The full upstream README, mirrored here for reference. Install config, tool schemas, adoption signals, and an original overview live on the Warden402 MCP listing page.
warden402.xyzThe pre-execution security & trust layer for agents transacting on Base.
Give Warden a token, a pending transaction, or an address → get a single decision:
block · review · clear with reasons, a risk score, and a plain-language summary.
Warden uses the x402 Bazaar as its intelligence backend and builds judgment, a provable track record, and (next) a firewall on top.
x402 infrastructure is ahead of demand; the missing layer is trust. The marketplace vertical is crowded (Coinbase Bazaar + dozens of clones), but pre-execution security is wide open. Warden owns that vertical.
| Path | What |
|---|---|
web/ | The website (warden402.xyz) — landing + live demo + track-record. Runs the guard in-process, so it deploys as a single Vercel project. |
src/ | Standalone Hono Guard API (same logic) — for agents/SDK/MCP and a persistent-ledger host. |
sdk/ | @warden402/sdk — client + enforce/assertSafe gate + LangChain tools. |
mcp/ | warden402-mcp — stdio MCP server exposing guard_token / guard_tx / guard_address. |
scripts/ | smoke.ts (offline decision tests), probe.ts (calibration), recheck.ts (outcome re-checker). |
Every endpoint returns a Verdict (src/schema/verdict.ts). Principles:
decision and riskScore come from deterministic
rules; the LLM only writes summary. Auditable.unknown → degraded:true
→ the verdict is review at worst, never a false clear.verdictId + signal evidence) → the track-record moat.honeypot or sanctions fail → block (regardless of score).fail (e.g. liquidity collapse) floors the decision at review (can't be
diluted by the average). 2+ warns → review. Else clear.| Endpoint | What it checks |
|---|---|
GET /guard/token?address= | honeypot, taxes, liquidity, holder concentration, OFAC |
POST /guard/tx {from,to,calldata} | decodes calldata (unlimited approve / setApprovalForAll), sanctions + contract risk on the counterparty |
GET /guard/address?address= | sanctions, contract risk, age/activity |
GET /track-record | public trust stats (decision mix, hit-rate, rugs caught/missed) |
(The website exposes the same via /api/guard.)
web/ is the production API + site. Deployed as a single Vercel project
(Root Directory = web). It runs the guard/firewall in-process, so the
endpoints agents actually call (/api/guard, /api/firewall) are live here.
Hot path is edge-friendly: KV store (no fs) + per-IP rate limiting.
Persistence turns on when KV_REST_API_URL / KV_REST_API_TOKEN are set.src/ (Hono API) is an optional Node host — for teams that want a
persistent-disk ledger or the x402 payment layer. Not required; not deployed by
default. The src/ modules are the canonical logic; a drift-guard test
(tests/drift.test.ts) proves the web copy stays identical.npm test fails if the two diverge.See DEPLOY.md. TL;DR: new Vercel project, Root Directory = web,
set BAZAAR_INTERNAL_SECRET (+ optional KV_REST_API_URL/KV_REST_API_TOKEN for
persistent track-record), deploy. Done.
Warden calls Bazaar without paying x402 (so our own products don't bill themselves) via
the X-Warden-Internal header. Bazaar must have a matching WARDEN_INTERNAL_SECRET. Until
set, all signals come back unknown and verdicts stay safely at review.
/guard/token) + verdict contract/guard/tx (pre-sign) + /guard/address + track-record + re-checker