget before signing. Failed attempts remain reserved, so retry loops and concurrent calls cannot exceed the cap. The private key stays in the buyer's local process and is never sent to IntentFence.

Build an exact machine checkout

Agents do not need to infer which endpoint, method, payload, or payment cap matches a product. Read the catalog, then submit the exact product input:

curl https://agentpass-protocol.rmalka06.chatgpt.site/api/checkout

curl -X POST https://agentpass-protocol.rmalka06.chatgpt.site/api/checkout \ -H "Content-Type: application/json" \ -d '{"product":"wallet-risk","input":{"address":"0x1111111111111111111111111111111111111111"}}'

The checkout response is free and never initiates payment. It returns a validated HTTP request, shell-safe Agentic Wallet argv, POSIX and PowerShell commands, Coinbase Agentic Wallet MCP instructions, an mcpc --x402 call, the matching Agent Skill, the matching MCP tool and arguments, and an exact Base USDC ceiling. Paid MCP tools advertise _meta.x402 for clients that can sign before the first tool call. Agents must still review and authorize the payment and require PAYMENT-RESPONSE settlement proof.

Install in VS Code

Open the live install panel, then select Install IntentFence in VS Code.

The install action contains only the public server name, transport, and URL. VS Code asks you to review and trust the server before its first start. The free policy-preview tool works with no API key. Paid calls through the hosted server need an x402-capable client; runtimes without one can use the budget-capped local stdio mode above.

Manual .vscode/mcp.json or user-profile fallback:

{

"servers": { "IntentFence": { "type": "http", "url": "https://agentpass-protocol.rmalka06.chatgpt.site/api/mcp" } } }

Review the server details yourself before starting a manually configured server.

See the official VS Code MCP installation documentation.

Install the cross-agent payment guard

Install the open Agent Skill in Codex, Claude Code, Cursor, Gemini CLI, GitHub Copilot, and other skills-compatible agents:

npx skills add razel369/intentfence --skill guard-x402-payments

Review the complete skill before installing it.

The skill triggers when an agent is about to sign an x402 payment. It teaches the agent to capture the exact quote, enforce a caller-defined ceiling and payee allowlist, keep wallet credentials local, and use IntentFence only after the 0.005 USDC assessment fee is authorized. It includes a capped Coinbase Agentic Wallet buyer path for agents that already use an authenticated wallet.

Agents that have only a public x402 URL can install the narrower live-readiness skill. It probes the route without credentials or target payment, blocks redirects and private-network targets, validates the returned challenge, and requires explicit authorization before the 0.002 USDC IntentFence fee:

npx skills add razel369/intentfence --skill inspect-x402-endpoints

The official x402 client buyer example verifies the live fee challenge before creating a signer and is payment-disabled by default:

https://github.com/razel369/intentfence/tree/main/examples/x402-buyer

Agents that already use Coinbase Agentic Wallet can retrieve a complete capped checkout from GET /api/payments under buyer_quickstart. The published command is pinned to a verified CLI version, includes a valid policy body, and sets --max-amount 5000 so it cannot authorize more than the 0.005 USDC IntentFence fee. Review the body and explicitly authorize the real payment before running it.

Projects that already own a Coinbase AgentKit EVM wallet can use th