Deterministic preflight check for a proposed AI agent action

Deterministic preflight check for a proposed AI agent action - a tool call, payment, fetch, or write - before it executes. Evaluates up to four independent checks (prompt-injection scan on action text/untrusted text, URL/hostname validation, a bounded JSON-schema check on a payload, and a spend proposal against a spend mandate) and returns ALLOW, REVIEW, or BLOCK with stable reason codes plus a SHA-256 request/receipt hash pair.

Paid test badge: not yet. The checks above are free: we call the tool without paying and read the payment request it sends back. The Verified badge needs paid calls whose answers match the promised output, and nobody can buy a badge.

Endpoint

POST https://agent402.tools/api/action-gate

Our checks, last 30 days

Example input (from the provider)

{
  "body": {
    "action": {
      "description": "Fetch a vendor risk report and store the validated JSON response.",
      "effect": "payment",
      "name": "submit_paid_api_request"
    },
    "payload": {
      "account_id": "acct_123",
      "include_signals": true
    },
    "schema": {
      "additionalProperties": false,
      "properties": {
        "account_id": {
          "type": "string"
        },
        "include_signals": {
          "type": "boolean"
        }
      },
      "required": [
        "account_id",
        "include_signals"
      ],
      "type": "object"
    },
    "spend": {
      "mandate": {
        "allowed_assets": [
          "USDC"
        ],
        "allowed_counterparties": [
          "0x1111111111111111111111111111111111111111"
        ],
        "expires_at": "2030-01-01T00:00:00.000Z",
        "max_per_tx_atomic": "25000",
        "max_period_atomic": "100000",
        "spent_period_atomic": "20000"
      },
      "proposal": {
        "amount_atomic": "10000",
        "asset": "USDC",
        "counterparty": "0x1111111111111111111111111111111111111111"
      }
    },
    "untrusted_text": "Vendor request: return the current account risk score.",
    "url": "https://example.com/risk-report"
  },
  "bodyType": "json",
  "method": "POST",
  "type": "http"
}

Promised output schema (from the provider)

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "properties": {
    "input": {
      "additionalProperties": false,
      "properties": {
        "body": {
          "properties": {
            "action": {
              "description": "{name, description, effect} - describes the proposed action; description is scanned for prompt-injection signals",
              "type": "object"
            },
            "payload": {
              "description": "Data the action would send, if any",
              "type": "object"
            },
            "schema": {
              "description": "Bounded JSON-schema (type/required/properties/additionalProperties) to validate payload against",
              "type": "object"
            },
            "spend": {
              "description": "{proposal:{amount_atomic,asset,counterparty}, mandate:{...}, now?} - checked with BigInt, no floats",
              "type": "object"
            },
            "untrusted_text": {
              "description": "Any additional untrusted text to scan for prompt-injection signals",
              "type": "string"
            },
            "url": {
              "description": "URL the action would fetch/call, if any",
              "type": "string"
            }
          },
          "required": []
        },
        "bodyType": {
          "enum": [
            "json",
            "form-data",
            "text"
          ],
          "type": "string"
        },
        "method": {
          "enum": [
            "POST"
          ],
          "type": "string"
        },
        "type": {
          "const": "http",
          "type": "string"
        }
      },
      "required": [
        "type",
        "method",
        "bodyType",
        "body"
      ],
      "type": "object"
    },
    "output": {
      "properties": {
        "example": {
          "properties": {
            "checks": {
              "properties": {
                "payload": {
                  "type": "object"
                },
                "prompt": {
                  "type": "object"
                },
                "spend": {
                  "type": "object"
                },
                "url": {
                  "type": "object"
                }
              },
              "type": "object"
            },
            "decision": {
              "type": "string"
            },
            "limitation": {
              "type": "string"
            },
            "reason_codes": {
              "type": "array"
            },
            "receipt_sha256": {
              "type": "string"
            },
            "request_sha256": {
              "type": "string"
            }
          },
          "required": [
            "decision",
            "reason_codes",
            "checks",
            "request_sha256",
            "receipt_sha256",
            "limitation"
          ],
          "type": "object"
        },
        "type": {
          "type": "string"
        }
      },
      "required": [
        "type"
      ],
      "type": "object"
    }
  },
  "required": [
    "input"
  ],
  "type": "object"
}

This page as JSON