{
  "markdown": "# Frisk\n\n[![CI](https://github.com/Jiangw2718i/frisk/actions/workflows/ci.yml/badge.svg)](https://github.com/Jiangw2718i/frisk/actions/workflows/ci.yml)\n[![npm](https://img.shields.io/npm/v/frisk-screen?label=frisk-screen)](https://www.npmjs.com/package/frisk-screen)\n[![PyPI](https://img.shields.io/pypi/v/frisk-screen?label=PyPI)](https://pypi.org/project/frisk-screen/)\n[![npm](https://img.shields.io/npm/v/frisk-mcp?label=frisk-mcp)](https://www.npmjs.com/package/frisk-mcp)\n[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)\n\n**Pre-transaction risk screening for autonomous AI agents.**\n\nBefore your agent pays an x402 seller or calls an unfamiliar tool, ask Frisk\nwhether the counterparty is trustworthy and whether the transaction fits your\npolicy. Frisk returns a verdict — `allow`, `review`, or `block` — with a trust\nscore and human-readable reasons. It is advisory: your agent stays in control\nof the decision.\n\n```ts\nimport { Client } from \"frisk-screen\";\n\nconst client = new Client(); // lite mode, no key required\n\nconst result = await client.screen(\"0x9a3f1b2c3d4e5f60718293a4b5c6d7e8f9a0bc12\", {\n  endpoint: \"https://api.seller.x402/quote\",\n  amount: 2.5,\n  asset: \"USDC\",\n  policy: { maxPerCall: 5.0 },\n});\n\nif (!result.allowed) {\n  console.log(result.verdict, result.trustScore, result.reasons);\n}\n```\n\n## Surfaces\n\n| Surface        | Package                | Source                       |\n| -------------- | ---------------------- | ---------------------------- |\n| TypeScript SDK | `frisk-screen` (npm)   | [`typescript/`](typescript/) |\n| Python SDK     | `frisk-screen` (PyPI)  | [`python/`](python/)         |\n| MCP server     | `frisk-mcp` (npm)      | [`mcp/`](mcp/)               |\n\nBoth SDKs expose the same model: a `Client` with a `screen()` call, a `lite`\nmode that runs locally with zero dependencies, and an optional hosted mode for\nreputation history and live threat intelligence.\n\n## MCP server\n\nFor agents that cannot import a library, and for asking the question\ninteractively, the same checks are available as an MCP server exposing one\ntool, `screen_payment`:\n\n```json\n{\n  \"mcpServers\": {\n    \"frisk\": {\n      \"command\": \"npx\",\n      \"args\": [\"-y\", \"frisk-mcp\"]\n    }\n  }\n}\n```\n\nNo API key and no account: with no configuration it screens entirely on your\nmachine. It is listed in the MCP registry as `dev.tryfrisk/frisk`.\n\nAn MCP tool runs only when a model chooses to call it, so a check the model can\nskip is a weaker guarantee than the same check on the code path that signs the\npayment. Where the money actually moves, prefer the SDK. Details in\n[`mcp/`](mcp/).\n\n## Lite mode vs. hosted\n\n|            | Lite (default)                  | Hosted (API key)                              |\n| ---------- | ------------------------------- | --------------------------------------------- |\n| Runs       | Locally, offline                | Frisk API                                     |\n| Signals    | Public, structural checks only  | Reputation graph, trained models, threat feed |\n| Confidence | Always `low`                    | Rises with coverage                           |\n| Cost       | Free                            | Usage-based                                   |\n\nLite mode catches obvious problems — malformed counterparties, `payTo` swaps,\ninsecure endpoints, policy violations, and a small seed blocklist — without a\nnetwork call. The hosted API (`https://api.tryfrisk.dev`) adds reputation\nhistory and continuously updated threat intelligence.\n\n## What a verdict covers\n\nFrisk screens who you are paying. An `allow` means nothing disqualifying was\nfound by the checks you gave it enough information to run: the counterparty\nparses as an address and is not on the blocklist, the `payTo` the endpoint\nasked for matches the counterparty you named, the endpoint is served over\nHTTPS, and the amount and asset fall inside the policy you supplied. A check\nwhose input you leave out does not run and does not fail — omit\n`observedPayTo` and no `payTo` comparison happens. In hosted mode an `allow`\nalso means no adverse reputation history was found.\n\nIt says nothing about what comes back. Whether the response matches the shape\nyou expected, contains the data you paid for, or is worth the price is a\nseparate question, and Frisk deliberately does not answer it. Verifying the\nresponse contract is worth doing; it belongs after the call, on the buyer's\nside, against the buyer's own definition of a satisfactory answer.\n\nAn `allow` is not a claim of safety in general either. In lite mode confidence\nis always `low`, because the checks are structural: a counterparty with no\nhistory and no defects screens the same as one with a long clean record. The\nverdict is one input to your decision, which is why it is advisory.\n\n## Design principles\n\n- **Advisory, not in-path.** Frisk never holds your funds or blocks a payment\n  itself; it returns a verdict and your code decides.\n- **Zero runtime dependencies.** The TypeScript SDK is built on the platform\n  `fetch` API (Node, Bun, Deno, Workers, browser); the Python SDK uses only the\n  standard library.\n- **Typed.** Both SDKs ship with full type information.\n\n## Contributing\n\nSee [CONTRIBUTING.md](CONTRIBUTING.md). Security disclosures: [SECURITY.md](SECURITY.md).\n\n## License\n\n[MIT](LICENSE)\n\nThe hosted API at `api.tryfrisk.dev` is additionally governed by the\n[Terms of Service](TERMS.md).\n",
  "bytes": 5420,
  "sha": "b3c039c0324ff9f641b154586a4f9cc58340966ea57d6844ebf7d5b32cd88259",
  "repo_slug": "jiangw2718i/frisk",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_dev_tryfrisk_frisk_61ef2310/readme"
}