AgentGuard
A spending firewall for AI agents, on NEAR
An AI agent that can pay is one prompt injection away from paying a scammer. AgentGuard takes its spending rules out of the prompt and puts them in a NEAR contract the agent can't get around, and that even its owner can lock for good.
Sentinel is an AI with real (testnet) money on an AgentGuard vault. Try to talk it into paying you. Or don't trust any of this, and verify it.
Read live from NEAR testnet by your browser.
A factory creates each vault from immutable code, with no full-access key. No person or program holds a key that can sign a transfer out of it.
The agent gets a key that can call one method: request_payment. It can ask to pay. It can't pay.
Per-payment and daily caps, an allowlist, a hold on repeated payments (the "it failed, please retry" trick), and a lookup in a shared scam registry. If the registry doesn't answer, the payment is blocked.
lock_rules() is one-way. After it, nobody, owner included, can loosen the rules or withdraw. Pausing and denying still work.
An agent asked vault demo2 to pay the same account three times. In between, two different accounts reported it to the shared registry. The agent didn't change. The vault's answer did.
Five parts, all live on NEAR testnet, all open source.
The firewall. Every payment comes out paid, held or blocked, with a reason, recorded on-chain.
Rules and codeCreates vaults with no full-access key, on immutable code. If creation fails, you get your money back.
CodeA shared blocklist. Anyone reports with evidence. Two reporters or a curator flag an account, for every vault at once.
CodeThe owner's web app: create a vault with a NEAR wallet, set limits, approve or deny held payments, lock the rules.
Open the ConsoleLets Claude, Codex or any MCP agent pay through a vault, check an address first, and see its own limits.
Setup
Live
An AI agent with money of its own, on a locked AgentGuard vault. It sells "is this address safe to pay?" checks to other agents over HTTP 402 and on NEAR Agent Market, pays for its own thinking every 10 minutes, and verifies that its model runs in a TEE. Anyone can try to talk it into paying them.
Launch Sentinel
Your turn
Create a vault with a NEAR wallet in about two minutes, set its limits, and give your agent a key that can only ask. The key is made in your browser; only its public half goes on-chain.
Every claim above can be checked on the chain. Press the button and your browser asks NEAR testnet directly (public RPC nodes: rpc.testnet.fastnear.com, and NEAR archival nodes for older transactions), not our server. Each line shows what the chain said.
From a terminal, the same checks and more (every transaction in TESTNET-RESULTS, all 240 stress results): node scripts/verify-evidence.mjs
Who needs this, what one sale earns, and what it costs to stay open. The numbers load live from Sentinel.
$47,000
In November 2024 an AI agent called Freysa was told one rule in its prompt: never send money. After 482 tries, someone convinced it that sending money meant receiving it, and it paid out its whole prize of 13.19 ETH.
A rule in a prompt can be talked away. AgentGuard puts the rule in a contract.
Source: The Decoder, Nov 2024138 million
Agent payments over x402 on Base in one quarter (Q3 2026), and more than 87% of them under $0.10.
That's far too many, too small payments for a person to approve each one. The rules have to run by themselves.
Source: Chainalysis, via PaymentsJournalIt only reads the public chain. No AI, no transaction.
A rent Sentinel pays from its own vault every 10 minutes, for its server and its AI.
checks a day
Honest note: so far every sale was our own test. We show the numbers anyway. Sentinel's vault is locked by its own rules, so even we can't take money out of it; Agent Market jobs are paid in USDC to the marketplace balance. Source: Sentinel's status (its payments are on NearBlocks).
Read by your browser from the factory contract on NEAR testnet (agentguard.testnet, get_vaults). Team accounts not counted: agentguard.testnet, agentguard-user.testnet, zaxtest.testnet. Be the first: give your agent a vault in about 2 minutes.
…
Each payment checked once at 0.01 NEAR, against today's fixed cost. A what-if, not a forecast. NEAR at $3.48 (Nov 7, 2026).
This is the plan, not live yet. Mainnet coming soon.
Add the MCP server to Claude Code, point it at a vault, and ask it to pay. The vault decides.
claude mcp add agentguard -e AGENTGUARD_VAULT=your-vault.agentguard.testnet \
-- npx -y @zaxcoraider/agentguard-mcpSeven tools: pay, check an address, balance, policy, payment status, history, and buying Sentinel's paid check. On npm · Setup.