CanaryGuard 402 MCP server

CanaryGuard 402

-blue)

Deterministic prompt-injection firewall and honeypot scrubber for autonomous AI agents. POST /v1/sanitize costs 0.003 USDC on Base mainnet through the Coinbase CDP x402 facilitator. A remote MCP tool exposes the same inspection with payment per tool call.

• 🌐 Live Web Playground: canaryguard-402.onrender.com
• 🤖 Agent Discovery: canaryguard-402.onrender.com/llms.txt
• 📦 NPM Packages:
• @kurox_real/plugin-canaryguard — Official ElizaOS Plugin
• @kurox_real/agentkit-canaryguard-402 — Coinbase AgentKit Action Provider
• @kurox_real/canaryguard-client — TypeScript SDK with automatic x402 payment handling

Agent Quickstarts

1. ElizaOS Agents (ai16z)

npm install @kurox_real/plugin-canaryguard

import { canaryGuardPlugin } from "@kurox_real/plugin-canaryguard";

export const character = {
  name: "AutonomousAgent",
  plugins: [canaryGuardPlugin],
};

2. Coinbase AgentKit

npm install @kurox_real/agentkit-canaryguard-402

import { canaryGuardActionProvider } from "@kurox_real/agentkit-canaryguard-402";

const agent = await createAgent({
  actionProviders: [canaryGuardActionProvider()],
});

3. TypeScript Client

npm install @kurox_real/canaryguard-client

import { CanaryGuardClient } from "@kurox_real/canaryguard-client";

const client = new CanaryGuardClient();
const result = await client.sanitize("Untrusted scraped text or user prompt", { strictMode: true });

Configuration

These addresses and URLs are public configuration. A URL in this README does not establish that deployment or registry submission has succeeded. Verify health, payment challenges, settlement and catalog visibility separately.

Local setup

Use Node.js 24 or newer. From the repository directory:

npm ci
npm run build
npm test

Create an ignored local .env.local with server configuration. Enter CDP credentials privately; do not place actual values in a shell command, screenshot or tracked file.

CDP_API_KEY_ID=<your CDP key ID>
CDP_API_KEY_SECRET=<your CDP secret>
PUBLIC_URL=https://canaryguard-402.onrender.com
X402_RECIPIENT_ADDRESS=0x73279fa4BadA7CAC888c62CDa4f5c8104765f6f1
NETWORK=base
PORT=4020

PUBLIC_URL must be the HTTPS origin buyers will use, without a path, query or credentials. It supplies discovery URLs even during local testing. CDP verify/settle calls must originate from an IP range allowed by your CDP key. The NETWORK=base configuration alias is normalized to eip155:8453 in protocol messages.

Shortened. The full README is on GitHub.