io.github.razel369Published by GitHub account razel369v0.16.0Updated Oct 24, 2026
Fail-closed action authorization, MCP risk scanning, x402 checks, and signed receipts.
Fail-closed authorization firewall that signs short-lived receipts for agent actions and runs MCP metadata, x402 and wallet risk checks.
Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.
Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.
Read https://sourceweft.com/mcp/io.github.razel369%2Fintentfence/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.Add this to your client's mcpServers config.
{
"mcpServers": {
"intentfence-agent-action-firewall": {
"type": "http",
"url": "https://agentpass-protocol.rmalka06.chatgpt.site/api/mcp"
}
}
}IntentFence is a fail-closed authorization firewall for autonomous AI agents. Immediately before a consequential MCP, HTTP, A2A, or payment action, it binds the exact action and payload hash to explicit action/resource allowlists, spend and retention ceilings, and optional action-specific approval. It returns a five-minute ES256 receipt; the TypeScript and Python SDKs verify the receipt and local action digest before executing the caller-owned callback. IntentFence never executes downstream tools and should never receive credentials or wallet keys. It also provides MCP metadata scanning and x402 payment-safety checks.
safe_to_proceedneeds_reviewdeniedProduction: https://agentpass-protocol.rmalka06.chatgpt.site
x402scan: https://www.x402scan.com/server/c495c104-dba4-4764-86b1-96b8b0cda48b
Official MCP Registry: https://registry.modelcontextprotocol.io/v0.1/servers?search=io.github.razel369%2Fintentfence
[razel369/intentfence MCP server]
The hosted MCP tools intentfence_authorize_action and
intentfence_agent_risk_scan are available without an API key and are
rate-limited. Authorization signs the exact caller-supplied action and policy
digests for five minutes but does not validate the truth of a self-declared
identity or approval source. Production callers must verify the receipt,
re-hash the local action, and block on denial, review, expiry, mismatch, network
failure, or verification failure. Use the TypeScript enforceAction or Python
run_authorized helper to make that boundary executable.
The scanner evaluates caller-supplied MCP metadata only. It highlights missing schemas, annotations, action-bound approval, and financial limits, but does not execute tools, inspect source code, or certify security or compliance.
Official U.S. CPI costs 0.001 USDC; live readiness and wallet risk cost 0.002 USDC; signed preflight and exact-quote assessment cost
0.005 USDC on Base through x402. A successful call
returns both the facilitator's PAYMENT-RESPONSE settlement header and an
IntentFence ES256 compact-JWS receipt.
Wallet risk is the recommended first check before paying a Base recipient. It
uses live Base RPC activity and GoPlus malicious-address intelligence. A
safe_to_proceed result means no listed malicious flags were observed and the
address was established on Base at assessment time; it does not prove identity,
ownership, authorization, or future behavior.
Install the recurring pre-payment skill to attach that check to new Base recipients:
The skill can run without interrupting an autonomous workflow only when the wallet owner already approved a standing 0.002 USDC screening budget and the wallet enforces it. It blocks the downstream payment on review, denial, missing settlement proof, invalid receipt, or service failure.
The live readiness check is the simplest first call when an agent only has an endpoint URL. It makes one bounded credential-free request, rejects private-network targets and redirects, validates the returned challenge, never pays the target, and signs the result for five minutes.
The quote assessment is the recommended check after an x402 merchant returns
its unpaid challenge and before the agent signs the merchant payment.
The agent supplies subject, target_url, optional method (GET, HEAD, or
POST), the base64 payment_required header (maximum 16 KiB), and a policy with
max_price_usdc plus an optional allowed_payees list. IntentFence validates
x402 v2, exact scheme, Base mainnet, canonical Base USDC, price, payee, and exact
resource binding. It requires the canonical USDC EIP-712 domain and sends
Permit2, unknown transfer metadata, and active extensions to review. A
safe_to_proceed result requires an explicit matching
allowed_payees entry; omitting the list yields needs_review. IntentFence
never fetches or pays the target. Every advertised payment option must satisfy
every automatic check; mixed safe and unsafe option sets are denied.
An agent or developer can buy a complete production guard without an account, email, meeting, or sales call:
The request selects openai-agents-js, cloudflare-agents,
coinbase-agentkit, or mcp-gateway and supplies one exact action plus its
allowlists, spend ceiling, retention limit, and optional approval policy. The
first request returns an x402 challenge for exactly 1 USDC on Base. After
settlement, the same response delivers a copy-ready TypeScript guard, signed
action and policy receipt, allowed/denied/over-budget test vectors, and a
fail-closed deployment checklist. The buyer must review the generated code and
keep all credentials in its own runtime.
The hosted MCP endpoint is available without an API key:
Agents and MCP clients that require a local process can run the immutable public 0.11.0 release directly. This does not require an npm account, repository clone, or IntentFence API key:
The release artifact is built and tested by GitHub Actions. Its SHA-256 digest
is f0cdf3df28da8a5c037e48193cbb4602744b5fb0b6c182d877abedb707b1e9f9.
Use the hosted endpoint above when the client supports Streamable HTTP.
All adapters keep credentials in the caller runtime and execute the downstream action only after the exact local action digest and ES256 receipt verify.
The local stdio package can handle the x402 challenge, sign it, retry the tool call, and return the settled result without requiring special MCP-client support. Automatic payment is disabled unless all three values below are set:
Supply the key through the agent runtime's secret manager or process
environment; never commit it to an MCP configuration file. The package signs
only exact Base-mainnet USDC requirements addressed to the published
IntentFence recipient, rejects any payment above the per-call ceiling, and
reserves every attempted signature against the process-lifetime budget before
signing. Failed attempts remain reserved, so retry loops and concurrent calls
cannot exceed the cap. The private key stays in the buyer's local process and is
never sent to IntentFence.
Agents do not need to infer which endpoint, method, payload, or payment cap matches a product. Read the catalog, then submit the exact product input:
The checkout response is free and never initiates payment. It returns a
validated HTTP request, shell-safe Agentic Wallet argv, POSIX and PowerShell
commands, Coinbase Agentic Wallet MCP instructions, an mcpc --x402 call, the
matching Agent Skill, the matching MCP tool and arguments, and an exact Base
USDC ceiling. Paid MCP tools advertise _meta.x402 for clients that can sign
before the first tool call.
Agents must still review and authorize the payment and require
PAYMENT-RESPONSE settlement proof.
Open the live install panel, then select Install IntentFence in VS Code.
The install action contains only the public server name, transport, and URL. VS Code asks you to review and trust the server before its first start. The free policy-preview tool works with no API key. Paid calls through the hosted server need an x402-capable client; runtimes without one can use the budget-capped local stdio mode above.
Manual .vscode/mcp.json or user-profile fallback:
Review the server details yourself before starting a manually configured server.
See the official VS Code MCP installation documentation.
Install the open Agent Skill in Codex, Claude Code, Cursor, Gemini CLI, GitHub Copilot, and other skills-compatible agents:
Review the complete skill before installing it.
The skill triggers when an agent is about to sign an x402 payment. It teaches the agent to capture the exact quote, enforce a caller-defined ceiling and payee allowlist, keep wallet credentials local, and use IntentFence only after the 0.005 USDC assessment fee is authorized. It includes a capped Coinbase Agentic Wallet buyer path for agents that already use an authenticated wallet.
Agents that have only a public x402 URL can install the narrower live-readiness skill. It probes the route without credentials or target payment, blocks redirects and private-network targets, validates the returned challenge, and requires explicit authorization before the 0.002 USDC IntentFence fee:
The official x402 client buyer example verifies the live fee challenge before creating a signer and is payment-disabled by default:
https://github.com/razel369/intentfence/tree/main/examples/x402-buyer
Agents that already use Coinbase Agentic Wallet can retrieve a complete capped
checkout from GET /api/payments under buyer_quickstart. The published
command is pinned to a verified CLI version, includes a valid policy body, and
sets --max-amount 5000 so it cannot authorize more than the 0.005 USDC
IntentFence fee. Review the body and explicitly authorize the real payment
before running it.
Projects that already own a Coinbase AgentKit EVM wallet can use the pinned AgentKit adapter. Unlike an automatic retry, it binds the payment to the exact IntentFence URL, Base network, canonical USDC asset, 5000-atomic-unit amount, and recipient, then calls the buyer's own authorization function before signing. The matching machine-readable manifest is published at https://agentpass-protocol.rmalka06.chatgpt.site/integrations/coinbase-agentkit.json.
Gemini CLI can install the repository directly, without waiting for an npm package or gallery crawl:
The extension starts a dependency-free local MCP bridge and exposes the free preview plus the x402-paid verified preflight and quote-assessment tools.
The first call returns the standard PAYMENT-REQUIRED challenge for the
IntentFence fee:
Retry the same request with a valid x402 v2 PAYMENT-SIGNATURE. A successful
response contains the validated caller-observed challenge fields,
pass/review/deny checks, a SHA-256 binding to the full target URL and exact
payment requirement, and an ES256-signed assessment receipt. The assessment
uses assurance caller-observed-x402-quote-assessment and verification tier
x402-quote-assessment+x402-settled; x402 settlement covers the 0.005 USDC
IntentFence assessment fee, not the target payment.
The first call returns an x402 challenge for 0.002 USDC:
Retry the same URL with a valid x402 v2 PAYMENT-SIGNATURE. The successful
response includes Base account activity, native and USDC balances, a code hash
for contracts, current malicious-address flags, pass/review/deny checks, and a
five-minute ES256 receipt with assurance live-base-wallet-risk. If a required
live source is unavailable, the endpoint fails closed and does not intentionally
settle the assessment fee.
Declared-input receipts attest only that IntentFence evaluated caller-supplied
policy data. Quote-assessment receipts bind the exact caller-observed
PAYMENT-REQUIRED challenge; they do not prove that IntentFence contacted the
merchant, or prove merchant identity, delivery, or downstream enforcement. The
receipt-signing key is separate from the USDC recipient wallet. IntentFence
never needs a payer's seed phrase or wallet private key. Wallet-risk receipts
report observed evidence at one point in time and are not identity attestations.
For MCP clients that launch local stdio servers, use npm run mcp:stdio.
Glama and other container-based hosts can build the root Dockerfile; it starts
the same IntentFence policy engine and responds to MCP initialization,
tools/list, and tools/call requests over standard input/output.
The production signing key is stored in Sites as the secret
INTENTFENCE_SIGNING_PRIVATE_JWK. Generate a separate development key with:
Never commit the generated private JWK. Publish only its public coordinates in
/.well-known/jwks.json.
Set INTENTFENCE_TEST_PRIVATE_JWK_PATH only for a local smoke test that should
exercise the signed-receipt verifier.
TypeScript and Python SDKs live in sdk/. The root server.json is ready for
the official MCP Registry under io.github.razel369/intentfence; the public MCP
endpoint uses Streamable HTTP and requires no API key.
The /.well-known/x402 service manifest and Bazaar metadata make both paid
endpoints crawlable by x402 indexes and autonomous tool routers. Production
resources are continuously checked, and the original verified-preflight route
is registered on x402scan.
Production uses PayAI by default. When both CDP_API_KEY_ID and
CDP_API_KEY_SECRET are configured in the hosted runtime, verification and
settlement switch to Coinbase CDP. That makes successful Bazaar-enabled route
settlements eligible for Coinbase Bazaar indexing; configuration alone does
not create a listing or count as customer revenue.
The fastest no-contact path to production is the 1 USDC policy pack for one
guarded purchase, transfer, booking, deployment, deletion, or other
consequential action. The machine-readable offer and capped Agentic Wallet
checkout are published by GET /api/payments.
See docs/PROTOCOL.md and docs/SECURITY.md for the protocol and security model.
Source: README.md at commit 486bb3b
IntentFence Action Authorization
Authorize an exact agent action against an explicit allowlist, spend ceiling, retention ceiling, and optional action-bound approval. Returns a five-minute ES256 receipt and never executes the downstream action. Callers must verify the receipt and fail closed if the action changes.
actionrequiredpolicyrequiredcontextsubjectrequiredapprovalIntentFence MCP Agent Risk Scan
Free metadata-only scan of caller-supplied MCP tool definitions for missing schemas, unsafe annotations, approval binding, and cost boundaries. Does not execute tools or certify security.
toolsrequiredserver_namerequiredIntentFence Agent Checkout
Free machine checkout builder. Select a paid IntentFence outcome and receive the exact endpoint, validated request, USDC cap, shell-safe Agentic Wallet argv, MCP tool call, and opt-in local auto-payment budget. It never signs or initiates payment.
inputproductrequiredIntentFence Preview
Free declared-input preview with no signed receipt, authorization proof, or enforcement guarantee. Returns safe_to_proceed, needs_review, or denied.
actionrequiredproofssubjectrequiredconstraintsIntentFence Production Policy Pack
Paid self-service integration pack (1 USDC on Base). Generates a runtime-specific TypeScript guard, signed action and policy receipt, negative test vectors, and a fail-closed deployment checklist for Cloudflare Agents, Coinbase AgentKit, or an MCP gateway. No meeting or account is required.
runtimerequiredproject_namerequiredauthorizationrequiredIntentFence Verified Preflight
Paid production preflight ($0.005 USDC on Base). Settles through x402 and returns a signed ES256 audit receipt plus settlement metadata.
actionrequiredproofssubjectrequiredconstraintsIntentFence x402 Quote Assessment
Paid assessment ($0.005 USDC on Base). Forward the exact base64 or base64url PAYMENT-REQUIRED header observed by the caller. IntentFence validates the quote, canonical Base USDC asset, price ceiling, payee allowlist, timeout, and resource binding without contacting the target, then returns a short-lived ES256 receipt bound to the quote hash. Supply allowed_payees for safe_to_proceed; omission yields needs_review.
methodpolicyrequiredsubjectrequiredtarget_urlrequiredpayment_requiredrequiredIntentFence Live x402 Readiness
Paid live endpoint check ($0.002 USDC on Base). Makes one bounded credential-free request to a public HTTPS target, blocks private networks and redirects, never pays the target, validates the returned x402 challenge, and returns a signed five-minute receipt.
bodymethodpolicysubjecttarget_urlrequiredallowed_payeesmax_price_usdcIntentFence Wallet Risk
Paid AML/KYT wallet screening ($0.002 USDC on Base) before sending funds or approving a transaction. Checks live Base activity plus GoPlus sanctions, phishing, mixer, money-laundering, dark-web, blacklist, and related counterparty-risk flags, then returns a five-minute ES256 receipt. A low-risk result is not proof of identity, ownership, authorization, or future behavior.
addressrequiredIntentFence Official U.S. CPI
Paid official U.S. CPI and core CPI data ($0.001 USDC on Base), retrieved from the Bureau of Labor Statistics with a six-hour edge cache and returned with an ES256 provenance receipt. Optionally request a YYYY-MM period.
month100% of the applicable checks met
How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.
npx skills add razel369/intentfence --skill screen-base-walletsPOST /api/policy-packshttps://agentpass-protocol.rmalka06.chatgpt.site/api/mcpnpx --yes --package https://github.com/razel369/intentfence/releases/download/mcp-v0.11.0/razel369-intentfence-mcp-0.11.0.tgz intentfence-mcpINTENTFENCE_EVM_PRIVATE_KEY=<buyer-controlled 0x-prefixed key>INTENTFENCE_MAX_AUTO_PAYMENT_USDC=0.005INTENTFENCE_AUTO_PAYMENT_BUDGET_USDC=0.05curl https://agentpass-protocol.rmalka06.chatgpt.site/api/checkout
curl -X POST https://agentpass-protocol.rmalka06.chatgpt.site/api/checkout \ -H "Content-Type: application/json" \ -d '{"product":"wallet-risk","input":{"address":"0x1111111111111111111111111111111111111111"}}'{ "servers": { "IntentFence": { "type": "http", "url": "https://agentpass-protocol.rmalka06.chatgpt.site/api/mcp" } }}npx skills add razel369/intentfence --skill guard-x402-paymentsnpx skills add razel369/intentfence --skill inspect-x402-endpointsgemini extensions install https://github.com/razel369/intentfencecurl -i -X POST https://agentpass-protocol.rmalka06.chatgpt.site/api/x402-assessments \ -H "Content-Type: application/json" \ -d '{"subject":"agent:buyer-07","target_url":"https://merchant.example/api/paid-resource","method":"GET","payment_required":"BASE64_PAYMENT_REQUIRED_HEADER","policy":{"max_price_usdc":"0.10","allowed_payees":["0x1111111111111111111111111111111111111111"]}}'curl -i "https://agentpass-protocol.rmalka06.chatgpt.site/api/wallet-risk?address=0x1111111111111111111111111111111111111111"npm installnpm run devdocker build -t intentfence-mcp .docker run --rm -i intentfence-mcpnode scripts/generate-signing-key.mjs /secure/path/intentfence-private-jwk.jsonnpm run testnpm run lintnpx tsc --noEmitnpm run sdk:checknpm run smoke:mcp:dockernpm run smoke:mcp:stdionpm run smoke:protocol -- http://localhost:3000