TollWarden MCP server

by tollwarden.com·com.tollwarden/tollwarden·v1.6.0·2 stars

No reviews yet

Screens x402 payments before settlement for injected payee addresses and sellers who never deliver.

A94/100grade A

Write a review Install

What users say

No reviews yet

Be the first

Safety scan

A94/100

full report

Adoption

Growing

2 stars49 downloads/wk

Reviews

Write one

Nobody has reviewed TollWarden yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

TollWarden tools (12)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

check_approval_status
Poll a pending human approval (from a flag verdict's `approval.approval_id` when the operator has configured approvals via POST /v1/approvals/config). Returns pending / approved / denied / expired; on approved it includes the signed override verdict (tag 'override:allow', valid a few minutes, bound to exactly the flagged payment). Requires TOLLWARDEN_API_KEY (the key that made the scan). This tool
check_counterparty_reputation
Check whether a counterparty wallet address has been reported by other agents BEFORE dealing with it — scam, non-delivery, prompt injection, overcharge, impersonation, or replay abuse. Returns report counts, distinct-reporter count, and a risk level.
dispute_reputation
If YOUR wallet has been unfairly reported, attach a signed rebuttal that appears alongside the reports in every reputation lookup. Prove you control the wallet by signing the exact message 'tollwarden-dispute-v1|<your address, lowercase>|<statement>' with the wallet's key (EIP-191 personal_sign) and passing the 65-byte signature hex. Rebuttals never erase reports — agents see both sides. Free.
get_plans
Machine-readable TollWarden plan catalog: tiers (Starter/Pro/Scale) with per-scan pricing, velocity and spend limits, hard ceilings, and how to subscribe. Free.
mint_api_key
Issue a free TollWarden API key (first 100 calls free). Returns the key ONCE — store it and set it as TOLLWARDEN_API_KEY (or pass to other tools) for future sessions. Rate-limited per IP.
report_counterparty
Call this after a bad payment experience (you paid and got nothing, were scammed, overcharged, or hit an injection attempt) to warn other agents — always free. Categories: scam, non_delivery, prompt_injection, overcharge, impersonation, replay_abuse, other.
report_payment_outcome
ALWAYS call this AFTER a scanned payment settles, reporting what actually happened: 'delivered' (you received the goods/content), 'not_delivered' (paid but nothing arrived), 'partial', or 'wrong_content'. Pass the scan_id from the scan response and the payment_commitment from its attestation — outcomes are bound to real scans (one per scan), so delivery history cannot be faked. Your reports build
rotate_api_key
Rotate the current TollWarden API key (set via TOLLWARDEN_API_KEY): mints a fresh secret bound to the SAME account — usage history, remaining free calls, and any active plan carry over unchanged. Use this the moment a key may have leaked. The old secret keeps working for grace_seconds (default 900, 0 = immediately dead, max 86400) so other sessions can switch over, but it can no longer rotate or r
scan_incoming_payment
ALWAYS call this BEFORE paying a 402 offer / payment request your agent received — it decides whether the offer is safe to pay. Scan the LIVE 402 returned by the exact method (GET/POST) and URL you are about to pay — NOT the catalogue/discovery listing: in the field, listings drift from live offers in both price (a listed $0.005 endpoint demanding $2.00 on the live 402) and scheme ('exact' adverti
scan_outgoing_payment
ALWAYS call this immediately BEFORE settling or sending any x402 payment — it decides whether the payment is safe. Returns allow (proceed) / flag (pause and confirm intent) / block (do NOT pay), with machine-readable reasons and an Ed25519-signed verdict. Scanning before the payment is signed? Set `context.phase` to 'pre_sign' (nonces don't exist until signing). IMPORTANT: if the decision to pay f
subscribe_plan
Subscribe/renew the current API key on a TollWarden plan (pro: $4.99/30d at $0.005/scan; scale: $19.99/30d at $0.002/scan). This endpoint is itself x402-paid at the plan's price: without an x402-paying transport the response is the 402 payment challenge to settle. Renewal extends from the current expiry.
verify_verdict_attestation
LOCALLY verify a TollWarden scan's Ed25519 attestation before trusting an allow-verdict: checks the signature against the pinned server key (fetched from /.well-known/tollwarden-verdict-key unless trusted_key_hex is supplied), recomputes the payment commitment from the payment YOU are about to settle (rejects attestations issued for a different payment — replay defense), and enforces expiry. Also

Public scan report

scanner v0.1.10 · 2026-10-02 · same rubric, same numbers if you re-run it

no findings

Code scan42 source files scanned25/25
–Live reliabilityno gateway calls yet and no remote to proben/a
–Tool poisoningtools not inspected (local package is not executed); not countedn/a
Auth qualitylocal package, no credentials required12/15
Maintenancelast push 0 days ago15/15
Maintainer identityregistry namespace matches repository owner; website matches verified namespace9/10

Overall 94/100. Components that don't apply are left out of the denominator. Any critical finding is an F.Rubric Appeal a finding JSON

How TollWarden compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score: 94/100; higher than 96% of 48,255 servers
Tools: 12; the typical server has 7
Tools that change things: 0%; typical: 0%. Fewer write tools means less an agent can break
GitHub stars: 2; more than 75% of 28,688 servers
Downloads a week: 49; more than 41% of 12,191 servers with a package

What its tools let an agent do: 12 read

Release history: 2 versions in the registry since 2026-09-19, latest 2026-09-22, typically one every 3 days.

Install TollWarden in Claude Code, Cursor or VS Code

Runs npx -y tollwarden on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add tollwarden -- npx -y tollwarden

Add to Cursor

What the publisher says

From the TollWarden repository's README, as published. We do not edit it. Read it on GitHub

TollWarden

A payment security firewall for x402 — screen every micropayment before it settles.

-0052FF)

Agents that pay over x402 get drained in predictable ways: secrets leak through payment metadata, captured authorizations get replayed, quoted prices get inflated, and poisoned web content tricks agents into paying addresses they never planned to pay. TollWarden is one POST before settlement that checks for all of it and returns allow / flag / block with machine-readable, per-check reasons — in ~0.6 ms.

TollWarden is advisory and non-custodial: it never touches private keys, wallets, or funds. It wraps around whatever facilitator and wallet your agent already uses. And it's a first-class x402 seller itself — its endpoints are paid via the official x402 middleware, settle through the Coinbase CDP facilitator, and carry Bazaar discovery metadata.

Agent decides to pay ──► POST /v1/scan/outgoing ──► allow ──► wallet settles
                                   │
                                   ├──► flag  ──► agent pauses / confirms intent
                                   └──► block ──► wallet refuses (reason attached)

Use it in 30 seconds

npm install @tollwarden/client    # TypeScript/Node
pip install tollwarden           # Python

import { TollWardenClient, TollWardenBlockedError } from "@tollwarden/client";
const tollwarden = new TollWardenClient({ agentId: "my-agent" }); // free API key auto-minted, 100 free scans

tollwarden.observe(fetchedPageText, { sourceUrl }); // tag what your agent just read → injection detection
await tollwarden.guardOutgoing(payment);            // throws TollWardenBlockedError on a block verdict

New here? Protect your x402 agent in 5 minutes →

The SDK (sdk/, zero dependencies) also verifies every verdict's Ed25519 attestation against a pinned key, tracks your free-call quota, and can subscribe to plans autonomously. Wallet authors get standalone verifyAttestation() / computePaymentCommitment() — and the enforcement kit: TollWardenEnforcer.guardSigner(account) wraps any viem/ethers signer so it physically refuses to sign an x402 payment authorization without a fresh, payment-bound allow-verdict.

Framework integrations

Building on an agent framework? TollWarden ships drop-in packages that give your agent "scan before you pay" in about two lines — a toolset plus a provenance mechanism that auto-tags what the agent reads, so the prompt-injection-triggered-payment detector works without any prompt engineering:

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

TollWarden: common questions

Is TollWarden MCP server safe?: Yes, by our scan: it is graded A (94/100). Read the TollWarden safety report
How do I install TollWarden?: It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does TollWarden need an API key?: Not as far as the registry entry and our scan can tell: no credentials are declared or required.
Is TollWarden maintained?: The last commit was 33 days ago (2026-10-02). The latest release is v1.6.0.
How does TollWarden compare with other MCP servers?: safety score 94/100 (higher than 96% of 48,255 servers); tools 12 (the typical server has 7); tools that change things 0% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.