AI agents that read the web can be talked into paying an address a page hands them. The payment itself looks normal, so spending limits don't stop it.
TollWarden checks each agent payment before it settles. The agent tags what it just read and makes one API call before it pays. TollWarden checks whether the payee address arrived in that content, whether the decision came from a tool result or fetched page rather than the agent's own plan, and whether the content carries prompt-injection instructions in any of eight languages, raw or encoded. It also catches replayed authorizations, inflated prices, lookalike tokens posing as stablecoins, address poisoning, and leaked secrets in payment metadata.
TollWarden yields an allow, flag, or block with a reason for each check, returned in under a millisecond and Ed25519-signed over a hash of the exact payment. Our SDK can also wrap the wallet signer so it refuses to sign an x402 payment without a fresh allow for that payment.
TollWarden is live on Base mainnet, shipping TypeScript and Python SDKs, an MCP server, and packages for five agent frameworks including LangChain and Coinbase AgentKit.
An agent reads a web page, tool result, or reply that names a payee, then pays it. TollWarden checks whether the payee address - or a near copy of it - arrived in content the agent just read and whether the decision came from that content rather than the agent's own plan. Instructions hidden with base64, hex, homoglyphs, or other encodings are unpacked before checking.
The TollWarden SDK wraps the agent's wallet signer. It refuses to sign an x402 stablecoin authorization unless it holds a fresh, signature-verified allow verdict for that exact payment. A missing or stale verdict means no signature. The firewall itself never touches keys or funds.
TollWarden checks that the token is the canonical asset for the declared network and blocks lookalike tokens that spoof it. It also flags payee addresses that imitate ones the agent has paid before, replayed authorizations, and prices inflated beyond what the seller advertised.
This site contains content and information, including links to other sites and resources, that was prepared by third parties ("Third Party Content") who are not affiliated with Circle or any of its affiliates (collectively "Circle"). Circle makes no representations on the accuracy, suitability, or validity of Third Party Content. As such, Circle is neither responsible nor liable for any Third Party Content, including any errors, omissions, or delays, or for any actions taken in reliance upon any Thirds Party Content. Reference to any specific company, product, service, or website of any third party does not constitute an implied or express endorsement, recommendation, favoring or validation by Circle. All content provided is for educational and informational purposes only. Circle shall not be liable for any damage or loss relating to use of, or reliance upon, the Third Party Content.