Policy engine
You set how much per payment, how much per day, and exactly who can be paid. A new agent cannot spend a cent until you allow it.
Let agents pay.
Never let them drain you.
AgentGuard sits between your AI agents and your money. Every payment must pass the rules you set, then a test run of the real transaction. Small payments go through, bigger ones wait for your approval on Telegram, and anything suspicious is refused. Your funds stay locked in your own vault. The agent only ever touches a small allowance you set.
Solana + Base
USDC
x402 (pay-per-use APIs) · MCP (agent plug-in) · Telegram
2blockchains: Solana first, Base next
530automated tests run on every change
24attack scenarios blocked in testing
20named reasons a payment is refused
0new smart contracts for you to trust
Figures from the codebase, SPEC v0.3, November 2026.
Built on proven, independently audited tools already live onchain
Squads v4 vault wallet
Safe vault wallet
Safe Allowance Module spend limit
x402 pay-per-use payments
Model Context Protocol how agents connect
USDC digital dollar
Telegram approvals
How it works
Every payment takes the same four steps. No exceptions.
The agent never holds a key. It asks AgentGuard to pay, and AgentGuard decides. The agent also sends text, like its reason and the URL. You see that text, but AgentGuard never uses it to decide.
Step 1
Request
Your agent asks AgentGuard to pay. It holds no keys and no money. Asking is all it can do.
- paid_fetch
- transfer
Step 2
Policy
AgentGuard checks the payment against the limits you set for this agent. Any doubt means no.
- per-payment and daily limits
- networks and tokens you allow
- recipients and websites you allow
Step 3
Test run
Before any money moves, AgentGuard rehearses the exact payment to see what it would really do, not what the agent says it does.
- exact balance changes
- hidden permissions
- programs you never approved
Step 4
Decide
Each payment ends one of three ways. Every outcome is written to the audit log with its reasons.
Under your threshold approved
At or above it asks you
Breaks your rules rejected
Where the money lives
Funds stay in your vault. The agent spends from a small, capped wallet.
Your vault (multisig)
Holds your funds. A wallet only you control: Squads v4 on Solana, Safe on Base.
spend limit · your daily cap per 24h
Built-in spend limit
Tops up the spending wallet, never above your cap. The blockchain itself enforces this, not our code.
refill
Guard spending wallet
Pocket money only (the "hot wallet"). Its key never leaves AgentGuard. It is never shown to the agent and never written to logs.
pays after policy + simulation
Pay-per-use APIs and transfers
Only websites and recipients you approved in advance.
Worst case, in writing
Max loss per day = daily cap + hot wallet balance.
This holds even if AgentGuard's own software has a bug or is hacked: the blockchain itself enforces the cap, with independently audited code. Move the sliders to see your own ceiling.
Most you can lose in 24 hours
$140
0.28% of your vault. The other $49,860 cannot be reached by the agent.
Security model
Layers of protection. Everything starts blocked.
Two layers that do not trust each other. The blockchain caps how much can ever be lost. The guard decides what gets paid at all.
Test run before signing
Every payment gets a rehearsal before it is signed. If it would do anything beyond what you approved, even one hidden side effect, it never runs.
Telegram approvals
Payments at or above your threshold go to your phone with a plain summary of what they will do. No answer in 10 minutes means no payment.
One-tap kill switch
Send /kill and every agent is paused at once. AgentGuard also drafts
the transaction that cuts each chain's spending limit to zero. You sign it and the
money is shut off.
Onchain daily cap
The daily refill uses the built-in limits of Squads and Safe, widely used vault wallets that are independently audited. We add no code of our own to that layer.
Full audit log
Every decision is recorded with its exact reason, so you can always see what your agent tried and why it was stopped. Amounts are exact to a millionth of a dollar and never rounded.
Human in the loop
Big payments wait for your thumb.
Set an approval threshold. Anything above it lands in Telegram with what the payment will actually do, so you approve the effect, not the agent's story.
- One yes, one payment. Your approval covers exactly this amount, this recipient, this one time. It cannot be reused or stretched.
- Forged messages get nowhere. Everything the guard sends the bot is cryptographically signed; old or duplicated messages are refused.
- Attack alerts. If an agent tries something shady, like a hidden permission grab, your phone pings right away with a suggestion to pause it.
- Fail safe. If the bot restarts, pending approvals expire. Nothing is paid by default.
AgentGuardbot
Approval needed · agent-1
Pay 18.00 USDC
Kindx402
Domainapi.datafeed.example
ChainSolana devnet
Effectspending wallet −18.00 USDC
Agent says: "Premium market data for the weekly report." Unverified.
Expires in 9:42
What gets blocked
Twenty ways to say no.
Each refusal carries a reject code, so you, your agent and the audit log all know exactly why.
For developers
Connect your agent. Coming soon.
An agent connector and a plain HTTP API are on the way: a few simple tools that let any AI agent pay through AgentGuard while you keep full control. The code and the docs go public when they are ready.
Developer tools · coming soon
Chains
Solana first. Base right behind.
The same protection everywhere: the same limits, the same test run before signing, and the same kill switch, whether your agent pays on Solana or Base.
Solana
Ships first- Vault wallet
- Squads v4
- Spend limit
- Squads Spending Limit, resets every 24 h
- Payments
- x402 pay-per-use, in USDC
- Test network
- Solana devnet
- Network ID
- solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp
Base
Ships second- Vault wallet
- Safe
- Spend limit
- Safe Allowance Module, resets every 24 h
- Payments
- x402 pay-per-use, in USDC
- Test network
- Base Sepolia
- Network ID
- eip155:8453
Roadmap
Where we are, plainly.
Done
Core stack
- Policy engine and HTTP API
- MCP server, four tools
- Telegram approvals and kill
- 530 tests, 24 attack cases
Done
Onchain cap on devnet
- Spending inside the cap works
- One unit over the cap: refused by the chain itself
- After the kill switch, nothing can be drawn
In progress
Full stack on devnet
- Real signing end to end
- Hardware wallet kill
- Agent token revocation
- Second security review
Next
Mainnet beta
- Solana mainnet-beta
- Base mainnet
- Bug bounty
FAQ
Questions builders ask.
Can my agent ever touch the funds in my multisig?
No. The agent never holds a key. AgentGuard holds the key of a small spending wallet, and your vault refills that wallet through a blockchain-enforced limit that can never exceed your daily cap.
What if AgentGuard itself is compromised?
The cap still holds, because the blockchain enforces it, not our software. The most
anyone can take in a day is your daily cap plus whatever sits in the spending
wallet. Press /kill and sign the prepared transaction to shut it off
entirely.
Do you deploy your own smart contracts?
No. AgentGuard uses Squads v4 on Solana and Safe on Base, widely used vault wallets that are independently audited and already live. There is no new contract for you to trust.
What is x402?
An open standard that lets a website or API charge a small fee per request, paid automatically. When an API asks for payment, AgentGuard reads the terms, checks your rules, runs the test run, pays only if everything passes, and hands the result to your agent.
Which tokens are supported?
USDC only in v0.1, a digital dollar. Every amount is handled as an exact whole count of the token's smallest unit, like counting in cents. A value that would need rounding is refused, never rounded.
Does the agent's explanation affect the decision?
Never. The reason an agent gives is shown to you in Telegram and marked as unverified. Decisions use only your policy and the simulated effect of the transaction.
Get started
Give your agents a budget, not your keys.
Launching soon. We build in the open and go live only when every item on the security checklist is done.
See how it works
GitHub · coming soon