IntentFence Agent Action Firewall

Measured conclusion: Deep-tested. L2 outcome: tools_ok.

Fail-closed action authorization, MCP risk scanning, x402 checks, and signed receipts.

Add to your agent

Copy this into your MCP client config:

{
  "mcpServers": {
    "IntentFence Agent Action Firewall": {
      "url": "https://agentpass-protocol.rmalka06.chatgpt.site/api/mcp",
      "transport": "streamable-http"
    }
  }
}

Measured tools (10)

• intentfence_authorize_action read-only

  Authorize an exact agent action against an explicit allowlist, spend ceiling, retention ceiling, and optional action-bound approval. Returns a five-minute ES256 receipt and never executes the downstream action. Callers must verify the receipt and fail closed if the action changes.

  Parameters:

  • subject (required) — string
  • action (required) — object
  • policy (required) — object
  • context — object
  • approval — object

  Hints: read-only yes · destructive no · idempotent no · open-world no

• intentfence_agent_risk_scan read-only

  Free metadata-only scan of caller-supplied MCP tool definitions for missing schemas, unsafe annotations, approval binding, and cost boundaries. Does not execute tools or certify security.

  Parameters:

  • server_name (required) — string
  • tools (required) — array

  Hints: read-only yes · destructive no · idempotent no · open-world no

• intentfence_checkout read-only

  Free machine checkout builder. Select a paid IntentFence outcome and receive the exact endpoint, validated request, USDC cap, shell-safe Agentic Wallet argv, MCP tool call, and opt-in local auto-payment budget. It never signs or initiates payment.

  Parameters:

  • product (required) — string — The paid outcome the agent wants to buy.
  • input — object — The exact product input. Omit only to receive a non-executable example recipe.

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• intentfence_preflight read-only

  Free declared-input preview with no signed receipt, authorization proof, or enforcement guarantee. Returns safe_to_proceed, needs_review, or denied.

  Parameters:

  • subject (required) — string — Agent or principal identifier.
  • action (required) — object
  • proofs — array
  • constraints — object

  Hints: read-only yes · destructive no · idempotent yes · open-world no

• intentfence_policy_pack read-only

  Paid self-service integration pack (1 USDC on Base). Generates a runtime-specific TypeScript guard, signed action and policy receipt, negative test vectors, and a fail-closed deployment checklist for Cloudflare Agents, Coinbase AgentKit, or an MCP gateway. No meeting or account is required.

  Parameters:

  • project_name (required) — string — A public-safe project label. Do not include credentials or secrets.
  • runtime (required) — string
  • authorization (required) — object

  Hints: read-only yes · destructive no · idempotent no · open-world yes

• intentfence_verified_preflight read-only

  Paid production preflight ($0.005 USDC on Base). Settles through x402 and returns a signed ES256 audit receipt plus settlement metadata.

  Parameters:

  • subject (required) — string — Agent or principal identifier.
  • action (required) — object
  • proofs — array
  • constraints — object

  Hints: read-only yes · destructive no · idempotent no · open-world yes

• intentfence_x402_assessment read-only

  Paid assessment ($0.005 USDC on Base). Forward the exact base64 or base64url PAYMENT-REQUIRED header observed by the caller. IntentFence validates the quote, canonical Base USDC asset, price ceiling, payee allowlist, timeout, and resource binding without contacting the target, then returns a short-lived ES256 receipt bound to the quote hash. Supply allowed_payees for safe_to_proceed; omission yields needs_review.

  Parameters:

  • subject (required) — string — Agent or principal identifier.
  • target_url (required) — string — Exact public HTTPS resource URL from the caller-observed x402 challenge.
  • payment_required (required) — string — Exact base64 or base64url PAYMENT-REQUIRED header value observed by the caller.
  • policy (required) — object
  • method — string

  Hints: read-only yes · destructive no · idempotent no · open-world yes

• intentfence_x402_readiness read-only

  Paid live endpoint check ($0.002 USDC on Base). Makes one bounded credential-free request to a public HTTPS target, blocks private networks and redirects, never pays the target, validates the returned x402 challenge, and returns a signed five-minute receipt.

  Parameters:

  • target_url (required) — string — Public HTTPS x402 resource URL on the standard HTTPS port.
  • body — Optional JSON request body for POST probes, limited to 4096 encoded bytes.
  • method — string
  • policy — object — Legacy nested policy input. New buyers should use the optional top-level fields.
  • subject — string — Optional buyer identifier. Omit for anonymous marketplace delivery.
  • allowed_payees — array — Optional explicit payee allowlist. Omission yields ready_with_review for an otherwise valid quote.
  • max_price_usdc — string — Optional maximum acceptable x402 price in USDC.

  Hints: read-only yes · destructive no · idempotent no · open-world yes

• intentfence_wallet_risk read-only

  Paid AML/KYT wallet screening ($0.002 USDC on Base) before sending funds or approving a transaction. Checks live Base activity plus GoPlus sanctions, phishing, mixer, money-laundering, dark-web, blacklist, and related counterparty-risk flags, then returns a five-minute ES256 receipt. A low-risk result is not proof of identity, ownership, authorization, or future behavior.

  Parameters:

  • address (required) — string — Base recipient or counterparty address to assess before payment.

  Hints: read-only yes · destructive no · idempotent no · open-world yes

• intentfence_us_cpi read-only

  Paid official U.S. CPI and core CPI data ($0.001 USDC on Base), retrieved from the Bureau of Labor Statistics with a six-hour edge cache and returned with an ES256 provenance receipt. Optionally request a YYYY-MM period.

  Parameters:

  • month — string — Optional CPI month in YYYY-MM. Omit for the latest complete headline/core period.

  Hints: read-only yes · destructive no · idempotent no · open-world yes

Repository

Measured by MCPYP probing. Untested fields are omitted, never estimated. Listing is always free; MCPYP never proxies calls or stores user tokens.