Safe4

ai.safe4Published by safe4.aiOfficial publisherv1.0.0Updated Oct 24, 2026

Tests an AI agent's purchase against the task it was given. Paid per call in USDC via x402.

VerifiedStreamable HTTPWeb executableFinanceSecurity & Monitoring

Overview

AI-generated overview

A hosted MCP server that checks whether an AI agent's proposed payment fits the task it was given and returns an allow or deny decision.

What you can do
Read the price and accepted payment networks for a Safe4 decision, free of charge, before committing to a paid call. Submit a proposed purchase with its task, purpose, amount, counterparty and category to receive an ALLOW or DENY decision with a reason code and matched concepts. Test the purchase against budget caps, permitted service categories, permitted counterparties and task-to-purchase fit. Record each decision in a hash-chained audit log.
When to use it
Use it when an agent can spend money on its own and you want a check that a purchase actually serves the assigned task, not just that it is within budget and to an approved payee. Useful where a swapped counterparty or an off-task purchase is a real risk.
Requirements
A remote streamable HTTP endpoint; nothing to install. Connecting and listing tools are free. Paid decisions are settled per call in USDC over x402, so an x402-aware client and a funded wallet are needed for real decisions; the free surface can be tried without a key or wallet.
Before you install
Only the price tool is free; each authorize call costs USDC. The task and allow-lists are meant to come from the principal, so an agent that supplies its own task is grading its own homework, though Safe4 marks the task context as request-supplied in the audit entry. The example client needs a buyer private key in SAFE4_BUYER_PRIVATE_KEY to pay; the service states it holds no wallet key or custody of funds.

Installation

In SourceWeft

  1. Open Safe4 in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/ai.safe4%2Fsafe4/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "safe4": {
      "type": "http",
      "url": "https://api.safe4.ai/mcp/"
    }
  }
}

README

Safe4 — the payment firewall for AI agents, as an MCP server

Safe4 decides whether an AI agent's proposed payment should be allowed, by testing the purchase against the task the agent was actually given.

The case it exists for is the one budget limits miss: a payment that is inside every budget, in an allowed category, and to an approved counterparty — and is still the wrong purchase, because it does not serve the task.

This repository is the public manifest and client example for the hosted MCP server. The service itself runs at api.safe4.ai; there is no server to install.

Connect

Streamable HTTP, no installation:

json
{  "mcpServers": {    "safe4": {      "type": "http",      "url": "https://api.safe4.ai/mcp/"    }  }}

Connecting and listing tools are free. Only safe4_authorize is paid.

Tools

safe4_price — free

Returns the current price and the payment networks the endpoint accepts, so an agent can see the cost before committing to a paid call.

safe4_authorize — paid, settled per call in USDC over x402

Returns an ALLOW or DENY decision for a proposed payment, with a reason code, the concepts it matched, and a hash-chained audit entry.

Called without a payment it returns the x402 challenge instead of a decision. An x402-aware client pays and calls again with the resulting payload in the payment argument.

Arguments:

ArgumentMeaning
taskThe task the agent was given, as stated by its principal
purchaseWhat is being bought
purchase_purposeWhy this purchase serves the task
amount, currencyThe proposed payment
counterpartyWho would receive it
service_categoryCategory of the thing being bought
allowed_service_categoriesCategories the principal permits
allowed_counterpartiesOptional. Payees the principal permits
task_idOptional. Echoed into the audit entry
paymentAn x402 payment payload. Omit to receive the price list

The task and the two allow-lists are the principal's constraints, not the agent's — they are what the purchase is tested against, so an agent that writes its own task is grading its own homework. Safe4 records every field it was given and marks the task context as request-supplied, so a substituted constraint is visible in the audit entry afterwards.

Try it without paying

The example runs the entire free surface — connect, list tools, read the price, fetch the challenge — and stops before signing anything. It needs only httpx: no key, no funded wallet.

bash
python examples/mcp_buyer_demo.py https://api.safe4.ai --dry-run

Drop --dry-run and set SAFE4_BUYER_PRIVATE_KEY to buy a real decision. That signs an EIP-3009 authorisation for exactly the amount and payee the server advertised, and nothing else; the script holds no custody and Safe4 never sees the key.

What a decision rests on

Four checks, in order, and a purchase must clear all of them:

  1. Budget and caps — per-transaction, daily, and agent-scoped limits.
  2. Service category — the purchase's category must be one the principal permitted.
  3. Counterparty — when the task declares allowed_counterparties, payment to anyone else is refused. This is the only check that sees a swapped payee; task text and category are identical in that attack.
  4. Task-to-purchase match — the task must account for what the purchase says it is buying, not merely share a word or two with it.

Every decision is appended to a hash-chained audit log. Each entry carries the previous entry's hash, so the record is tamper-evident and continuous across restarts and redeploys.

Payment

Priced per call in USDC over x402. The endpoint advertises its terms in the 402 challenge; buyers pay on whichever advertised network suits them. Safe4 holds no wallet key and takes no custody of buyer funds.

Links

Security

Reporting instructions are in SECURITY.md. Please do not open a public issue containing exploit details.

License

The manifest and client examples in this repository are MIT licensed. The hosted service they describe is a separate commercial product.

Source: README.md at commit 21c0542

Tools

2

safe4_price

Safe4 price

Price and accepted payment networks for one Safe4 decision. Free to call. Returns the same x402 terms the HTTP endpoint advertises, so an agent can see the cost before committing to a paid call.

Takes no parameters.

safe4_authorize

Safe4 authorize

Decide whether a proposed agent payment should proceed. Settled per call in USDC over x402. Called without ``payment`` it returns the price list rather than a decision; call it again with the signed payload to receive one. The task and the two allow-lists are the principal's constraints, not the agent's: they are what the purchase is tested against, so an agent that writes its own ``task`` is grading its own homework. Safe4 records every field it was given in the audit entry and marks the task context as request-supplied, so a substituted constraint is visible afterwards. Args: task: The task the agent was given, as stated by its principal. purchase: What is being bought. purchase_purpose: Why this purchase serves the task. amount: Decimal amount as a string, for example "25.00". currency: Currency of the proposed payment, for example "USDC". counterparty: Who would receive the payment. service_category: Category of the thing being bought. allowed_service_categories: Categories the principal permits. allowed_counterparties: Optional payees the principal permits. When supplied, payment to anyone else is denied. task_id: Optional caller-side task identifier, echoed into the audit. payment: An x402 payment payload for this call. Omit to receive the price list instead of a decision.

Parameterstaskrequiredamountrequiredpaymenttask_idcurrencyrequiredpurchaserequiredcounterpartyrequiredpurchase_purposerequiredservice_categoryrequiredallowed_counterpartiesallowed_service_categoriesrequired

Version history

1
  1. v1.0.0LatestSep 16, 2026

Score

100% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts