Vouch

A per-call payment trust & reputation API for AI agents — monetized over x402.

When an autonomous agent is about to pay a merchant, API, or counterparty, it asks Vouch one question first: is this safe to pay? Vouch returns an explainable trust score, and charges a fraction of a cent per call in USDC — no accounts, no API keys, no Stripe. Billing is the x402 protocol itself.

Why

The agentic-commerce rails (Coinbase x402, AWS, Visa, Mastercard, Agnic) are being built by giants. The governance layer — should this agent trust this counterparty with money? — is the named #1 blocker to autonomous spend and is wide open. Vouch is a thin, self-serve pick-and-shovel on top of those rails.

Every call makes the product better: checks and community reports accrete into a reputation dataset that compounds with usage — the moat a bootstrapped team can actually build.

How it works

agent ──POST /v1/check { target }──▶  x402 paywall (402 → pay USDC → retry)
                                          │
                                          ▼
                          ┌─────────── scoring engine ───────────┐
                          │ transport · domain heuristics ·       │
                          │ threat feed · reputation (D1)         │
                          └───────────────────────────────────────┘
                                          │
                            { score, risk, reasons[] }

Scoring is a weighted average of independent signals, with a safety override: any single hard-negative signal (e.g. a threat-feed hit) caps the overall score so one strong red flag can't be averaged away.

Use it from your agent

Vouch is a real MCP server, an x402-paid HTTP API, and a tiny SDK — pick whichever fits your stack. Nothing needs an account or API key.

MCP (free tools, works in any MCP client)

Point your client at the Streamable-HTTP endpoint — it exposes vouch_score and vouch_report, and ships model-facing instructions so the agent knows to check a counterparty before it pays:

{
  "mcpServers": {
    "vouch": { "type": "streamable-http", "url": "https://vouch.futuronoti.workers.dev/mcp" }
  }
}

For clients that only speak stdio, bridge it with npx mcp-remote https://vouch.futuronoti.workers.dev/mcp. Vouch is also listed in the official MCP registry as io.github.notifuturo/vouch.

Free HTTP (curl)

curl -s https://vouch.futuronoti.workers.dev/v1/score \
  -H 'content-type: application/json' -d '{"target":"https://some-merchant.com"}'
# → {"target":"...","host":"some-merchant.com","score":91,"risk":"low"}

Gate a payment with the SDK (one line)

import { assertTrusted } from "vouch-sdk";

await assertTrusted("https://some-merchant.com", { minScore: 75 }); // free; throws if risky
await payTheMerchant();

The paid POST /v1/check adds the explainable reasons, weighted signals, and a signed Ed25519 attestation (keep it as proof of due diligence). See examples/buyer.ts for the full x402 pay-and-retry loop and sdk/ for the client.

Endpoints

CORS is open (*) and the x402 payment headers are exposed, so browser-hosted agents can preflight and complete the pay/retry flow.

Reading /v1/report (abuse model)

POST /v1/report is free and unauthenticated by design — anyone can submit a flag or vouch for a host, so the raw flags/vouches counts are community signals, not ground truth. Abuse is contained by:

• Rate limiting — 10 reports per 60s per client IP (Cloudflare Rate Limiting, fails closed).
• Reporter-standing weighting — each counted report contributes a weighted amount (not a flat +1) based on the reporting source's tenure: a brand-new or anonymous source counts at 0.3, ramping to 1.0 only after ~7 days of sustained reporting. The scoring signal uses these weighted totals, so spinning up fresh sybil identities buys far less influence. A source can also move a given host's counter at most once per 24h (per-source de-dup); raw counts are still logged for audit.
• Poisoning resistance in scoring — community reputation is a non-authoritative signal: it can lower a score but cannot, on its own, force a critical verdict. Only objective signals (threat feeds, transport) can hard-cap the score. So a burst of anonymous flags can't unilaterally brand a legitimate counterparty as unsafe.
• Bounded input — target/reason/reporter are length-capped before storage.

Treat /v1/stats and report counts as a crowd-sourced prior that informs the paid verdict, not as an authoritative blocklist.

Stack ($0 to run)

TypeScript · Hono · Cloudflare Workers (free tier) · D1 (free SQLite) · @x402/* v2 · public facilitator at x402.org/facilitator.

Live on Base mainnet (X402_NETWORK=base, real USDC, $0.01/call). For local development, set X402_NETWORK=base-sepolia and fund a throwaway wallet from the free Circle faucet. The live network and price are authoritatively advertised at /.well-known/x402.

Develop

npm install
npm run typecheck
npm test

cp .dev.vars.example .dev.vars   # set PAY_TO_ADDRESS (your testnet wallet)
wrangler d1 create vouch         # paste database_id into wrangler.toml
npm run db:init                  # apply schema locally
npm run dev                      # local Worker

License

MIT — see LICENSE.