@kaditang/402sentinel-mcp 0.2.0 → 0.4.0

package/README.md

@@ -7,12 +7,16 @@ decision, scored from on-chain settlement behaviour on Base (address age,
 facilitator-aware payer diversity, settlement maturity) + a delivery-outcome
 flywheel, with honest confidence/coverage.
 
-Tools:
+Tools — vet the **seller**:
 - `assess_counterparty` ($0.002) — risk score + decision + a ready-to-apply `recommended_policy`
 - `assess_counterparty_deep` ($0.02) — same, scans more on-chain history
 - `recommend_policy` ($0.002) — decision + wallet-ready spending policy (caps, denylist, approval)
 - `report_outcome` (free) — after paying, report delivery to train the reliability flywheel
 
+Tools — vet the **payment itself** (buyer-side):
+- `firewall` ($0.002) — should YOUR agent make THIS payment now? Catches fraudulent routing (payTo swapped vs the address you usually pay), drain velocity, overcharge, and injection-sourced instructions. Pass your payer wallet as `agent_id`.
+- `firewall_record` (free) — seed your agent's payment history so the firewall has a behavioural baseline.
+
 It's a thin client for the hosted service at **https://402sentinel.com** — the
 scoring model and facilitator-identification logic live server-side (closed); this
 package only forwards the request and pays for it, so it's open source.

package/dist/index.js

@@ -111,6 +111,72 @@ const TOOLS = [
         endpoint: "/api/report_outcome",
         paid: false,
     },
+    {
+        name: "firewall",
+        description: "Buyer-side payment firewall: should YOUR agent make THIS payment now? Where assess_counterparty vets the seller, this vets the payment instruction in the context of your agent's own history + provenance. Returns allow/hold/block + signals: routing_anomaly (payTo swapped vs the address you usually pay = fraudulent routing), velocity_anomaly (drain), amount_anomaly (overcharge), provenance_flag, counterparty_risk, injection_destination (if the payTo appears in the untrusted page/tool-output you're acting on, the destination was injected — pass it as context.untrusted_text), intent_mismatch (pass context.intended={payto,max_amount} so a mid-flight redirect is caught), new_counterparty_burst, recurring_flagged (poisoned-memory loop). STRONGLY recommended: pass untrusted_text + intended to catch prompt-injection payments. Pass your payer wallet as agent_id. Costs $0.002. Seed history free with firewall_record.",
+        inputSchema: {
+            type: "object",
+            required: ["agent_id", "payment"],
+            properties: {
+                agent_id: { type: "string", description: "stable id for your agent — use your payer wallet address" },
+                payment: {
+                    type: "object",
+                    required: ["payto_address"],
+                    properties: {
+                        payto_address: { type: "string", description: "address you're about to pay" },
+                        amount: { type: "number" },
+                        asset: { type: "string", description: "e.g. USDC" },
+                        resource_url: { type: "string", description: "what you're paying for" },
+                    },
+                },
+                context: {
+                    type: "object",
+                    properties: {
+                        source: { type: "string", enum: ["tool_output", "web_content", "user", "unknown"], description: "where the payTo/instruction came from" },
+                        metadata: { type: "object", description: "x402 description/reason strings (scanned for injection)" },
+                        expected_payto: { type: "string", description: "known-good address for this resource (optional)" },
+                        untrusted_text: { type: "string", description: "the page/tool-output content you're acting on — if the payTo appears in it, the destination was injected (hard block)" },
+                        intended: { type: "object", description: "what you meant to do: { payto, max_amount } — any deviation = mid-flight redirect (hard block)", properties: { payto: { type: "string" }, max_amount: { type: "number" } } },
+                    },
+                },
+                policy: {
+                    type: "object",
+                    properties: {
+                        max_payment_usdc: { type: "number" },
+                        velocity_window_min: { type: "number" },
+                        velocity_cap_usdc: { type: "number" },
+                        check_counterparty: { type: "boolean" },
+                        block_on: { type: "array", items: { type: "string" } },
+                    },
+                },
+            },
+        },
+        endpoint: "/api/firewall",
+        paid: true,
+    },
+    {
+        name: "firewall_record",
+        description: "FREE. Seed your agent's payment history so the firewall has a behavioural baseline (record past/known-good payments). Pass your payer wallet as agent_id.",
+        inputSchema: {
+            type: "object",
+            required: ["agent_id", "payment"],
+            properties: {
+                agent_id: { type: "string", description: "use your payer wallet address" },
+                payment: {
+                    type: "object",
+                    required: ["payto_address"],
+                    properties: {
+                        payto_address: { type: "string" },
+                        amount: { type: "number" },
+                        asset: { type: "string" },
+                        resource_url: { type: "string" },
+                    },
+                },
+            },
+        },
+        endpoint: "/api/firewall/record",
+        paid: false,
+    },
 ];
 function clientOrNull() {
     if (!RAW_PK || RAW_PK.startsWith("0xYour"))
@@ -119,7 +185,7 @@ function clientOrNull() {
     return new GatewayClient({ chain: "base", privateKey: pk });
 }
 async function main() {
-    const server = new Server({ name: "402sentinel", version: "0.2.0" }, { capabilities: { tools: {} } });
+    const server = new Server({ name: "402sentinel", version: "0.4.0" }, { capabilities: { tools: {} } });
     server.setRequestHandler(ListToolsRequestSchema, async () => ({
         tools: TOOLS.map(({ name, description, inputSchema }) => ({ name, description, inputSchema })),
     }));

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@kaditang/402sentinel-mcp",
-  "version": "0.2.0",
-  "description": "MCP tools to assess an x402 counterparty BEFORE paying — risk score, allow/review/block, and a wallet-ready spending policy. Thin client for 402sentinel.com.",
+  "version": "0.4.0",
+  "description": "MCP tools for x402 payment safety — vet the counterparty (risk score, allow/review/block, spending policy) AND vet the payment itself (buyer-side firewall: routing/drain/injection). Thin client for 402sentinel.com.",
   "type": "module",
   "bin": { "402sentinel-mcp": "./dist/index.js" },
   "main": "dist/index.js",