Tollary Agent Transaction Guard

kr.p-e.tollaryPublished by tollary.p-e.krv0.1.0Updated Oct 24, 2026

Local fit-check and safe integration guidance for non-custodial Base USDC agent transactions.

The publisher's own server: WAI Quantum job service

VerifiedSTDIODesktop onlyFinanceDeveloper Tools

Overview

AI-generated overview

A local stdio MCP server and CLI that runs a fit-check for non-custodial Base USDC agent payments and reads Tollary's public metadata.

What you can do
Run a local fit-check against a project directory, skipping credentials, dependencies, vendor directories and build output, to see whether it suits Tollary's guarded payment flow. Read Tollary's public metadata endpoints in inspect mode, including readiness and legal information. Start the stdio MCP server from the npm package for use inside an assistant. The client never accepts a raw wallet or AWS private key.
When to use it
Consider it if you are evaluating Tollary's experimental guard for autonomous Base USDC payments and want a local, credential-free check before integrating. It is aimed at testnet evaluation, not live sales.
Requirements
A local Node.js runtime to run the npm package (npx tollary, or the tollary-mcp stdio server). The beta must be selected explicitly as tollary@beta. Inspect mode needs network access to Tollary's public metadata endpoints. No environment variables or headers are declared.
Before you install
Experimental beta limited to Base Sepolia testnet; Base Mainnet sales are disabled and no transaction-safety, recipient-identity, compliance, settlement or loss-prevention guarantee is made. Check the readiness and legal endpoints before any purchase. The client is designed not to accept raw wallet or AWS private keys, so do not supply them. The hosted API and service logic are not covered by the MIT license.

Installation

In SourceWeft

  1. Open Tollary Agent Transaction Guard in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

Tollary

Experimental beta — Base Sepolia testnet only. No transaction-safety, recipient-identity, legal-compliance, settlement, or loss-prevention guarantee is made. Base Mainnet sales are disabled.

Tollary is a non-custodial Agent Transaction Guard for autonomous Base USDC payments. It checks an exact, owner-mandated transaction immediately before a customer-owned AWS KMS signer can sign it.

This repository contains the open-source local fit-check/MCP client, immutable publication metadata, and guarded npm/MCP release workflows. It does not contain customer keys, payment credentials, hosted-service state, or private backend operations.

Try the client

sh
npx tollary fit-check --project .npx tollary inspectnpx --yes --package tollary tollary-mcp

The client never accepts a raw wallet or AWS private key. The fit check is local and skips credentials, dependencies, vendor directories, and build output. Inspect mode reads only Tollary's public metadata endpoints.

The hosted service currently exposes Base Sepolia testnet payment terms only. A published package does not mean that Base Mainnet sales are active. Check /api/readiness and /api/legal before every purchase. The npm beta must be selected explicitly with tollary@beta; no latest release is created by the bootstrap workflow.

Repository layout

  • packages/tollary — npm CLI and stdio MCP server
  • distribution/github-action — local, bounded fit-check action
  • .github/workflows — manual, environment-protected npm/MCP publishing
  • scripts — fail-closed publication and namespace validation

The local client is MIT-licensed. Tollary's hosted API, service logic, trademarks, and commercial output are not granted under that license.

Source: README.md at commit bb7327b

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v0.1.0LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

Other Transaction integrations