LeakGuard: paid x402 outbound leak guard for AI agents (finds and redacts crypto wallet keys such as BIP39 seed phrases with checksum, EVM and Solana private keys, WIF and xprv, API secrets, JWT, PEM and PII before text or JSON reaches an LLM, tool, log or webhook; the scan tier reports which wallets a leaked key controls and whether they hold funds on Base, Ethereum, Polygon, Arbitrum One and Solana; fail-closed). Cloudflare Worker, Hono, x402 v2 + v1, Base / Polygon / Arbitrum One / Solana, remote and stdio MCP, offline npm engine.
Agents paste logs, configs and tool outputs into LLMs, tools and webhooks all day, and sometimes a seed phrase, private key or API key goes with them. LeakGuard checks text or a JSON payload before it leaves:
password= / api_key= assignments.You get a verdict (WALLET_KEY_EXPOSED / SECRETS_FOUND / PII_FOUND / CLEAN), safe_to_send, findings with masked
previews (never the secret), a remediation line per finding and the redacted text. The deep scan also takes JSON payloads
(findings by JSON path, redacted_json with the same shape) and, for every leaked seed phrase or private key, derives the
public addresses it controls and reports native + USDC balances on Base, Ethereum, Polygon, Arbitrum One and Solana:
funds_at_risk, used_empty, no_funds_found or unknown.
InjectScan guards what comes in to an agent; LeakGuard guards what goes out.
| Route | Price | What |
|---|---|---|
POST /v1/lite {"text": "..."} |
$0.005 | verdict, findings, remediation, redacted text (text up to 32 KB) |
POST /v1/scan {"text": "..."} or {"json": ...} |
$0.02 | lite + JSON payloads + leaked-wallet exposure + ordered actions (up to 256 KB) |
GET|POST /v1/preview |
free | verdict, safe_to_send, counts (8 KB, 10/min per IP) |
POST /mcp |
free | remote MCP, tool scan_for_leaks (preview tier) |
Base URL: https://api.youraitools.co/leakguard (fallback https://leakguard.agentgate.workers.dev). Pay in USDC with x402 v2
(Base, Solana, Polygon, Arbitrum One) or v1 (Base), or with a prepaid YourAITools credits key (Authorization: Bearer yatc_...).
Invalid or oversized input is never charged; only HTTP 200 results are settled. GET ?text= works too, but prefer POST for
anything sensitive.
Privacy: inputs are processed in memory for the duration of the request only: never logged, stored, cached or forwarded. Only public addresses derived from leaked keys are sent to public RPCs (deep scan).
Fail-closed: if a balance lookup fails or times out, the wallet is unknown (assume funds at risk), the chain is listed in
sources_failed and confidence is low. It is never reported as empty.
import { redact } from '@agentgate-builder/leakguard'; // zero dependencies; Node 20+, Workers, browsers
const r = await redact(text, { style: 'mask' });
// { verdict, safe_to_send, max_severity, counts, findings[], redacted }
MCP (stdio): { "mcpServers": { "leakguard": { "command": "npx", "args": ["-y", "@agentgate-builder/leakguard"] } } }.
Tools scan_for_leaks and redact_text run locally. With LEAKGUARD_X402_PRIVATE_KEY set (and @x402/fetch, @x402/evm,
viem installed next to it) the server adds check_leaked_wallets, which pays the hosted deep scan ($0.02 USDC on Base;
spend guard: Base only, at most $0.02 per payment, only to the LeakGuard payee).
Docker: docker build -t leakguard-mcp . && docker run -i --rm leakguard-mcp.
Pattern and validator based detection: it can miss secrets in unknown formats and can flag look-alikes. A clean result is not a guarantee. Balances are a point-in-time lookup of native coin and USDC only; BIP39 passphrases and non-default derivation paths are not covered; at most 8 addresses per scan.
MIT. BIP39 wordlist from @scure/bip39 (MIT). Source: https://agentgate-source.pages.dev/x402-leakguard/
agentgate-source: code mirror on Cloudflare Pages. All repos