ModelsAtlas
Explore
Atlas / MCP servers / twzrd-sol / twzrd-x402-gate

twzrd-x402-gateBLOCK

mcp/twzrd-sol/twzrd-trust
MCP server by twzrd-sol · agent trust · mcp · pre spend · Audited 2026-10-12
⚑ Report / re-scanSource ↗

TWZRD buyer-side x402 trust packages: x402 trust gate, elizaOS trust plugin, and the agent-intel client. Vet a counterparty before you pay.

Verdict
BLOCK
Grade
F
Trust score
56 /100
Exposed tools
8 6r · 2w · 0d
Transport
stdio
License
MIT
Stars
0
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

Don't let your agent sign blind. Pre-spend trust for agents that buy: the x402 service they are about to pay (Solana, and Base) and the product listing they are about to buy from.

  • x402 services: vet the seller before USDC leaves the wallet, cap and ledger every spend, and bind each settled payment to the exact offer it paid for (bind-v1 — verifiable from public chain data). Advisory preflight is free ($0). The paid quickCheck is $0.001 (seller wash risk, tier and score; no receipt). Separately, the gate can issue a portable twzrd.payment_decision.v1 record from its own decision, signed locally with your own signer.
  • Product listings: a free check of a store product URL and its asking price against a card TWZRD published from the store's public pages. The card is an observer card, not a merchant attestation, and a match is never permission to spend (details).

Not a wallet. Not a payment network. The commerce walkthrough lives in docs/COMMERCE-KIT.md.

Canonical skill (always refresh) • https://intel.twzrd.xyz/skill.md (skill twzrd-trust; the live copy carries its version) · ClawHub `twzrd-trust` Spend-control SDK (npm) • `[email protected]` + seat `[email protected]` Live MCP • https://intel.twzrd.xyz/mcp (streamable HTTP; free tools for x402 service checks and product-listing checks) Shopping check • free check_listing on the hosted MCP · report: https://twzrd.xyz/shopping-check/vuori-kore/ Agent contract • https://intel.twzrd.xyz/llms.txt · https://intel.twzrd.xyz/.well-known/agent.json

60-second deterministic free demo

Run this one-line command with no wallet, no API key, and no configuration:

curl -fsS https://intel.twzrd.xyz/v1/intel/demo-gate | jq '{verdict: (.steps[
Read from source at commit 8fe63071e452OBSERVED · 2026-10-12
Advertisement
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code
claude mcp add twzrd-x402-gate --env SVM_KEYPAIR_PATH=${SVM_KEYPAIR_PATH} --env TWZRD_RECEIPT_PUBKEY=${TWZRD_RECEIPT_PUBKEY} --env TWZRD_WALLET_SECRET_KEY=${TWZRD_WALLET_SECRET_KEY} -- npx -y [email protected]
claude-desktop
{
  "mcpServers": {
    "twzrd-x402-gate": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "SVM_KEYPAIR_PATH": "${SVM_KEYPAIR_PATH}",
        "TWZRD_RECEIPT_PUBKEY": "${TWZRD_RECEIPT_PUBKEY}",
        "TWZRD_WALLET_SECRET_KEY": "${TWZRD_WALLET_SECRET_KEY}"
      }
    }
  }
}
03

Exposed tools (8)

6 read · 2 write · 0 destructive.

ToolRiskDescription
TWZRD_TRUST_GATEreadBuyer-side x402 trust check: scores the counterparty seller wallet via the free TWZRD
full_trustwritePAID $0.05 (auto-pay, Solana x402): full trust intel + signed V6 receipt.
merchant_cardreadFREE: seller graph card for a payTo wallet or resource id. wash_flagged=true -> do not pay (locked buyer sequence step 2). No payment.
preflightreadFREE pre-payment check. readiness_card with allow/warn/block + trust_score. No payment.
quick_trustwritePAID $0.001 (auto-pay, Solana x402): quick tier+score for a Solana wallet.
twzrd-trustgatereadBuyer-side x402 trust gate. Scores a seller via free TWZRD preflight (ReadinessCard) before
verify_receiptreadFREE: independently verify a wallet
wallet_lookupreadFREE: facilitators + counterparty breadth for a Solana wallet.
04

Trust audit

BLOCKgrade F · trust 56/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codeFAIL
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
none-observed
Network
declared (5 observation(s))
Shell
declared (5 observation(s))
Dependencies
not all pinned
Secrets in source
found

Findings (25)

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
plugin-trustgate/dist/faremeter.d.ts:38
exec(): Promise<{
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
twzrd-x402-gate/src/resource-bind-tx.ts:13
const TOKEN = "TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA";
MEDIUMHard-coded secrets · secret.private_key · CWE-798, CWE-321
twzrd-x402-gate/test/evidence-verify.test.ts:36
["pem_block", { note: "-----BEGIN PRIVATE KEY-----\nMIIB\n-----END PRIVATE KEY-----" }],
MEDIUMHard-coded secrets · secret.private_key · CWE-798, CWE-321
twzrd-x402-gate/test/payment-decision.test.ts:395
private_key: "-----BEGIN PRIVATE KEY-----",
MEDIUMHard-coded secrets · secret.private_key · CWE-798, CWE-321
twzrd-x402-gate/test/payment-decision.test.ts:408
const pem = verify({ ...base, note: "-----BEGIN PRIVATE KEY-----\nMIIB\n-----END PRIVATE KEY-----" });
MEDIUMHard-coded secrets · secret.stripe · CWE-798, CWE-321
twzrd-x402-gate/test/evidence-verify.test.ts:38
["bearer_token", { h: "Bearer sk_live_abcdefghijklmnop" }],
MEDIUMHard-coded secrets · secret.stripe · CWE-798, CWE-321
twzrd-x402-gate/test/payment-decision.test.ts:393
authorization: "Bearer sk_live_abcdefghijklmnop",
LOWFilesystem / path · fs.credential_store · CWE-22, CWE-59
twzrd-x402-gate/test/evidence-bundle.test.ts:119
const something = scrubForEvidence({ outer: { apiKey: "x", note: "/home/someone/.ssh/id" } });
Why it matters. touches a credential store
LOWFilesystem / path · fs.credential_store · CWE-22, CWE-59
twzrd-x402-gate/test/evidence-verify.test.ts:250
assert.equal(verifyEvidenceBundle({ ...full, leaked: "/home/alice/.ssh/id_ed25519" }).ok, false);
Why it matters. touches a credential store
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
docs/proofs/examples/zero-spend-guard-check.mjs:17
import { installTwzrdAutoGate } from "../../../twzrd-x402-gate/dist/index.js";
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
twzrd-log-verifier/test/imports.test.ts:16
const SRC = fileURLToPath(new URL("../../src", import.meta.url));
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
twzrd-x402-gate/examples/shadow-sweep.ts:37
import { checkTrust } from "../../plugin-trustgate/src/gate.js";
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
twzrd-x402-gate/examples/shadow-sweep.ts:38
import { createOnBeforeSettleHook } from "../../plugin-trustgate/src/facilitator.js";
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
twzrd-x402-gate/test/live/cold-start.test.ts:20
} from "../../src/cold-start.js";
LOWNetwork egress · net.beacon_words · CWE-200, CWE-319
.github/workflows/publish-eliza-plugin.yml:3
# Not pull_request-triggered -- that is how CI publish tokens get exfiltrated.
LOWNetwork egress · net.beacon_words · CWE-200, CWE-319
.github/workflows/publish.yml:6
# is the standard way CI publish tokens get exfiltrated. Manual button-press
LOWNetwork egress · net.metadata_ip · CWE-200, CWE-319
twzrd-x402-gate/test/cold-start.test.ts:233
"https://169.254.169.254/latest/meta-data",
Why it matters. cloud metadata endpoint: the classic SSRF credential grab
LOWNetwork egress · net.metadata_ip · CWE-200, CWE-319
twzrd-x402-gate/test/ssrf.test.ts:17
"169.254.169.254",
Why it matters. cloud metadata endpoint: the classic SSRF credential grab
LOWNetwork egress · net.metadata_ip · CWE-200, CWE-319
twzrd-x402-gate/test/ssrf.test.ts:39
assert.equal(await hasForbiddenResolution("https://169.254.169.254/latest/meta-data", resolve), true);
Why it matters. cloud metadata endpoint: the classic SSRF credential grab
LOWNetwork egress · net.metadata_ip · CWE-200, CWE-319
twzrd-x402-gate/test/ssrf.test.ts:50
assert.equal(await hasForbiddenResolution("https://metadata.google.internal/", resolve), true);
Why it matters. cloud metadata endpoint: the classic SSRF credential grab
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
twzrd-log-verifier/test/monitor-cli.test.ts:98
baseUrl = `http://127.0.0.1:${addr.port}`;
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
twzrd-x402-gate/examples/clawrouter-gate.ts:66
base: `http://127.0.0.1:${port}`,
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
twzrd-x402-gate/examples/foreign-client-proof.ts:173
const origin = `http://127.0.0.1:${(server.address() as AddressInfo).port}`;
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
twzrd-x402-gate/examples/foreign-client-proof.ts:215
const origin = `http://127.0.0.1:${(server.address() as AddressInfo).port}`;
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
twzrd-x402-gate/examples/wash-refuse-dogfood.ts:171
intelBase: "https://127.0.0.1:1",

Gates applied: no_behavioural_pass.

Audited 2026-10-12 · audit v0.4.1 · source sha 8fe63071e452full audit observations/trust-audit/mcp-server/twzrd-sol__twzrd-trust.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-128fe63071e452BLOCKF56first audit
06

Questions

What is the twzrd-x402-gate MCP server?

TWZRD buyer-side x402 trust packages: x402 trust gate, elizaOS trust plugin, and the agent-intel client. Vet a counterparty before you pay.

What tools does twzrd-x402-gate expose?

8 in total: 6 read-only, 2 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is twzrd-x402-gate safe to connect to an agent?

No — not without reading the findings first. The audit graded it F (56/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on.

What credentials does twzrd-x402-gate need?

It reads SVM_KEYPAIR_PATH, TWZRD_RECEIPT_PUBKEY and TWZRD_WALLET_SECRET_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does twzrd-x402-gate run?

It speaks stdio, so it runs as a local process your client starts. It is published on npm as twzrd-x402-gate at 0.12.0.

How current is this page?

The grade is for one exact copy of the source (8fe63071e452), read on 2026-10-12. The repository is watched and re-audited when it changes.

Advertisement