Agents paste logs, configs and tool outputs into LLMs, tools and webhooks all day, and sometimes a seed phrase, private key or API key goes with them. LeakGuard checks text or a JSON payload before it leaves:
password= / api_key= assignments.You get a verdict (WALLET_KEY_EXPOSED / SECRETS_FOUND / PII_FOUND / CLEAN), safe_to_send, findings with masked
previews (never the secret), a remediation line per finding and the redacted text. The deep scan also takes JSON payloads
(findings by JSON path, redacted_json with the same shape) and, for every leaked seed phrase or private key, derives the
public addresses it controls and reports native + USDC balances on Base, Ethereum, Polygon, Arbitrum One and Solana:
funds_at_risk, used_empty, no_funds_found or unknown.
InjectScan guards what comes in to an agent; LeakGuard guards what goes out.
| Route | Price | What |
|---|---|---|
POST /v1/lite {"text": "..."} |
$0.005 | verdict, findings, remediation, redacted text (text up to 32 KB) |
POST /v1/scan {"text": "..."} or {"json": ...} |
$0.02 | lite + JSON payloads + leaked-wallet exposure + ordered actions (up to 256 KB) |
GET|POST /v1/preview |
free | verdict, safe_to_send, counts (8 KB, 10/min per IP) |
POST /mcp |
free | remote MCP, tool scan_for_leaks (preview tier) |
Base URL: https://api.youraitools.co/leakguard (fallback https://leakguard.agentgate.workers.dev). Pay in USDC with x402 v2
(Base, Solana, Polygon, Arbitrum One) or v1 (Base), or with a prepaid YourAITools credits key (Authorization: Bearer yatc_...).
Invalid or oversized input is never charged; only HTTP 200 results are settled. GET ?text= works too, but prefer POST for
anything sensitive.
Privacy: inputs are processed in memory for the duration of the request only: never logged, stored, cached or forwarded. Only public addresses derived from leaked keys are sent to public RPCs (deep scan).
Fail-closed: if a balance lookup fails or times out, the wallet is unknown (assume funds at risk), the chain is listed in
sources_failed and confidence is low. It is never reported as empty.
import { redact } from '@agentgate-builder/leakguard'; // zero dependencies; Node 20+, Workers, browsers
const r = await redact(text, { style: 'mask' });
// { verdict, safe_to_send, max_severity, counts, findings[], redacted }
MCP (stdio): { "mcpServers": { "leakguard": { "command": "npx", "args": ["-y", "@agentgate-builder/leakguard"] } } }.
Tools scan_for_leaks and redact_text run locally. With LEAKGUARD_X402_PRIVATE_KEY set (and @x402/fetch, @x402/evm,
viem installed next to it) the server adds check_leaked_wallets, which pays the hosted deep scan ($0.02 USDC on Base;
spend guard: Base only, at most $0.02 per payment, only to the LeakGuard payee).
Docker: docker build -t leakguard-mcp . && docker run -i --rm leakguard-mcp.
Pattern and validator based detection: it can miss secrets in unknown formats and can flag look-alikes. A clean result is not a guarantee. Balances are a point-in-time lookup of native coin and USDC only; BIP39 passphrases and non-default derivation paths are not covered; at most 8 addresses per scan.
MIT. BIP39 wordlist from @scure/bip39 (MIT). Source: https://agentgate-source.pages.dev/x402-leakguard/
agentgate-source: code mirror on Cloudflare Pages. All repos