X402 Trust Layer
About
x402 Trust Layer is the trust, security & settlement control plane for autonomous agent payments. It exposes 13 MCP tools that an agent calls around every x402 (HTTP 402) payment:
Details
- Author
- mimranchohan
- Downloads
- 475
- Categories
- Other
Jump to
- Guard preflight spend and risk checks before payment.
- Attestation issues agent credentials and liability insurance.
- Performance caching delivers sub-15 ms on-chain reads.
- Compliance ledgers, disputes, and refund auditing.
- Settlement rail optimization and metered escrow sessions.
- Wallet Sessions skip per-call settlement via HMAC tokens.
Setting up with Highlight
This MCP is not yet compatible with Highlight’s one-click setup. However, you can still use it with Highlight by following these steps:
- Download and install Highlight from highlightai.com/download
- Navigate to the plugins tab and select "Add Custom Plugin"
-
Configure the plugin with the settings below
Plugin Name
X402 Trust LayerCommand (node, npx, python, etc.)Please refer to the README for specific instructions on how to obtain API keys or other required environment variables.
- Enable "Start Automatically" if you want the plugin to start when Highlight launches
From the repository
Install the npm package x402-trust-layer, configure environment variables (e.g., WEBHOOK_SECRET, AGENT_RATE_LIMIT_PER_MIN, TRUSTSCORE_RPC_TIMEOUT_MS, PRE_X402_GUARD_TIMEOUT_MS), and call the endpoints at https://x402trustlayer.xyz. Wallet Sessions require a $0.10 USDC payment once for a session token.
trust_before_x402_fetch
Full pre-pay flow: pipeline/trust-v2 (mandate diff + KYM + guard + buyer gate) — use before x402_fetch ($0.35)
trust_agent_verify
ERC-8004 TrustScore on Base mainnet ($0.04)
trust_preflight_proxy
All-in-one preflight before external x402 payment ($0.08)
trust_mandate_diff
Mandate vs MCP tool trace before payment ($0.04)
trust_merchant_score
KYM score with x402watch auto-ingest ($0.06)
trust_buyer_gate
Certified seller buyer gate — attestation + tier ($0.03)
trust_semantic_settle
Post-pay semantic escrow — release or auto-refund ($0.12)
trust_receipt_verify
Verify x402 settlement receipt on-chain ($0.05)
trust_protocol_full_pipeline
Agent Trust Protocol v4 — passport, trust v2, fraud, oracle, credit, compliance, guard, replay bind ($0.45)
trust_protocol_trust_score_v2
Multi-factor TrustScore v2 with cryptographic proof ($0.08)
trust_protocol_fraud_scan
Graph fraud scan — Sybil, wash trading, circular payments ($0.10)
trust_protocol_execution_receipt
Proof of Execution receipt after paid API call ($0.05)
trust_protocol_credit_score
AI Agent Credit Bureau score 300-900 ($0.06)
Claude Desktop / Cursor
Paste into your MCP client config file to install this server.
{
"mcpServers": {
"x402 trust layer": {
"trust-layer": {
"command": "npx",
"args": [
"-y",
"@mimranakb/trust-layer-mcp"
],
"env": {
"EVM_PRIVATE_KEY": "0x..."
}
}
}
}
}McpServers
{
"trust-layer": {
"command": "npx",
"args": [
"-y",
"@mimranakb/trust-layer-mcp"
],
"env": {
"EVM_PRIVATE_KEY": "0x..."
}
}
}<p align="center">
</p>
<h1 align="center">x402 Trust Layer</h1>
<p align="center"><strong>The trust, security, and caching layer for agent payments.</strong><br/>
<code>x402trustlayer.xyz</code> · Guard · Attest · Comply · Audit</p>
<p align="center">
<a href="https://x402trustlayer.xyz">
<a href="https://x402gle.com/servers/x402trustlayer.xyz">
<a href="https://dexter.cash/sellers/9c7tE587KpGYBjiNQrjw3nGvxQHhSYKU4Ba6WRgQsHkt">
<a href="https://www.npmjs.com/package/x402-trust-layer">
<a href="https://github.com/mimranchohan/x402-trust-layer">
</p>
---
> x402 Trust Layer (x402 Agent Suite Pro) — 59 paid x402 APIs (67 total endpoints) for guard,
> attestation, caching, compliance, settlement, Wallet Sessions, and Agent Trust Protocol v4. Live at https://x402trustlayer.xyz
A control plane for autonomous agent commerce. Fifty-seven paid x402 APIs that an
AI agent calls before, during, and after it spends money — to decide whether a
merchant is trustworthy, whether a payment is allowed, which rail is cheapest, and
whether the response it paid for was actually worth it. Everything settles in USDC
over the Dexter facilitator, on Base or Solana, for a
few cents a call.
Live: https://x402trustlayer.xyz
The Five Layers of Trust
| Layer | Does | Key Endpoints |
|-------|------|---------------|
| 01. Guard | Preflight spend, payload sandboxing, and risk checks before any payment | /api/guard/pre-x402 · /api/guard/payload-sandbox · /api/x402/proxy |
| 02. Attestation | Issues, verifies, and indexes agent credentials, liability insurance, and mandates | /api/attestation/ · /api/mandate/ · /api/trust-network/insurance/attest |
| 03. Performance | Low-latency in-memory TTL cache for on-chain identity & reputation reads (sub-15 ms cached lookups; configurable TTL) | /api/agent/verify (uses memory registry TTL cache) |
| 04. Compliance | Ledgers, evidence bundles, dispute resolution, refund auditing | /api/compliance/ledger · /api/dispute/resolve · /api/refund-arbiter/evaluate |
| 05. Settlement Ops | Rail optimization, metered sessions, escrows, receipt auditing | /api/rail-optimizer/route · /api/escrow/metered/* · /api/receipt-auditor/verify |
---
What's New (v5.5.0)
- x402 V2 Header Compatibility — Full CAIP-2 chain ID support (eip155:8453, eip155:137, solana:5eykt4...). The accepts array now carries structured multi-stablecoin objects per the x402 V2 spec — compatible with Stripe x402 (Feb 2026), AWS Bedrock AgentCore Payments, and Travala's MCP integration.
- Wallet Sessions — Pay $0.10 USDC once → receive an HMAC-signed session token → attach x-session-token header on subsequent calls to skip per-call settlement. Sessions expire after 24 h (configurable), support max_calls caps, and persist in SQLite (wallet_sessions table). Four new endpoints: POST /api/session/create, GET /api/session/verify, DELETE /api/session/revoke, GET /api/session/info.
- ERC-8004 Mainnet Live Registry — Agent identity and reputation registries on Base mainnet (0x8004A169… and 0x8004BAa1…). Joins the 16,500+ verified agents already on-chain since the ERC-8004 ratification (Jan 29, 2026). Responses cached with 120 s TTL for sub-15 ms lookup.
- A2A v1.2 Signed Agent Cards — GET /.well-known/agent.json now returns an A2A protocol v1.2 agent card signed with x-agent-card-signature (HMAC-SHA256). Advertises wallet sessions, ERC-8004 registry, multi-stablecoin accepts, and all 59 paid capabilities. Compatible with Azure AI Foundry, Amazon Bedrock, and Google Cloud A2A native integrations.
- Multi-Stablecoin Fallback — Full EURC (MiCA/EU compliance), PYUSD (Stripe regulated), and USDT (tertiary) support on Base and Polygon, alongside primary USDC. The availableStablecoins(chain) helper and /api/session/create accept any of the four coins.
- x402 Discovery Endpoint — GET /.well-known/x402.json returns a fully-structured x402 V2 discovery manifest: CAIP-2 chain IDs, multi-stablecoin accepts array, wallet session terms, ERC-8004 registry links, and endpoint catalog.
---
What's New (v5.4.0)
- Trust Score Webhooks — POST /api/webhooks/trust registers a callback URL; GET /api/webhooks/list lists all hooks; DELETE /api/webhooks/trust/:id removes one. When any agent's ERC-8004 trust score changes, all matching webhooks receive a signed JSON payload with walletAddress, tier, trustScore, and previousTier. Stored in SQLite (trust_webhooks table). Configurable via WEBHOOK_SECRET env var for HMAC-SHA256 signing.
- Multi-chain Trust Aggregation — POST /api/agent/multichain-trust accepts a walletAddress and optional chains array (base, ethereum, polygon, arbitrum, optimism). Queries ERC-8004 trust scores across all requested chains in parallel and returns an aggregated result with per-chain breakdown, highest tier, weighted composite score, and chain-specific metadata.
- Agent Reputation History — GET /api/agent/:walletAddress/history returns a paginated ledger of all trust score snapshots for a given wallet, keyed by timestamp. Supports ?limit= and ?offset= query params. Each entry includes tier, trustScore, chainId, and resolutionSource.
- Admin Dashboard — GET /api/dashboard/summary returns a JSON snapshot of system health: total agents verified, spend today (USDC), blocked wallets count, active webhooks, and top-5 wallets by spend. Static HTML admin panel served at GET /admin with live-refreshing stats cards.
- Wallet Blocklist — POST /api/admin/blocklist adds a wallet address to the blocklist (body: { address, reason?, blockedBy? }); DELETE /api/admin/blocklist/:address removes it; GET /api/admin/blocklist lists all entries with pagination. The walletBlocklistMiddleware() Express middleware auto-rejects any request carrying a blocked walletAddress (header, body, or query) with HTTP 403. Persisted in SQLite (wallet_blocklist table).
- Expanded Test Suite (104 tests) — Unit tests for all five new subsystems added: pre-x402-guard, spend-governor, identity-gate, risk-gate, payload-sandbox, wallet-blocklist, webhooks, trust-score, ssrf, replay-guard, semantic-judge, and alchemy-policy. All pass with zero unhandled rejections.
---
What's New (v5.3.0)
…
Sign in to leave a review
Use Google, GitHub, or an email account so ratings stay tied to real people.
No reviews posted yet.
