X402 Presign Guard MCP Server

x402-presign-guard

"Should I sign this?" — a pay-per-call pre-sign safety layer for AI trading/wallet agents. An agent POSTs a raw EVM transaction (or an approval) before signing; this decodes the calldata, flags the patterns that drain wallets, and returns GO / HOLD / BLOCK. Settles in USDC via x402 to a self-custody (pseudonymous) wallet.

Why this axis (the honest frame)

10-angle research (2026) on the x402 / agent-payment economy concluded:

• Real x402 demand is tiny and hyper-concentrated (~$28K/day real commerce; the all-time #1 data seller ≈ $940/mo). Flat/commodity APIs — dates, OCR, raw chain reads — earn ≈ $0. (Confirms why the earlier x402-jp-data fleet made nothing.)
• The only categories with real crypto-native willingness-to-pay: computed risk/safety verdicts a trading agent must get before it signs — and first-party MEASURED data you generate yourself (no scraping ToS / copyright, un-backfillable time-series).
• This project is both: a computed pre-sign verdict (not a commodity score card), backed by an accumulating malicious-signature set — the moat that gets bigger the longer it runs.

Honest expectation: $1,000/mo is NOT achievable passively on x402 rails in 2026 — it's above the current top seller. The realistic path is distribution: ship this as an MCP tool that lands in agents' default toolsets (dual-rail: x402 pay-per-call + flat MCP key). x402 is the on-ramp; the MCP install base is the demand. The POC proves the mechanism and starts the compounding asset now.

What it does (POC — pure code, no keys, no RPC)

src/decode.ts statically decodes calldata and catches the real drain vectors:

• unlimited approve / increaseAllowance to an unknown or known-malicious spender
• setApprovalForAll(true) (classic NFT drainer) to unknown / malicious operators
• gasless permit / Permit2 approvals (common drainer vector)
• transfer / transferFrom to known-malicious recipients
• calls to known-malicious contracts; unknown selectors flagged "simulate before signing" Known-good routers (Uniswap/Permit2/1inch/Seaport) reduce false positives.

Endpoints

Live (2026-10-24)

Running in production, paid mode on: https://x402-presign-guard.vercel.app

curl https://x402-presign-guard.vercel.app/.well-known/x402            # discovery (free)
curl "https://x402-presign-guard.vercel.app/guard/tx?to=0x..."         # 402 + payment requirements

A 402 returns the x402 v1 payment requirements (scheme exact, network base, USDC); an x402-capable client pays and retries. Implemented + tested: 25/25 PASS (decode 19 + app 6), tsc clean. Runs on both Cloudflare Workers and Vercel from one codebase.

Use it as an MCP server

Point any MCP client (Claude Desktop, agent frameworks) at the hosted guard — no install build, no npm account needed:

{
  "mcpServers": {
    "presign-guard": {
      "command": "npx",
      "args": ["-y", "x402-presign-guard"]
    }
  }
}

Published on npm: x402-presign-guard (or run straight from source: npx -y github:kaito3636/x402-presign-guard). Exposes two tools — presign_guard_tx and presign_guard_approval — that forward to the hosted guard (GUARD_URL, default the live URL above). The agent calls the guard before it signs.

The compounding engine (v2, wired but off)

wrangler.toml has a commented cron + KV: a scheduled job ingests malicious selectors/addresses from live threat feeds + own honeypot probes, timestamped — so the signature set and the never-backfillable time-series grow every day. That daily accrual is the "掘るほど美味い" asset.

Deploy your own

Vercel (how the live one runs):

npm install
npx vercel deploy --prod                       # free mode first
npx vercel env add PAY_TO production            # Base self-custody wallet 0x… → go paid
npx vercel deploy --prod

Cloudflare Workers (alternative; same code):

npx wrangler login && npx wrangler deploy
npx wrangler secret put PAY_TO && npx wrangler deploy

Distribution (the real lever)

MCP server (this repo, npx github:…) → Official MCP Registry / mcp.so; x402 Bazaar discovery needs a facilitator that implements /discovery/resources (e.g. Coinbase CDP — set FACILITATOR_URL + CDP keys); list on x402scan. The hosted endpoint already serves /.well-known/x402 for crawlers.