{
  "markdown": "# XGuard — Universal Paid AI Agent + Secretless Gateway\n\n**Canonical production API**\n\n```text\nhttps://api.xguardgate.com\n```\n\n> **Canonical identity — v5.1.0:** XGuard Universal Paid AI Agent + Secretless Gateway. Agents discover real tools, get a signed price, pay per request through x402 v2 USDC, and receive a signed receipt plus ProofRail evidence. Secretless Egress keeps reusable upstream credentials outside agent context. See [`CANONICAL_IDENTITY.md`](./CANONICAL_IDENTITY.md).\n\nThe primary no-account path is:\n\n```text\ndirect tool call → signed quote + HTTP 402 → verify + settle\n                 → controlled execution → signed receipt + ProofRail\n```\n\nThe first paid production tool is `xguard.web.fetch`: bounded public HTTPS `GET`/`HEAD` with SSRF protection, public-DNS validation, safe manual redirects, content/type/size/time limits, caching, stable errors, source timestamps and content hashes. Search, AI generation/routing and data-query tools are explicitly disabled until real connectors are configured.\n\n## Five-minute quickstart\n\nNo account or SDK is needed. The shortest path is one request; XGuard creates the signed quote and returns the standard x402 challenge without contacting the target:\n\n```bash\ncurl -i https://api.xguardgate.com/v1/tools/web.fetch \\\n  -H 'content-type: application/json' \\\n  -d '{\"url\":\"https://example.com/\"}'\n\n# Response: HTTP 402 + Payment-Required + X-XGuard-Quote.\n# Sign the challenge with an x402 v2 payer and retry the identical request with\n# Payment-Signature and X-XGuard-Quote. XGuard settles before execution.\n\n# Optional machine discovery and free preparation:\ncurl -sS https://api.xguardgate.com/v1/capabilities\ncurl -sS https://api.xguardgate.com/v1/pricing\ncurl -sS https://api.xguardgate.com/v1/payment/readiness\n\n# Optional free guard: validates HTTPS/SSRF/DNS/payment readiness without contacting the target\ncurl -sS https://api.xguardgate.com/v1/preflight \\\n  -H 'content-type: application/json' \\\n  -d '{\"url\":\"https://example.com/\",\"testnet\":true}'\n\ncurl -sS https://api.xguardgate.com/v1/pricing/quote \\\n  -H 'content-type: application/json' \\\n  -d '{\"url\":\"https://example.com/\",\"testnet\":true}'\n\n# A standalone signed quote remains available for clients that need a price preview.\n# Send its compact `quote` as X-XGuard-Quote; the response is the same HTTP 402.\ncurl -i https://api.xguardgate.com/v1/tools/web.fetch/testnet \\\n  -H 'content-type: application/json' \\\n  -H 'X-XGuard-Quote: <signed-quote>' \\\n  -d '{\"url\":\"https://example.com/\"}'\n```\n\nThe final payment payload is standard x402 v2; it can be produced by any compatible wallet/client. XGuard additionally requires the server-recommended `payment-identifier` returned in the quote and challenge. An exact retry returns the stored result and does not settle twice.\n\n### MCP\n\n```bash\ncurl -i https://api.xguardgate.com/mcp \\\n  -H 'content-type: application/json' \\\n  -d '{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"tools/call\",\"params\":{\"name\":\"xguard.web.fetch\",\"arguments\":{\"url\":\"https://example.com/\"}}}'\n```\n\n### A2A\n\n```bash\ncurl -i https://api.xguardgate.com/a2a \\\n  -H 'content-type: application/json' -H 'a2a-version: 1.0.0' \\\n  -d '{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"SendMessage\",\"params\":{\"message\":{\"messageId\":\"fetch-1\",\"role\":\"ROLE_USER\",\"parts\":[{\"data\":{\"action\":\"xguard.web.fetch\",\"input\":{\"url\":\"https://example.com/\"}}}]}}}'\n```\n\n### TypeScript and Python discovery\n\n```ts\nconst capabilities = await fetch(\"https://api.xguardgate.com/v1/capabilities\").then(r => r.json());\nconst quote = await fetch(\"https://api.xguardgate.com/v1/pricing/quote\", {\n  method: \"POST\",\n  headers: { \"content-type\": \"application/json\" },\n  body: JSON.stringify({ url: \"https://example.com/\", testnet: true }),\n}).then(r => r.json());\n```\n\n```python\nimport requests\n\ncapabilities = requests.get(\"https://api.xguardgate.com/v1/capabilities\", timeout=10).json()\nquote = requests.post(\n    \"https://api.xguardgate.com/v1/pricing/quote\",\n    json={\"url\": \"https://example.com/\", \"testnet\": True},\n    timeout=10,\n).json()\n```\n\nCanonical discovery surfaces: `/mcp`, `/a2a`, `/.well-known/agent-card.json`, `/.well-known/oauth-protected-resource/mcp`, `/.well-known/payment-manifest`, `/.well-known/x402-facilitator.json`, `/openapi.json`, `/llms.txt`, `/v1/capabilities`, `/v1/preflight`, `/v1/pricing`, `/v1/payment/readiness`, `/v1/health`, and `/v1/ready`.\n\nBase Sepolia is integration-only and every test settlement is recorded as `environment=test, revenue=false`. Production quotes use Base Mainnet and the configured production recipient/facilitator; revenue is recorded only for an external production settlement with transaction evidence.\n\n`xguard.web.fetch` is the mandatory guarded execution choke point: its first direct call returns the input-bound quote and 402 automatically, and every paid retry requires x402 v2 settlement before the target is contacted. `xguard.preflight` and the standalone quote endpoint remain optional free preparation. When an operator keeps a reusable upstream credential only in XGuard, Secretless Egress is likewise the required credential-backed path for that environment.\n\n## Secretless credential path\n\nXGuard keeps reusable upstream credentials **out of AI agents**. Operators store a Stripe, GitHub, OpenAI, Anthropic, Slack, Notion, Cloudflare, Gemini or custom API credential once, then give the agent only a short-lived scoped XGuard capability.\n\n```text\nOperator secret\n     ↓\nEncrypted XGuard credential vault\n     ↓\nScoped capability\n     ↓\nAI agent\n     ↓\nXGuard Secretless Egress\n     ↓\ncredential injected server-side\n     ↓\nupstream API\n```\n\nThe agent never receives the reusable upstream credential.\n\n> XGuard becomes an actual choke point when an operator keeps the reusable credential only in XGuard and delegates capabilities instead of redistributing that credential. XGuard does not claim control over unrelated Internet traffic.\n\n## Why Secretless Egress\n\nA reusable bearer token inside an autonomous agent can be copied, logged, placed in context, reused outside the intended request or leaked to an untrusted tool. XGuard changes the primitive from **secret possession** to **scoped capability possession**.\n\nThe current egress boundary provides:\n\n- encrypted reusable credential storage;\n- provider presets for OpenAI, Anthropic, GitHub, Stripe, Slack, Notion, Cloudflare and Gemini;\n- custom header-based credentials restricted to explicit public HTTPS hosts;\n- short-lived capabilities;\n- exact HTTPS origin binding;\n- path-prefix allowlists;\n- HTTP method allowlists;\n- maximum call counts;\n- Usage Credit billing before secret release and before outbound network egress;\n- no automatic credential forwarding across redirects;\n- private/local target blocking;\n- automatic `Idempotency-Key` injection for unsafe methods;\n- no blind automatic replay after network ambiguity;\n- MCP discovery and egress execution without exposing credential provisioning to model context.\n\n## Egress API\n\nMachine-readable contract:\n\n```text\nGET https://api.xguardgate.com/v1/egress\nGET https://api.xguardgate.com/.well-known/xguard-egress.json\nGET https://api.xguardgate.com/.well-known/xguard-egress-key.json\nGET https://api.xguardgate.com/v1/egress/providers\n```\n\n### 1. Operator stores a reusable credential\n\nCredential provisioning is intentionally an **operator API**, not an MCP tool.\n\n```http\nPOST /v1/egress/credentials\nX-XGuard-Key: <usage-credit-key>\nContent-Type: application/json\n```\n\n```json\n{\n  \"provider\": \"github\",\n  \"value\": \"<github-token>\",\n  \"label\": \"production-github\",\n  \"allowed_paths\": [\"/repos/\"],\n  \"allowed_methods\": [\"GET\", \"POST\"]\n}\n```\n\nXGuard returns only credential metadata such as `xcred_...`; the reusable secret is not returned.\n\n### 2. Operator issues a short capability\n\n```http\nPOST /v1/egress/capabilities\nX-XGuard-Key: <usage-credit-key>\nContent-Type: application/json\n```\n\n```json\n{\n  \"credential_id\": \"xcred_...\",\n  \"target_origin\": \"https://api.github.com\",\n  \"path_prefix\": \"/repos/\",\n  \"allowed_methods\": [\"GET\", \"POST\"],\n  \"ttl_seconds\": 300,\n  \"max_calls\": 10\n}\n```\n\nThe returned `xgc_...` capability is what the agent receives.\n\n### 3. Agent executes without the upstream secret\n\n```http\nPOST /v1/egress/fetch\nContent-Type: application/json\n```\n\n```json\n{\n  \"capability\": \"xgc_...\",\n  \"target\": \"https://api.github.com/repos/org/repo/issues\",\n  \"method\": \"POST\",\n  \"body_json\": {\n    \"title\": \"Example\"\n  }\n}\n```\n\nXGuard validates capability scope and billing, injects the GitHub credential server-side, sends one HTTPS request and never exposes the reusable GitHub token to the agent.\n\nPricing contract:\n\n```text\nGET /v1/egress/pricing\n```\n\nThe current configuration consumes **1 XGuard Usage Credit per authorized credential-backed egress attempt**. Billing is committed before credential decryption and before outbound network egress. If billing cannot commit, no upstream request is sent.\n\n## MCP\n\nCanonical MCP endpoint:\n\n```text\nhttps://api.xguardgate.com/mcp\n```\n\nAgent-facing tools include:\n\n```text\nxguard_secretless_egress\nxguard_egress_fetch\nxguard_action_rail\n```\n\nReusable credential creation is deliberately **not** exposed as an MCP tool.\n\n## Action Rail underneath\n\nThe no-account paid-tool path and Secretless Egress are the primary product boundaries. XGuard Action Rail remains available underneath for stronger execution controls around payments, purchases, bookings, messages, deployments, deletes, API writes and tool calls.\n\n```text\nPOST /v1/mandates\nPOST /v1/actions/permits\nPOST /v1/actions/execute\nGET  /v1/actions/permits/{permit_id}\n```\n\nAction Rail adds scoped mandates, request-bound cryptographic permits, replay rejection, durable execution state and receipts.\n\n## Universal and Edge deployment\n\nFor operator-controlled infrastructure XGuard can also be placed in front of an origin:\n\n```text\nInternet / Ingress\n      ↓\nXGuard Universal Gate\n      ↓\nprivate origin\n```\n\nThe repository includes Cloudflare Edge Gate, portable Node deployment, Docker, Docker Compose, Kubernetes and OpenAPI AutoGate components.\n\n## Native x402 and paid execution\n\nx402 v2 is the primary no-account payment path for paid agent tools. XGuard also retains its facilitator relay endpoints for backwards compatibility.\n\n```text\nGET  /supported\nPOST /verify\nPOST /settle\nGET  /facilitator\nGET  /.well-known/x402\nGET  /v1/facilitator/route\n```\n\nXGuard remains a non-custodial x402 v2 facilitator gateway with capability-aware routing, replay protection, Base USDC reconciliation and fail-closed ambiguous settlement behavior.\n\n## Security model\n\n- reusable upstream credentials are encrypted at rest using per-record AES-GCM keys wrapped by an XGuard RSA-OAEP authority;\n- secret values are not included in agent capabilities;\n- operator XGuard Usage Credit keys are encrypted into capability state and are not handed to agents;\n- capabilities bind an origin, path prefix, methods, expiry and maximum calls;\n- user-supplied headers cannot override the injected credential header or XGuard control headers;\n- private/local targets and XGuard self-targets are blocked;\n- redirects are not automatically followed with injected credentials;\n- billing commits before secret decryption and network egress;\n- unsafe methods receive an XGuard-generated `Idempotency-Key` when the caller did not supply one;\n- XGuard does not automatically replay a credential-backed request after a network ambiguity.\n\n## Machine discovery\n\n```text\nGET /.well-known/xguard-egress.json\nGET /.well-known/xguard-actions.json\nGET /.well-known/xguard.json\nGET /.well-known/ai-plugin.json\nGET /.well-known/agent-card.json\nGET /architecture\nGET /v1/protocols\nGET /openapi.json\nGET /llms.txt\nGET /skill.md\nGET /sitemap.xml\n```\n\n## Production domains\n\n```text\nhttps://xguardgate.com\nhttps://api.xguardgate.com\n```\n\nThe Cloudflare Worker configuration disables the public `workers.dev` route so XGuard's production identity is limited to the custom XGuard domains.\n\nRepository:\n\n```text\nhttps://github.com/moelayyan90/XGuard\n```\n",
  "bytes": 12022,
  "sha": "18853eba8c92850f48e01394706e252fdcd458905ea581d36532058832de6315",
  "repo_slug": "moelayyan90/xguard",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_moelayyan90_xguard_554512a6/readme"
}