Metadata-Version: 2.4
Name: agentkit-tollwarden
Version: 0.1.0
Summary: TollWarden payment security for Coinbase AgentKit: a scan-before-you-pay action provider for x402 payments, with prompt-injection provenance and signed verdicts. Non-custodial.
Project-URL: Homepage, https://tollwarden.com
Project-URL: Repository, https://github.com/tollwarden/tollwarden
Project-URL: Documentation, https://github.com/tollwarden/tollwarden/tree/main/integrations/agentkit-tollwarden
Author-email: TollWarden <contact@tollwarden.com>
License: MIT
Keywords: agentkit,ai-agents,base,coinbase,payments,prompt-injection,security,usdc,x402
Classifier: Development Status :: 4 - Beta
Classifier: Intended Audience :: Developers
Classifier: License :: OSI Approved :: MIT License
Classifier: Programming Language :: Python :: 3
Classifier: Topic :: Security
Requires-Python: >=3.10
Requires-Dist: coinbase-agentkit>=0.1
Requires-Dist: tollwarden>=0.3.0
Description-Content-Type: text/markdown

# agentkit-tollwarden

[TollWarden](https://tollwarden.com) payment security for [Coinbase AgentKit](https://github.com/coinbase/agentkit) — a scan-before-you-pay action provider for x402 payments.

```bash
pip install agentkit-tollwarden
```

## Add the action provider

```python
from coinbase_agentkit import AgentKit, AgentKitConfig
from agentkit_tollwarden import tollwarden_action_provider

agent_kit = AgentKit(AgentKitConfig(
    wallet_provider=wallet_provider,
    action_providers=[
        tollwarden_action_provider(agent_id="my-agent"),   # free key auto-minted
        # ... your other providers
    ],
))
```

The agent gets three actions — `tollwarden_scan_payment`, `tollwarden_check_reputation`, `tollwarden_report_counterparty` — each described so the model calls them at the right moment. Verdicts come back **allow / flag / block** with machine-readable reasons: prompt-injection-triggered payments, replayed nonces, overpayment vs the quote, secrets/PII leaking in payment metadata, lookalike-token contracts, address poisoning, counterparty reputation.

## Two AgentKit-native touches

**Wallet payer auto-fill.** `tollwarden_scan_payment` receives AgentKit's `wallet_provider`, so when you don't supply a `payer` it fills in the agent's own wallet address — scoping TollWarden's velocity and first-contact limits to *this* agent automatically. Supply `payer` explicitly to override.

**Provenance for injection detection.** TollWarden's strongest check catches payments whose *decision* came from content the agent just read. Pass that text as the scan action's optional **`content`** argument; if the `pay_to` address appears in it, the payment is blocked.

## Non-custodial by design

TollWarden only reads payment *metadata* to produce a verdict — it never signs, holds, or routes funds, and the action provider never touches the AgentKit wallet's keys. The settle/refuse decision stays with your agent. Verdicts are Ed25519-signed and payment-bound; for wallet-level enforcement (the signer itself refuses unscanned payments), see `TollWardenEnforcer` in the [tollwarden SDK](https://pypi.org/project/tollwarden/).

MIT.
