If the AI is fooled, the contract still says no.

How it works

1. The money sits in a vault nobody can drain

   A factory creates each vault from immutable code, with no full-access key. No person or program holds a key that can sign a transfer out of it.

2. The agent can only ask

   The agent gets a key that can call one method: request_payment. It can ask to pay. It can't pay.

3. The contract decides, every time

   Per-payment and daily caps, an allowlist, a hold on repeated payments (the "it failed, please retry" trick), and a lookup in a shared scam registry. If the registry doesn't answer, the payment is blocked.

4. Lock it for good

   lock_rules() is one-way. After it, nobody, owner included, can loosen the rules or withdraw. Pausing and denying still work.

One attacker, three answers. All on-chain.

An agent asked vault demo2 to pay the same account three times. In between, two different accounts reported it to the shared registry. The agent didn't change. The vault's answer did.

1. Paid

   0.1 NEAR to agentguard-evil.testnet. Allowlisted, no reports yet.

   tx EhtM…
2. Held

   0.11 NEAR, after one report: recipient_reported. Waits for the owner.

   tx 28dd…
3. Blocked

   0.12 NEAR, after a second reporter: recipient_flagged. Blocked in every vault that uses the registry.

   tx AdDc…

The platform

Five parts, all live on NEAR testnet, all open source.

• Vault

  The firewall. Every payment comes out paid, held or blocked, with a reason, recorded on-chain.

  Rules and code

• Factory

  Creates vaults with no full-access key, on immutable code. If creation fails, you get your money back.

  Code

• Scam registry

  A shared blocklist. Anyone reports with evidence. Two reporters or a curator flag an account, for every vault at once.

  Code

• Console

  The owner's web app: create a vault with a NEAR wallet, set limits, approve or deny held payments, lock the rules.

  Open the Console

• MCP server

  Lets Claude, Codex or any MCP agent pay through a vault, check an address first, and see its own limits.

  Setup

Built on AgentGuard

Live

Sentinel

An AI agent with money of its own, on a locked AgentGuard vault. It sells "is this address safe to pay?" checks to other agents over HTTP 402, pays for its own thinking every 10 minutes, and verifies that its model runs in a TEE. Anyone can try to talk it into paying them.

In its vault

…

Paid out, all to its compute

…

Refused by the vault

…

Launch Sentinel

+

Your turn

Your agent

Create a vault with a NEAR wallet in about two minutes, set its limits, and give your agent a key that can only ask. The key is made in your browser; only its public half goes on-chain.

Open the Console From the command line

Give your agent a wallet it can't empty

Add the MCP server to Claude Code, point it at a vault, and ask it to pay. The vault decides.

claude mcp add agentguard -e AGENTGUARD_VAULT=your-vault.agentguard.testnet \
  -- node /path/to/AgentGuard/packages/mcp/dist/index.js

Seven tools: pay, check an address, balance, policy, payment status, history, and buying Sentinel's paid check. Full README.