x402-firewall
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| NETWORK | No | Target EVM network. Allowed values are 'base' or 'base-sepolia'. | base-sepolia |
| RPC_URL | No | Custom EVM JSON-RPC endpoint URL. | Base public RPC |
| PRIVATE_KEY | No | A 32-byte hex private key for the wallet. If omitted, a disposable ephemeral key is generated on launch. | |
| DATABASE_PATH | No | Path to the persistent SQLite audit store. | ~/.x402firewall/audit.db |
| MAX_DAILY_USDC | No | Rolling 24-hour cumulative USDC spend ceiling. | 5.00 |
| ALLOWED_DOMAINS | No | Comma-separated domain patterns allowed for outbound requests, e.g. '*.weather.com,api.ai'. | |
| MAX_HOURLY_USDC | No | Rolling 60-minute cumulative USDC spend ceiling. | 1.00 |
| ALERT_WEBHOOK_URL | No | Webhook endpoint URL for security incident dispatch. | |
| ALLOWED_CONTRACTS | No | Comma-separated EVM contract addresses allowed for transactions. | |
| MAX_PER_CALL_USDC | No | Maximum USDC spend allowed per individual request. | 0.05 |
| BLOCK_UNLIMITED_APPROVALS | No | When true, restricts ERC-20 approve calldata to the configured maxPerCallUsdc. | true |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| x402_fetchB | Safely fetch free or x402-paid HTTP endpoints with deterministic spending caps and automatic EIP-3009 payment authorization on Base L2. |
| x402_get_budgetA | Inspect current x402 spending limits, rolling hourly and daily spends, and remaining USDC allowances on Base L2. |
| x402_safe_txB | Simulate and execute an allowlisted EVM transaction on Base L2. Verifies against spending caps, blocks dangerous selectors (unlimited approvals, drainers), and checks contract allowlists before signing. |
| x402_audit_logA | Inspect recent permitted and blocked transactions/payments in the local SQLite audit log. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 4 tools
Each tool maps to a clearly distinct action: HTTP fetching, budget inspection, EVM transaction execution, and audit inspection. Although x402_fetch and x402_safe_tx both involve spending controls, their resources and outcomes are clearly separated.
All tools share the consistent x402_ prefix and use readable snake_case, but the verb pattern is slightly mixed: x402_fetch and x402_get_budget are verb-led, while x402_safe_tx and x402_audit_log are noun/adjective-led. The deviation is minor and still predictable.
Four tools is well-scoped for a focused firewall/payment-safety server. Each tool covers a distinct core capability without obvious padding or triviality.
The surface covers the main lifecycle: safe fetching, budget visibility, safe transaction execution, and audit review. Minor gaps exist around managing or updating spending caps and allowlists, but core firewall workflows are represented.