402sentinel MCP server
x402 payment safety for AI agents: counterparty risk gate, payment firewall, compliance, RWA gate.
1 stars49 downloads/wk
Reviews
Write oneNobody has reviewed 402sentinel yet.
If you have run it, two minutes of your experience saves the next person an afternoon.
402sentinel tools (10)
write = sends, deletes, buys or postsRead from the package source without running it. The installed server may list more.
assess_counterpartyAssess the risk of an x402 counterparty (a payTo address) BEFORE paying. Returns a 0-100 risk_score, an allow/review/block decision, honest confidence/coverage, and a ready-to-apply recommended_policy (per-counterparty caps + approval/denylist), scored from on-chain settlement behaviour on Base + a delivery-outcome flywheel. Call before authorizing any x402 payment above your risk threshold. Costs
assess_counterparty_deepLike assess_counterparty but scans more on-chain settlement history for a higher-confidence read. Use for larger or higher-stakes payments. Costs $0.02 (paid automatically in USDC).
assess_rwaRWA risk gate — score a TOKENIZED ASSET (tokenized treasury/stock/credit) BEFORE buying it. Detects PERMISSIONED securities an agent can buy but NOT transfer/redeem (= trapped funds): proxy-aware transfer-restriction scan (resolves the EIP-1967 implementation; ERC-1404/ERC-3643/allowlist/freeze/pause), a behavioral transfer simulation (on-chain revert = the gate is live), live pause state, token i
compliance_checkPre-pay COMPLIANCE screen for regulated-money x402 flows. Returns compliance_decision (pass/flag/block), diligence_tier, obligations, and checks: OFAC sanctions (hit = hard block), counterparty due-diligence tier from the on-chain risk engine, structuring/smurfing detection (many sub-threshold payments to one counterparty aggregating to a reportable sum in 24h — pass target.agent_id, e.g. your wal
firewallBuyer-side payment firewall: should YOUR agent make THIS payment now? Where assess_counterparty vets the seller, this vets the payment instruction in the context of your agent's own history + provenance. Returns allow/hold/block + signals: routing_anomaly (payTo swapped vs the address you usually pay = fraudulent routing), velocity_anomaly (drain), amount_anomaly (overcharge), provenance_flag, cou
firewall_outcomeFREE. After a firewall verdict, report what actually happened so 402Sentinel learns which signals are predictive and downweights noisy ones (hard-block safety signals stay deterministic). Pass the assessment_id (fw_…) from a prior firewall call.
firewall_recordFREE. Seed your agent's payment history so the firewall has a behavioural baseline (record past/known-good payments). agent_id and the wallet-ownership signature are attached automatically from your configured wallet, so the seeded history is trusted.
recommend_policyTurn a counterparty's risk into an enforceable spending policy you can apply to your agent wallet. Returns an allow/limit/deny decision plus recommended_policy: max_payment_usdc (per-counterparty cap), daily_cap_usdc, add_to_denylist, require_human_approval. Costs $0.002 (paid automatically in USDC).
report_outcomeFREE. After you pay a counterparty, report whether they delivered so 402Sentinel's settlement-reliability flywheel can learn. Pass the assessment_id returned by a prior assessment.
verify_service402Sentinel Verified (opt-in badge): submit YOUR OWN service's payTo for a deep settlement-graph audit (facilitator-aware, multi-hop, exchange-labelled). If it passes (organic, sufficient confidence), a signed time-boxed (30d) credential is issued and your service joins the public allow-list at /api/verified. Positive-only: failing audits are returned privately, never published. SLOW (deep on-chai
Public scan report
scanner v0.1.9 · 2026-09-27 · same rubric, same numbers if you re-run it
- Code scan2 source files scanned25/25
- –Live reliabilityno gateway calls yet and no remote to proben/a
- –Tool poisoningtools not inspected (local package is not executed); not countedn/a
- Auth qualitystatic API keys via environment variables6/15
- Maintenancelast push 21 days ago15/15
- Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10
What the publisher says
From the 402sentinel repository's README, as published. We do not edit it. Read it on GitHub
402sentinel-mcp
MCP tools that let your AI agent check an x402 counterparty's risk before it pays — and turn that risk into an enforceable wallet spending policy. Give it a payTo address, get back a 0–100 risk score + an allow / review / block decision, scored from on-chain settlement behaviour on Base (address age, facilitator-aware payer diversity, settlement maturity) + a delivery-outcome flywheel, with honest confidence/coverage.
Tools — vet the seller:
- assesscounterparty ($0.002) — risk score + decision + a ready-to-apply recommendedpolicy
- assesscounterpartydeep ($0.02) — same, scans more on-chain history
- recommend_policy ($0.002) — decision + wallet-ready spending policy (caps, denylist, approval)
- report_outcome (free) — after paying, report delivery to train the reliability flywheel
Tools — vet the payment itself (buyer-side):
- firewall ($0.002) — should YOUR agent make THIS payment now? Catches fraudulent routing (payTo swapped vs the address you usually pay), drain velocity, overcharge, and injection-sourced instructions. agent_id + a wallet-ownership signature are attached automatically from your configured wallet — trusted routing history with no extra steps.
- firewall_record (free) — seed your agent's payment history so the firewall has a behavioural baseline.
- firewall_outcome (free) — after a verdict, report what actually happened (fraud / legit / …) so the firewall learns which signals are predictive and downweights noisy ones (safety signals stay deterministic).
Tools — vet the asset and the flow:
- assessrwa ($0.02) — RWA risk gate: score a tokenized asset (treasury/stock/credit) before buying it. Proxy-aware transfer-restriction scan + behavioral transfer simulation — catches permissioned securities an agent can buy but not transfer or redeem** (trapped funds), live pause state, issuer identity + issuer sanctions.
- compliance_check ($0.02) — pre-pay compliance screen: OFAC sanctions (hard block), counterparty due-diligence tier, structuring/smurfing detection, FATF Travel-Rule threshold (informational). Not legal advice.
- verifyservice ($0.02) — opt-in 402Sentinel Verified** badge: submit your own payTo for a deep settlement-graph audit; pass → signed time-boxed credential + public allow-list. Failures stay private.
It's a thin client for the hosted service at https://402sentinel.com — the scoring model and facilitator-identification logic live server-side (closed); this package only forwards the request and pays for it, so it's open source.
Quickstart — gate a payment in 5 lines
Before your agent pays any x402 counterparty, ask the firewall; if it doesn't say allow, don't pay. No MCP needed — any standard x402 v2 client works:
import { x402Client, x402HTTPClient } from "@x402/core/client";
import { registerExactEvmScheme } from "@x402/evm/exact/client";
import { privateKeyToAccount } from "viem/accounts";
const client = new x402Client();
registerExactEvmScheme(client, { signer: privateKeyToAccount(process.env.AGENT_KEY) });
const http = new x402HTTPClient(client);
const body = JSON.stringify({
payment: { payto_address: target, amount, resource_url },
context: { source: "web_content", untrusted_text: pageYouActedOn }, // pass what you scraped
});
const url = "https://402sentinel.com/api/firewall";
const init = (h = {}) => ({ method: "POST", headers: { "Content-Type": "application/json", ...h }, body });
const r1 = await fetch(url, init());
const pr = http.getPaymentRequiredResponse((n) => r1.headers.get(n), await r1.json());
const payment = http.encodePaymentSignatureHeader(await http.createPaymentPayload(pr));
const data = await (await fetch(url, init(payment))).json();
if (data.decision !== "allow") throw new Error(`402Sentinel ${data.decision}: ${data.recommended_action}`);
// …safe to pay `target`.Shortened. The full README is on GitHub.
Nothing above is checked by us. What we check is on the safety report.
Install directly
Runs npx -y @kaditang/402sentinel-mcp on your machine. Read the scan report first; the gateway never runs local packages.
claude mcp add 402sentinel-mcp -- npx -y @kaditang/402sentinel-mcp
402sentinel: common questions
- Is 402sentinel MCP server safe?
- Mostly: it is graded B (83/100). Read the 402sentinel safety report
- How do I install 402sentinel?
- It runs on your machine. Copy the Claude Code, Claude Desktop or Cursor config from the install section.
- Does 402sentinel need an API key?
- Yes. The registry entry asks for
CLIENT_PRIVATE_KEY. - Is 402sentinel maintained?
- The last commit was 21 days ago (2026-09-06). The latest release is v0.7.1.
- What can I use instead of 402sentinel?
- Servers from other publishers that do the same job: three.ws Agent Payments MCP server, X402 List MCP server and PipRail MCP server. Compare all 402sentinel alternatives.
Alternatives to 402sentinel
Same job from other publishers: the closest match first, then the best rated.
three.ws Agent PaymentsGoverned x402 payment sessions: pay any endpoint with budget, allowlist & per-tx caps, no key.not reviewedEstablishedB
X402 ListFind and vet x402 payment APIs before your agent pays one: uptime, price, on-chain volume.not reviewedEstablishedA- PipRailBudget-bound x402 payment wallet for AI agents — pays HTTP 402 URLs, capped locally. No backend.not reviewedGrowingB
- Pulsefeed X402Verify x402 payment endpoints before an AI agent pays: scam scan, on-chain checks, trust scores.not reviewedGrowingA
POPCORN MCPSigned time and SHA-256 witness receipts for agents, with offline verification and x402 payment.not reviewedGrowingB
