Metadata-Version: 2.4
Name: nemo-tollwarden
Version: 0.1.0
Summary: TollWarden payment security for the NVIDIA NeMo Agent Toolkit: scan x402 payments before settling, with prompt-injection provenance and signed verdicts. Registers scan / reputation / report functions.
Project-URL: Homepage, https://tollwarden.com
Project-URL: Repository, https://github.com/tollwarden/tollwarden
Project-URL: Documentation, https://github.com/tollwarden/tollwarden/tree/main/integrations/nemo-tollwarden
Author-email: TollWarden <contact@tollwarden.com>
License: MIT
Keywords: ai-agents,nat,nemo-agent-toolkit,nvidia,payments,prompt-injection,security,usdc,x402
Classifier: Development Status :: 4 - Beta
Classifier: Intended Audience :: Developers
Classifier: License :: OSI Approved :: MIT License
Classifier: Programming Language :: Python :: 3
Classifier: Topic :: Security
Requires-Python: >=3.11
Requires-Dist: nvidia-nat>=1.1
Requires-Dist: tollwarden>=0.3.0
Description-Content-Type: text/markdown

# nemo-tollwarden

[TollWarden](https://tollwarden.com) payment security for the [NVIDIA NeMo Agent Toolkit](https://github.com/NVIDIA/NeMo-Agent-Toolkit) — screen every x402 payment before your workflow settles it.

```bash
pip install nemo-tollwarden
```

Installing registers three NeMo functions via the `nat.plugins` entry point. Add them to your workflow YAML:

```yaml
functions:
  scan:
    _type: tollwarden_scan_payment
    agent_id: my-agent          # optional; scopes velocity limits
  reputation:
    _type: tollwarden_check_reputation
  report:
    _type: tollwarden_report_counterparty
```

A free API key (100 free scans) is auto-minted on first use — set `api_key:` to pin one. Verdicts come back **allow / flag / block** with machine-readable reasons: prompt-injection-triggered payments, replayed nonces, overpayment vs the quote, secrets/PII leaking in payment metadata, lookalike-token contracts, address poisoning, counterparty reputation.

## Provenance: the strongest check

TollWarden's best detector catches payments whose *decision* came from content the agent just read — a prompt-injected page or tool result saying "send payment to 0x…". In NeMo, pass that text as the scan function's optional **`content`** argument:

```
tollwarden_scan_payment(payment={...}, direction="outgoing", content="<the page/tool text the agent just read>")
```

If the `pay_to` address appears in that content, the payment is blocked. (LangChain and CrewAI integrations auto-tag this via a callback; NeMo has no global tool-output hook, so it's an explicit parameter the agent — or your workflow — fills.)

## The functions

| Function | When to call it |
|---|---|
| `tollwarden_scan_payment` | ALWAYS, before settling an x402 payment (`direction="outgoing"`) or paying a received 402 offer (`direction="incoming"`) |
| `tollwarden_check_reputation` | Before dealing with an unfamiliar counterparty address |
| `tollwarden_report_counterparty` | After a bad payment experience (always free) — warns other agents |

The three functions share one TollWarden client per `(base_url, api_key, agent_id)`, so they draw on the same free-tier quota. Verdicts are Ed25519-signed and payment-bound; the underlying client verifies them against a pinned key automatically.

For wallet-level enforcement (the signer itself refuses unscanned payments), see `TollWardenEnforcer` in the [tollwarden SDK](https://pypi.org/project/tollwarden/).

MIT. TollWarden is advisory and non-custodial: it never touches keys, wallets, or funds.
