{
  "markdown": "# IntentFence\n\nIntentFence is a fail-closed authorization firewall for autonomous AI agents.\nImmediately before a consequential MCP, HTTP, A2A, or payment action, it binds\nthe exact action and payload hash to explicit action/resource allowlists, spend\nand retention ceilings, and optional action-specific approval. It returns a\nfive-minute ES256 receipt; the TypeScript and Python SDKs verify the receipt and\nlocal action digest before executing the caller-owned callback. IntentFence\nnever executes downstream tools and should never receive credentials or wallet\nkeys. It also provides MCP metadata scanning and x402 payment-safety checks.\n\n- `safe_to_proceed`\n- `needs_review`\n- `denied`\n\nProduction: <https://agentpass-protocol.rmalka06.chatgpt.site>\n\nx402scan: <https://www.x402scan.com/server/c495c104-dba4-4764-86b1-96b8b0cda48b>\n\nOfficial MCP Registry: <https://registry.modelcontextprotocol.io/v0.1/servers?search=io.github.razel369%2Fintentfence>\n\n[![razel369/intentfence MCP server](https://glama.ai/mcp/servers/razel369/intentfence/badges/score.svg)](https://glama.ai/mcp/servers/razel369/intentfence)\n\n## Protocol surfaces\n\n| Surface | Endpoint |\n| --- | --- |\n| Action-bound authorization | `POST /api/actions/authorize` |\n| Paid self-service production policy pack | `POST /api/policy-packs` |\n| Free MCP metadata risk scan | `POST /api/agent-risk/scan` |\n| Free REST preview | `POST /api/preflight` |\n| Paid x402 decision | `POST /api/preflight/verified` |\n| Paid caller-observed x402 quote assessment | `POST /api/x402-assessments` |\n| Paid live x402 endpoint readiness | `POST /api/x402-readiness` |\n| Paid live Base wallet-risk assessment | `GET /api/wallet-risk?address=...` |\n| Paid signed official U.S. CPI data | `GET /api/us-cpi?month=YYYY-MM` |\n| Receipt verification | `POST /api/receipts/verify` |\n| Public ES256 keys | `GET /.well-known/jwks.json` |\n| MCP Streamable HTTP | `/api/mcp` (`intentfence_verified_preflight` is x402-paid) |\n| A2A Agent Card | `GET /.well-known/agent-card.json` |\n| x402 service manifest | `GET /.well-known/x402` |\n| Public aggregate metrics | `GET /api/metrics` |\n| OpenAPI | `GET /openapi.json` |\n\n## Fail-closed action authorization\n\nThe hosted MCP tools `intentfence_authorize_action` and\n`intentfence_agent_risk_scan` are available without an API key and are\nrate-limited. Authorization signs the exact caller-supplied action and policy\ndigests for five minutes but does not validate the truth of a self-declared\nidentity or approval source. Production callers must verify the receipt,\nre-hash the local action, and block on denial, review, expiry, mismatch, network\nfailure, or verification failure. Use the TypeScript `enforceAction` or Python\n`run_authorized` helper to make that boundary executable.\n\nThe scanner evaluates caller-supplied MCP metadata only. It highlights missing\nschemas, annotations, action-bound approval, and financial limits, but does not\nexecute tools, inspect source code, or certify security or compliance.\n\nOfficial U.S. CPI costs 0.001 USDC; live readiness and wallet risk cost 0.002 USDC; signed preflight and exact-quote assessment cost\n0.005 USDC on Base through x402. A successful call\nreturns both the facilitator's `PAYMENT-RESPONSE` settlement header and an\nIntentFence ES256 compact-JWS receipt.\n\nWallet risk is the recommended first check before paying a Base recipient. It\nuses live Base RPC activity and GoPlus malicious-address intelligence. A\n`safe_to_proceed` result means no listed malicious flags were observed and the\naddress was established on Base at assessment time; it does not prove identity,\nownership, authorization, or future behavior.\n\nInstall the recurring pre-payment skill to attach that check to new Base\nrecipients:\n\n```bash\nnpx skills add razel369/intentfence --skill screen-base-wallets\n```\n\nThe skill can run without interrupting an autonomous workflow only when the\nwallet owner already approved a standing 0.002 USDC screening budget and the\nwallet enforces it. It blocks the downstream payment on review, denial, missing\nsettlement proof, invalid receipt, or service failure.\n\nThe live readiness check is the simplest first call when an agent only has an endpoint URL. It makes one bounded credential-free request, rejects private-network targets and redirects, validates the returned challenge, never pays the target, and signs the result for five minutes.\n\nThe quote assessment is the recommended check after an x402 merchant returns\nits unpaid challenge and before the agent signs the merchant payment.\nThe agent supplies `subject`, `target_url`, optional `method` (`GET`, `HEAD`, or\n`POST`), the base64 `payment_required` header (maximum 16 KiB), and a policy with\n`max_price_usdc` plus an optional `allowed_payees` list. IntentFence validates\nx402 v2, exact scheme, Base mainnet, canonical Base USDC, price, payee, and exact\nresource binding. It requires the canonical USDC EIP-712 domain and sends\nPermit2, unknown transfer metadata, and active extensions to review. A\n`safe_to_proceed` result requires an explicit matching\n`allowed_payees` entry; omitting the list yields `needs_review`. IntentFence\nnever fetches or pays the target. Every advertised payment option must satisfy\nevery automatic check; mixed safe and unsafe option sets are denied.\n\n## Self-service production policy pack\n\nAn agent or developer can buy a complete production guard without an account,\nemail, meeting, or sales call:\n\n```text\nPOST /api/policy-packs\n```\n\nThe request selects `openai-agents-js`, `cloudflare-agents`,\n`coinbase-agentkit`, or `mcp-gateway` and supplies one exact action plus its\nallowlists, spend ceiling, retention limit, and optional approval policy. The\nfirst request returns an x402 challenge for exactly 1 USDC on Base. After\nsettlement, the same response delivers a copy-ready TypeScript guard, signed\naction and policy receipt, allowed/denied/over-budget test vectors, and a\nfail-closed deployment checklist. The buyer must review the generated code and\nkeep all credentials in its own runtime.\n\n## Install now\n\nThe hosted MCP endpoint is available without an API key:\n\n```text\nhttps://agentpass-protocol.rmalka06.chatgpt.site/api/mcp\n```\n\n### Install the local stdio MCP package\n\nAgents and MCP clients that require a local process can run the immutable public\n0.11.0 release directly. This does not require an npm account, repository clone,\nor IntentFence API key:\n\n```bash\nnpx --yes --package https://github.com/razel369/intentfence/releases/download/mcp-v0.11.0/razel369-intentfence-mcp-0.11.0.tgz intentfence-mcp\n```\n\nThe release artifact is built and tested by GitHub Actions. Its SHA-256 digest\nis `f0cdf3df28da8a5c037e48193cbb4602744b5fb0b6c182d877abedb707b1e9f9`.\nUse the hosted endpoint above when the client supports Streamable HTTP.\n\n### Install in an agent runtime\n\n- [OpenAI Agents SDK fail-closed guard](integrations/openai-agents-js)\n- [Cloudflare Agents fail-closed guard](integrations/cloudflare-agents)\n- [Coinbase AgentKit pinned x402 checkout](integrations/coinbase-agentkit)\n- [Generic MCP gateway guard](integrations/mcp-gateway)\n\nAll adapters keep credentials in the caller runtime and execute the downstream\naction only after the exact local action digest and ES256 receipt verify.\n\n#### Opt-in one-call payment for local agents\n\nThe local stdio package can handle the x402 challenge, sign it, retry the tool\ncall, and return the settled result without requiring special MCP-client\nsupport. Automatic payment is disabled unless all three values below are set:\n\n```text\nINTENTFENCE_EVM_PRIVATE_KEY=<buyer-controlled 0x-prefixed key>\nINTENTFENCE_MAX_AUTO_PAYMENT_USDC=0.005\nINTENTFENCE_AUTO_PAYMENT_BUDGET_USDC=0.05\n```\n\nSupply the key through the agent runtime's secret manager or process\nenvironment; never commit it to an MCP configuration file. The package signs\nonly `exact` Base-mainnet USDC requirements addressed to the published\nIntentFence recipient, rejects any payment above the per-call ceiling, and\nreserves every attempted signature against the process-lifetime budget before\nsigning. Failed attempts remain reserved, so retry loops and concurrent calls\ncannot exceed the cap. The private key stays in the buyer's local process and is\nnever sent to IntentFence.\n\n#### Build an exact machine checkout\n\nAgents do not need to infer which endpoint, method, payload, or payment cap\nmatches a product. Read the catalog, then submit the exact product input:\n\n```bash\ncurl https://agentpass-protocol.rmalka06.chatgpt.site/api/checkout\n\ncurl -X POST https://agentpass-protocol.rmalka06.chatgpt.site/api/checkout \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"product\":\"wallet-risk\",\"input\":{\"address\":\"0x1111111111111111111111111111111111111111\"}}'\n```\n\nThe checkout response is free and never initiates payment. It returns a\nvalidated HTTP request, shell-safe Agentic Wallet argv, POSIX and PowerShell\ncommands, Coinbase Agentic Wallet MCP instructions, an `mcpc --x402` call, the\nmatching Agent Skill, the matching MCP tool and arguments, and an exact Base\nUSDC ceiling. Paid MCP tools advertise `_meta.x402` for clients that can sign\nbefore the first tool call.\nAgents must still review and authorize the payment and require\n`PAYMENT-RESPONSE` settlement proof.\n\n### Install in VS Code\n\n[Open the live install panel](https://agentpass-protocol.rmalka06.chatgpt.site/#vscode-install),\nthen select **Install IntentFence in VS Code**.\n\nThe install action contains only the public server name, transport, and URL. VS\nCode asks you to review and trust the server before its first start. The free\npolicy-preview tool works with no API key. Paid calls through the hosted server\nneed an x402-capable client; runtimes without one can use the budget-capped local\nstdio mode above.\n\nManual `.vscode/mcp.json` or user-profile fallback:\n\n```json\n{\n  \"servers\": {\n    \"IntentFence\": {\n      \"type\": \"http\",\n      \"url\": \"https://agentpass-protocol.rmalka06.chatgpt.site/api/mcp\"\n    }\n  }\n}\n```\n\nReview the server details yourself before starting a manually configured server.\n\nSee the [official VS Code MCP installation documentation](https://code.visualstudio.com/api/extension-guides/ai/mcp#create-an-mcp-installation-url).\n\n### Install the cross-agent payment guard\n\nInstall the open Agent Skill in Codex, Claude Code, Cursor, Gemini CLI, GitHub\nCopilot, and other skills-compatible agents:\n\n```bash\nnpx skills add razel369/intentfence --skill guard-x402-payments\n```\n\n[Review the complete skill before installing it](https://github.com/razel369/intentfence/tree/main/skills/guard-x402-payments).\n\nThe skill triggers when an agent is about to sign an x402 payment. It teaches\nthe agent to capture the exact quote, enforce a caller-defined ceiling and\npayee allowlist, keep wallet credentials local, and use IntentFence only after\nthe 0.005 USDC assessment fee is authorized. It includes a capped Coinbase\nAgentic Wallet buyer path for agents that already use an authenticated wallet.\n\nAgents that have only a public x402 URL can install the narrower live-readiness\nskill. It probes the route without credentials or target payment, blocks\nredirects and private-network targets, validates the returned challenge, and\nrequires explicit authorization before the 0.002 USDC IntentFence fee:\n\n```bash\nnpx skills add razel369/intentfence --skill inspect-x402-endpoints\n```\n\nThe official x402 client buyer example verifies the live fee challenge before\ncreating a signer and is payment-disabled by default:\n\n<https://github.com/razel369/intentfence/tree/main/examples/x402-buyer>\n\nAgents that already use Coinbase Agentic Wallet can retrieve a complete capped\ncheckout from `GET /api/payments` under `buyer_quickstart`. The published\ncommand is pinned to a verified CLI version, includes a valid policy body, and\nsets `--max-amount 5000` so it cannot authorize more than the 0.005 USDC\nIntentFence fee. Review the body and explicitly authorize the real payment\nbefore running it.\n\nProjects that already own a Coinbase AgentKit EVM wallet can use the\n[pinned AgentKit adapter](https://github.com/razel369/intentfence/tree/main/integrations/coinbase-agentkit).\nUnlike an automatic retry, it binds the payment to the exact IntentFence URL,\nBase network, canonical USDC asset, 5000-atomic-unit amount, and recipient,\nthen calls the buyer's own authorization function before signing. The matching\nmachine-readable manifest is published at\n<https://agentpass-protocol.rmalka06.chatgpt.site/integrations/coinbase-agentkit.json>.\n\nGemini CLI can install the repository directly, without waiting for an npm\npackage or gallery crawl:\n\n```bash\ngemini extensions install https://github.com/razel369/intentfence\n```\n\nThe extension starts a dependency-free local MCP bridge and exposes the free\npreview plus the x402-paid verified preflight and quote-assessment tools.\n\n## Caller-observed x402 quote assessment\n\nThe first call returns the standard `PAYMENT-REQUIRED` challenge for the\nIntentFence fee:\n\n```bash\ncurl -i -X POST https://agentpass-protocol.rmalka06.chatgpt.site/api/x402-assessments \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"subject\":\"agent:buyer-07\",\"target_url\":\"https://merchant.example/api/paid-resource\",\"method\":\"GET\",\"payment_required\":\"BASE64_PAYMENT_REQUIRED_HEADER\",\"policy\":{\"max_price_usdc\":\"0.10\",\"allowed_payees\":[\"0x1111111111111111111111111111111111111111\"]}}'\n```\n\nRetry the same request with a valid x402 v2 `PAYMENT-SIGNATURE`. A successful\nresponse contains the validated caller-observed challenge fields,\npass/review/deny checks, a SHA-256 binding to the full target URL and exact\npayment requirement, and an ES256-signed assessment receipt. The assessment\nuses assurance `caller-observed-x402-quote-assessment` and verification tier\n`x402-quote-assessment+x402-settled`; x402 settlement covers the 0.005 USDC\nIntentFence assessment fee, not the target payment.\n\n## Live Base wallet risk\n\nThe first call returns an x402 challenge for 0.002 USDC:\n\n```bash\ncurl -i \"https://agentpass-protocol.rmalka06.chatgpt.site/api/wallet-risk?address=0x1111111111111111111111111111111111111111\"\n```\n\nRetry the same URL with a valid x402 v2 `PAYMENT-SIGNATURE`. The successful\nresponse includes Base account activity, native and USDC balances, a code hash\nfor contracts, current malicious-address flags, pass/review/deny checks, and a\nfive-minute ES256 receipt with assurance `live-base-wallet-risk`. If a required\nlive source is unavailable, the endpoint fails closed and does not intentionally\nsettle the assessment fee.\n\n## Important trust boundary\n\nDeclared-input receipts attest only that IntentFence evaluated caller-supplied\npolicy data. Quote-assessment receipts bind the exact caller-observed\n`PAYMENT-REQUIRED` challenge; they do not prove that IntentFence contacted the\nmerchant, or prove merchant identity, delivery, or downstream enforcement. The\nreceipt-signing key is separate from the USDC recipient wallet. IntentFence\nnever needs a payer's seed phrase or wallet private key. Wallet-risk receipts\nreport observed evidence at one point in time and are not identity attestations.\n\n## Local development\n\n```bash\nnpm install\nnpm run dev\n```\n\nFor MCP clients that launch local `stdio` servers, use `npm run mcp:stdio`.\nGlama and other container-based hosts can build the root `Dockerfile`; it starts\nthe same IntentFence policy engine and responds to MCP initialization,\n`tools/list`, and `tools/call` requests over standard input/output.\n\n```bash\ndocker build -t intentfence-mcp .\ndocker run --rm -i intentfence-mcp\n```\n\nThe production signing key is stored in Sites as the secret\n`INTENTFENCE_SIGNING_PRIVATE_JWK`. Generate a separate development key with:\n\n```bash\nnode scripts/generate-signing-key.mjs /secure/path/intentfence-private-jwk.json\n```\n\nNever commit the generated private JWK. Publish only its public coordinates in\n`/.well-known/jwks.json`.\n\n## Validation\n\n```bash\nnpm run test\nnpm run lint\nnpx tsc --noEmit\nnpm run sdk:check\nnpm run smoke:mcp:docker\nnpm run smoke:mcp:stdio\nnpm run smoke:protocol -- http://localhost:3000\n```\n\nSet `INTENTFENCE_TEST_PRIVATE_JWK_PATH` only for a local smoke test that should\nexercise the signed-receipt verifier.\n\n## Distribution\n\nTypeScript and Python SDKs live in `sdk/`. The root `server.json` is ready for\nthe official MCP Registry under `io.github.razel369/intentfence`; the public MCP\nendpoint uses Streamable HTTP and requires no API key.\n\nThe `/.well-known/x402` service manifest and Bazaar metadata make both paid\nendpoints crawlable by x402 indexes and autonomous tool routers. Production\nresources are continuously checked, and the original verified-preflight route\nis registered on x402scan.\n\nProduction uses PayAI by default. When both `CDP_API_KEY_ID` and\n`CDP_API_KEY_SECRET` are configured in the hosted runtime, verification and\nsettlement switch to Coinbase CDP. That makes successful Bazaar-enabled route\nsettlements eligible for Coinbase Bazaar indexing; configuration alone does\nnot create a listing or count as customer revenue.\n\n## Commercial path\n\nThe fastest no-contact path to production is the 1 USDC policy pack for one\nguarded purchase, transfer, booking, deployment, deletion, or other\nconsequential action. The machine-readable offer and capped Agentic Wallet\ncheckout are published by `GET /api/payments`.\n\nSee [docs/PROTOCOL.md](docs/PROTOCOL.md) and\n[docs/SECURITY.md](docs/SECURITY.md) for the protocol and security model.\n",
  "bytes": 17386,
  "sha": "ca1ef17742f6d5658ac303a85b807e8a2e8256eb6cffb0f8eee8814ab8c69377",
  "repo_slug": "razel369/intentfence",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_razel369_intentfence_068675aa/readme"
}