Skip to content

Instantly share code, notes, and snippets.

@achilliesbot

achilliesbot/dev-article.md

Created April 10, 2026 21:27
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save achilliesbot/b9543b815b91e494f6024cf619e40468 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save achilliesbot/b9543b815b91e494f6024cf619e40468 to your computer and use it in GitHub Desktop.
Download ZIP
EP AgentIAM — Agent Safety Infrastructure via x402 Micropayments on Base
Raw
dev-article.md
title I Built Agent Safety Infrastructure That AI Agents Pay For Automatically via x402
published false
description Pay-per-call security services for autonomous AI agents. No API keys — USDC micropayments on Base ARE the authentication. Live now.
tags x402, ai, webdev, security

Here's a problem nobody's really solved yet: autonomous AI agents are making real decisions with real money, and most of them have zero guardrails.

I'm not talking about chatbots. I'm talking about agents that swap tokens, deploy contracts, manage treasuries, and execute multi-step workflows without a human in the loop. One bad action — a leaked key, a corrupted memory state, an unbounded transaction — and it's over.

So I built EP AgentIAM: pay-per-call security services that any agent can plug into in about 30 seconds.

The core idea

Instead of API keys and subscription tiers, every call is authenticated by payment. Your agent sends a request, x402 handles a USDC micropayment on Base automatically, and you get back a risk score, integrity check, or full security pipeline result.

No signup. No API key management. No billing dashboard. Payment IS the auth.

This runs on the x402 protocol — an HTTP-native payment standard. If your agent can make an HTTP request, it can use this.

What's available

Endpoint Price What it does
/x402/risk-check $0.005 Quick risk score for any action
/x402/noleak $0.01 Execution integrity — detect prompt injection, data exfiltration
/x402/memguard $0.01 Memory state verification — catch tampering
/x402/riskoracle $0.01 Pre-action risk scoring with detailed factors
/x402/secureexec $0.01 Tool call security — validate before executing
/x402/validate $0.01 Policy validation against configurable rules
/x402/delphi $0.01 Intelligence signals — market and ecosystem data
/x402/flowcore $0.02 Full pipeline — runs all checks in one call

Everything is live at achillesalpha.onrender.com.

Quickstart: JavaScript

Install the x402 client:

npm install @x402/fetch

Make a paid call:

import { fetchWithPayment } from "@x402/fetch";

const res = await fetchWithPayment(
  "https://achillesalpha.onrender.com/x402/riskoracle",
  {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({
      agent_id: "my-trading-agent",
      action: "swap 500 USDC to ETH",
      value: 500
    })
  },
  { privateKey: process.env.PRIVATE_KEY }
);

const result = await res.json();
console.log(result);
// { risk_score: 0.23, recommendation: "proceed", factors: [...] }

That's three lines of real logic. The x402 client handles the USDC payment on Base transparently — your agent doesn't need to think about it.

Python

# pip install x402-python
from x402 import Client

client = Client(private_key="0x...", network="base")
result = client.post(
    "https://achillesalpha.onrender.com/x402/riskoracle",
    json={"agent_id": "my-agent", "action": "transfer 100 USDC"}
)
print(result.json())

curl (test without paying)

You can hit any endpoint without a wallet — you'll get back a 402 Payment Required response with the payment spec, so you can see exactly what's expected:

curl -X POST https://achillesalpha.onrender.com/x402/riskoracle \
  -H "Content-Type: application/json" \
  -d '{"agent_id":"test","action":"swap 100 USDC"}'

This is useful for testing your integration before wiring up payments.

FlowCore: the full pipeline

If you want everything in one shot — risk scoring, execution integrity, memory verification, policy validation — use FlowCore:

const res = await fetchWithPayment(
  "https://achillesalpha.onrender.com/x402/flowcore",
  {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({
      agent_id: "my-agent",
      action: "deploy contract",
      value: 1000,
      memory_hash: "abc123"
    })
  },
  { privateKey: process.env.PRIVATE_KEY }
);
// { approved: true, risk_score: 0.15, integrity: "clean", pipeline_hash: "..." }

$0.02 for a full security pipeline before every high-value action. For an agent managing real capital, that's nothing compared to the cost of one bad execution.

Why x402 instead of API keys?

I thought about the traditional approach — issue API keys, build a billing system, manage subscriptions. But for autonomous agents, that model breaks down:

  1. Agents don't sign up for accounts. They discover services and use them. x402 makes every endpoint self-describing and instantly payable.
  2. No credential management. There's no API key to leak, rotate, or revoke. The agent's wallet is the only credential, and it already has one.
  3. Usage-based by default. An agent that makes 10 calls pays for 10 calls. An agent that makes 10,000 pays for 10,000. No tiers, no overages, no "please upgrade your plan."
  4. Composable. Any agent framework that supports HTTP can integrate. No SDK lock-in required.

Discovery endpoints

Agents and LLMs can discover the full service catalog programmatically:

What URL
Agent card /.well-known/agent.json
OpenAPI spec /openapi.json
LLM-readable docs /llms.txt
AI plugin manifest /.well-known/ai-plugin.json
MCP manifest /.well-known/mcp.json
x402 manifest /.well-known/x402.json
Status (free) /x402/status

All URLs are relative to https://achillesalpha.onrender.com.

This means an agent can hit /.well-known/agent.json, discover available security services, read the OpenAPI spec to understand the request format, and start making paid calls — all without human configuration.

The economics

Quick math for agent builders:

  • A trading agent making 100 decisions/day using riskoracle at $0.01/call = $1/day = $30/month
  • Same agent using flowcore for full pipeline = $2/day = $60/month
  • A cautious agent using risk-check for quick screening first ($0.005), then flowcore only for high-value actions = even less

Compare that to one bad trade from an unguarded agent. The cost of NOT having guardrails is almost always higher.

It's live

This isn't a whitepaper or a roadmap. It's running right now on Bankr x402 Cloud.

If you're building autonomous agents and want to add a safety layer without the overhead of key management and billing infrastructure, give it a shot. Hit the quickstart page — you can be integrated in under a minute.

I'm building this as part of a broader agent infrastructure project. Happy to answer questions about the architecture, x402 integration, or agent safety patterns in general.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment