Warden402 MCP server

Warden — warden402.xyz

The pre-execution security & trust layer for agents transacting on Base.

Give Warden a token, a pending transaction, or an address → get a single decision: block · review · clear with reasons, a risk score, and a plain-language summary.

Warden uses the x402 Bazaar as its intelligence backend and builds judgment, a provable track record, and (next) a firewall on top.

Why

x402 infrastructure is ahead of demand; the missing layer is trust. The marketplace vertical is crowded (Coinbase Bazaar + dozens of clones), but pre-execution security is wide open. Warden owns that vertical.

What's in here

The decision contract (immutable spine)

Every endpoint returns a Verdict (src/schema/verdict.ts). Principles:

rules; the LLM only writes summary. Auditable.

1. The LLM never touches the verdict. decision and riskScore come from deterministic

→ the verdict is review at worst, never a false clear.

1. Fails safe. If a Bazaar signal can't be fetched it becomes unknown → degraded:true

1. Every verdict is snapshotted (verdictId + signal evidence) → the track-record moat.

Decision rules

diluted by the average). 2+ warns → review. Else clear.

• Hard rule: honeypot or sanctions fail → block (regardless of score).
• Weighted-average risk ≥ 70 → block; degraded → review.
• Any single fail (e.g. liquidity collapse) floors the decision at review (can't be

Endpoints

(The website exposes the same via /api/guard.)

Run locally

# Single-project site (recommended) — runs guard in-process
cd web && npm install
cp .env.example .env.local   # set BAZAAR_INTERNAL_SECRET
npm run dev                  # http://localhost:3000

# Or the standalone Hono API
npm install
cp .env.example .env         # set BAZAAR_INTERNAL_SECRET
npm run smoke                # offline decision tests
npm run dev                  # http://localhost:8787

Production topology

(Root Directory = web). It runs the guard/firewall in-process, so the endpoints agents actually call (/api/guard, /api/firewall) are live here. Hot path is edge-friendly: KV store (no fs) + per-IP rate limiting. Persistence turns on when KVRESTAPIURL / KVRESTAPITOKEN are set.

• web/ is the production API + site. Deployed as a single Vercel project

persistent-disk ledger or the x402 payment layer. Not required; not deployed by default. The src/ modules are the canonical logic; a drift-guard test (tests/drift.test.ts) proves the web copy stays identical.

• src/ (Hono API) is an optional Node host — for teams that want a

• Drift is impossible to ship silently: npm test fails if the two diverge.

Deploy

Shortened. The full README is on GitHub.