Warden402 Mcp

io.github.sukrutkrdgPublished by GitHub account sukrutkrdgv0.2.0Updated Oct 25, 2026

Pre-execution security for AI agents on Base: guard token/tx/address + per-agent spend firewall.

VerifiedSTDIODesktop onlyFinanceSecurity & MonitoringAI & ML

Overview

AI-generated overview

A local MCP server that checks Base tokens, transactions and addresses for risk before an AI agent signs or pays, with an optional per-agent spend firewall.

What you can do
Check tokens before buying: sell simulation, honeypot and tax signals, owner powers, holder concentration, liquidity and deployer reputation, returning block, review or clear with reasons and a risk score. Check transactions before signing: calldata decoding for approvals and permits, approval-target and simulation checks, counterparty risk, address poisoning, plus a safer alternative to sign. Check addresses for sanctions exposure, contract risk and identity. With an agent key, query the per-agent firewall policy and its allow, hold or deny status.
When to use it
Use it when an assistant on Base is about to buy a token, sign a transaction or pay an address and you want a deterministic pre-execution verdict rather than a model's judgement. The firewall tools suit agents that move funds under spending limits.
Requirements
Runs locally via npx (Node.js). No key is needed for the guard tools; the WARDEN_AGENT_KEY environment variable (an agent key from the provider's onboarding page) enables the firewall tools. WARDEN_API_URL can override the default API base. Network access to the provider's API is required.
Before you install
The agent key is a secret passed by environment variable and should not be exposed. Guard calls are free up to a daily per-IP limit, after which calls are paid per request in USDC on Base, so costs can accrue. Verdicts are advisory risk signals, not a guarantee; the README notes a fail-closed design but a clear result does not make a transaction safe. Firewall holds may need human approval.

Installation

In SourceWeft

  1. Open Warden402 Mcp in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

Warden — pre-execution security for AI agents on Base

[npm warden402-mcp] [npm warden402-sdk] [License: MIT]

Before your agent buys a token, signs a transaction or pays an address, ask Warden. You get block · review · clear with the reasons, a risk score and — when there is one — the safer thing to sign instead. On top, a per-agent Firewall enforces a spending policy: allow · hold · deny.

Live at warden402.xyz · public track record at warden402.xyz/track-record

Quick start

MCP (Claude, Cursor, any MCP client) — no key needed:

json
{  "mcpServers": {    "warden402": {      "command": "npx",      "args": ["-y", "warden402-mcp"],      "env": { "WARDEN_AGENT_KEY": "wk_... (optional, enables firewall tools)" }    }  }}

Tools: guard_token, guard_tx, guard_address, and with an agent key firewall_check, firewall_status. → mcp/README.md

SDK (TypeScript, fail-closed):

ts
import { Warden } from "warden402-sdk";const warden = new Warden({ agentKey: process.env.WARDEN_AGENT_KEY });
await warden.assertSafe(() => warden.token("0xTOKEN"));         // throws on blockawait warden.protect({ to: payee, amountUsd: 5 }, () => pay());  // runs only on allow

→ sdk/README.md (also LangChain tools)

HTTP:

bash
curl "https://warden402.xyz/api/guard?address=0xTOKEN"                 # tokencurl "https://warden402.xyz/api/guard?type=address&address=0xADDR"     # addresscurl -X POST https://warden402.xyz/api/guard -H 'content-type: application/json' \  -d '{"type":"tx","from":"0x..","to":"0x..","calldata":"0x.."}'       # transaction

50 free guard calls per IP per day, then x402 pay-per-call ($0.01 token/address, $0.02 tx, USDC on Base). Firewall agent keys: warden402.xyz/onboard (free: 1 agent, 1,000 checks/month).

What it checks

TargetSignals
Tokenlive sell simulation from a real holder (can you get out?), honeypot & taxes, owner powers (mint, set balances, blacklist, upgradeable logic), contract controls, wallet holder concentration (LP / CEX / burn excluded), liquidity, LP lock, deployer reputation, OFAC
Transactioncalldata decode (approve, increaseAllowance, EIP-2612 permit, Permit2, setApprovalForAll, transfer); approval target (unlimited approval to an address with no code → block); eth_call simulation (revert, call to non-contract); counterparty OFAC + contract risk; address poisoning on outgoing transfers. Returns remediation — e.g. an exact-amount approval to sign instead
AddressOFAC, exposure to sanctioned counterparties, contract risk, identity (verified / named / anonymous)

Signal data comes from the x402 Bazaar plus Base RPC.

How decisions are made

  1. No LLM in the decision path. Decision, score and summary are deterministic rules over the collected signals — same input, same verdict.
  2. Fails safe. A critical signal that can't be fetched is unknown → degraded: true → the verdict is review at worst, never a false clear. The SDK and MCP are fail-closed too: no verdict → throw / "do not proceed".
  3. Hard blocks regardless of score: honeypot, sanctioned target, token that can't be sold, poisoned look-alike recipient, unlimited approval to a plain wallet.
  4. Otherwise: weighted risk ≥ 70 → block; any fail or risk ≥ 35 or 2+ warns → review; else clear.
  5. Every verdict is recorded and re-checked later for rugs — the public track record.

Firewall (per agent)

Policy-as-code in front of an agent's value flow: per-call / hourly / daily spend caps, allow & deny lists, unlimited approvals banned, first payment to a new counterparty held for a human (approve/reject in /account or via API), calls-per-minute limit, anomaly multiplier, kill switch, audit log, webhook on hold. Team accounts sign in with a wallet (SIWE), with roles and plans. → FIREWALL.md

Repository

PathWhat
web/The production site and API (Next.js on Vercel): guard, firewall, track record, accounts, x402 payment gate
packages/core/Shared verdict schema + calldata decoder (@warden/core)
mcp/warden402-mcp — stdio MCP server
sdk/warden402-sdk — TypeScript client + LangChain tools
src/Optional standalone Hono API (Node host); a drift test keeps its engine identical to web/
tests/Vitest: decision engine, calldata decoder, firewall policy, drift guard, web signals
bash
npm install && npm test                      # unit testscd web && cp .env.example .env.local && npm run dev   # site + API on :3000

Deploy notes: DEPLOY.md.

License

MIT — see LICENSE.

Source: README.md at commit c84d05f

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

2
  1. v0.2.0LatestOct 10, 2026
  2. v0.1.0Sep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts