X402 Presign Guard

io.github.kaito3636Published by GitHub account kaito3636v0.1.1Updated Oct 25, 2026

Pre-sign EVM tx/approval safety for AI agents: decode calldata, flag drainers, return GO/HOLD/BLOCK.

VerifiedSTDIODesktop onlyFinanceSecurity & Monitoring

Overview

AI-generated overview

Checks EVM transactions and token approvals before signing, flagging wallet-drainer patterns and returning a GO, HOLD or BLOCK verdict.

What you can do
  • Check a raw EVM transaction before signing: decodes calldata and returns GO/HOLD/BLOCK with flags.
  • Check a token approval: flags unlimited allowances and approvals to known-malicious spenders.
  • Recognize drainer patterns such as setApprovalForAll, gasless permits, and transfers to malicious addresses, with known-good routers reducing false positives.
  • Both tools forward to a hosted guard service rather than decoding locally.
When to use it
Useful for agents or users that prepare EVM transactions or approvals and want a second opinion on whether signing is safe, especially for trading or wallet agents handling unfamiliar contracts and spenders.
Requirements
Runs locally via npx from the npm package x402-presign-guard; it forwards requests to a hosted guard endpoint (GUARD_URL, defaulting to the project's live URL), so network access to that service is needed. No API keys or environment variables are declared.
Before you install
The verdict is advisory and comes from a third-party hosted service that receives the transaction details you submit; it does not replace simulation or your own review. The README describes paid x402 endpoints settling in USDC, so some checks may involve spending funds, and the hosted service is a pseudonymous self-custody setup.

Installation

In SourceWeft

  1. Open X402 Presign Guard in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

x402-presign-guard

"Should I sign this?" — a pay-per-call pre-sign safety layer for AI trading/wallet agents. An agent POSTs a raw EVM transaction (or an approval) before signing; this decodes the calldata, flags the patterns that drain wallets, and returns GO / HOLD / BLOCK. Settles in USDC via x402 to a self-custody (pseudonymous) wallet.

Why this axis (the honest frame)

10-angle research (2026) on the x402 / agent-payment economy concluded:

  • Real x402 demand is tiny and hyper-concentrated (~$28K/day real commerce; the all-time #1 data seller ≈ $940/mo). Flat/commodity APIs — dates, OCR, raw chain reads — earn ≈ $0. (Confirms why the earlier x402-jp-data fleet made nothing.)
  • The only categories with real crypto-native willingness-to-pay: computed risk/safety verdicts a trading agent must get before it signs — and first-party MEASURED data you generate yourself (no scraping ToS / copyright, un-backfillable time-series).
  • This project is both: a computed pre-sign verdict (not a commodity score card), backed by an accumulating malicious-signature set — the moat that gets bigger the longer it runs.

Honest expectation: $1,000/mo is NOT achievable passively on x402 rails in 2026 — it's above the current top seller. The realistic path is distribution: ship this as an MCP tool that lands in agents' default toolsets (dual-rail: x402 pay-per-call + flat MCP key). x402 is the on-ramp; the MCP install base is the demand. The POC proves the mechanism and starts the compounding asset now.

What it does (POC — pure code, no keys, no RPC)

src/decode.ts statically decodes calldata and catches the real drain vectors:

  • unlimited approve / increaseAllowance to an unknown or known-malicious spender
  • setApprovalForAll(true) (classic NFT drainer) to unknown / malicious operators
  • gasless permit / Permit2 approvals (common drainer vector)
  • transfer / transferFrom to known-malicious recipients
  • calls to known-malicious contracts; unknown selectors flagged "simulate before signing" Known-good routers (Uniswap/Permit2/1inch/Seaport) reduce false positives.

Endpoints

pathpricewhat
GET /guard/token?token=&chain=0.05 USDCpre-TRADE ERC-20 safety for trading agents: malicious-DB + on-chain rug/honeypot red-flags (owner controls, mint/pause/blacklist, renounced?)
GET /guard/tx?to=&data=&value=&chain=0.05 USDCfull pre-sign risk check → GO/HOLD/BLOCK + flags
GET /guard/approval?token=&spender=&amount=freeapproval-specific (unlimited + malicious-spender) — free adoption tier
GET /guard/signaturesfreesize of the accumulating signature set (the moat)
GET /, GET /.well-known/x402freedocs + Bazaar discovery

Live (2026-10-24)

Running in production, paid mode on: https://x402-presign-guard.vercel.app

bash
curl https://x402-presign-guard.vercel.app/.well-known/x402            # discovery (free)curl "https://x402-presign-guard.vercel.app/guard/tx?to=0x..."         # 402 + payment requirements

A 402 returns the x402 v1 payment requirements (scheme exact, network base, USDC); an x402-capable client pays and retries. Implemented + tested: 25/25 PASS (decode 19 + app 6), tsc clean. Runs on both Cloudflare Workers and Vercel from one codebase.

Use it as an MCP server

Point any MCP client (Claude Desktop, agent frameworks) at the hosted guard — no install build, no npm account needed:

json
{  "mcpServers": {    "presign-guard": {      "command": "npx",      "args": ["-y", "x402-presign-guard"]    }  }}

Published on npm: x402-presign-guard (or run straight from source: npx -y github:kaito3636/x402-presign-guard). Exposes two tools — presign_guard_tx and presign_guard_approval — that forward to the hosted guard (GUARD_URL, default the live URL above). The agent calls the guard before it signs.

The compounding engine (v2, wired but off)

wrangler.toml has a commented cron + KV: a scheduled job ingests malicious selectors/addresses from live threat feeds + own honeypot probes, timestamped — so the signature set and the never-backfillable time-series grow every day. That daily accrual is the "掘るほど美味い" asset.

Deploy your own

Vercel (how the live one runs):

bash
npm installnpx vercel deploy --prod                       # free mode firstnpx vercel env add PAY_TO production            # Base self-custody wallet 0x… → go paidnpx vercel deploy --prod

Cloudflare Workers (alternative; same code):

bash
npx wrangler login && npx wrangler deploynpx wrangler secret put PAY_TO && npx wrangler deploy

Distribution (the real lever)

MCP server (this repo, npx github:…) → Official MCP Registry / mcp.so; x402 Bazaar discovery needs a facilitator that implements /discovery/resources (e.g. Coinbase CDP — set FACILITATOR_URL + CDP keys); list on x402scan. The hosted endpoint already serves /.well-known/x402 for crawlers.

Source: README.md at commit 356a459

Tools

2

presign_guard_tx

Check whether an EVM transaction is safe to sign BEFORE signing it. Decodes the calldata, flags wallet-drainer patterns (unlimited approvals, setApprovalForAll, gasless permits, transfers/approvals to known-malicious addresses) and returns a GO / HOLD / BLOCK verdict.

Parameterstodatachainvalue

presign_guard_approval

Check whether a token approval is safe to sign. Flags unlimited allowances and approvals to known-malicious spenders. Returns GO / HOLD / BLOCK.

Parameterschaintokenrequiredamountspenderrequired

Version history

1
  1. v0.1.1LatestOct 25, 2026

Score

80% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts
  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

    Declare a license in the repository or the registry entry.