# Fizzl > Safety checks for AI agents that pay. Fizzl checks what an agent is about to sign, which paid API it is about to buy from, and what that API sent back. All services are paid per call over x402 (USDC on Base, Solana, Algorand or Stellar, or RLUSD on the XRP Ledger), need no account or API key, and never sign anything for you. Only Fizzl Buy pays anyone: the seller it buys from on your behalf, from its own wallet. Use Fizzl when an agent is about to: sign a transaction, approval or typed-data signature (presign-guard); buy, hold or accept a token (presign-guard); pay an x402 endpoint it has not used before (x402 Doctor); get data or a result it doesn't have from the right paid API, in one call (Fizzl Buy); or let its owner set spending rules and approve payments (Fizzl Agent Wallet). An agent sent here by its owner can start with the short skill file: https://fizzl.eu/skill.md (which service for which moment, the free tools to try first, how paying works). This file plus the full text of every Fizzl research article and guide, in one file: https://fizzl.eu/llms-full.txt ## Before signing: presign-guard Checks a transaction or signature before an agent signs it, on EVM chains, Solana, the XRP Ledger and Algorand. Solana: send `{"type": "solana", "transaction": ""}` (every instruction decoded, then simulated: token account takeovers, hidden delegates). XRP Ledger: `{"type": "xrpl", "tx": …}` (account takeovers, fake RLUSD, partial payments, DEX offers far below market). Algorand: `{"type": "algorand", "transaction": ""}` or a whole group as `transactions` (rekeys, closing the account or an asset holding to someone else, fake USDC; simulated). Answers green / orange / red with reason codes. Flags signatures that borrow the names of Permit2, Seaport, CoW, UniswapX or 1inch. - `POST https://presign-guard.fizzl.eu/v1/check` ($0.01): verdict, reason codes and the decoded transaction or signature - `POST https://presign-guard.fizzl.eu/v1/check/explain` ($0.03): the same plus a plain-language explanation (English or Dutch) - `GET https://presign-guard.fizzl.eu/v1/token?chain=…&address=…` ($0.01): any red flags on this token, like a honeypot or a rug pull? Solana, EVM chains, Algorand assets (`chain=algorand&address=31566704`) and XRPL tokens (`chain=xrpl&address=RLUSD.rMxCK…`) - `GET https://presign-guard.fizzl.eu/v1/approvals?chain=…&address=…` ($0.02): every open token approval of a wallet and which ones to revoke - `GET https://presign-guard.fizzl.eu/v1/screen?address=…` ($0.01): is this wallet sanctioned? Any chain's address (EVM, Solana, Tron, Bitcoin, XRP Ledger, Algorand) against the OFAC SDN list, plus theft and phishing reports for EVM - `GET https://presign-guard.fizzl.eu/v1/sanctions` (free, open data): every crypto address on the OFAC SDN list with its entry (name, programs, currency), refreshed every 6 hours - For sellers: [presign-guard-payer-screen](https://www.npmjs.com/package/presign-guard-payer-screen) (npm, no dependencies) screens who pays your x402 API against that list before the payment settles. One Express middleware before the x402 payment middleware; a listed payer gets 451 and is never charged. EVM, Solana, Algorand and XRP Ledger payments - Guide: [OFAC sanctions screening for x402 payments](https://fizzl.eu/sanctions/): the seller middleware, the pre-payment checks, the $0.01 screen and the free list on one page - `GET https://presign-guard.fizzl.eu/v1/credits` (free): prepaid packs, 100 checks for $0.80 or 1000 for $7.00 - MPP sessions (pay-as-you-go): the paid HTTP routes also offer MPP intent `session` on Tempo (USDC.e). An `mppx` client opens a payment channel once and pays each call with a signed voucher, no transaction per call; unspent deposit comes back when the channel closes - MCP server: `https://presign-guard.fizzl.eu/mcp` (Streamable HTTP), in the official MCP registry as `io.github.Fizzl13/presign-guard` - Docs: [presign-guard on GitHub](https://github.com/Fizzl13/presign-guard) ## Before paying an endpoint: x402 Doctor Checks x402 and MPP paid APIs. Buyers ask "is this safe to pay?"; sellers ask "why is my endpoint broken?". Checks over 35,000 paid endpoints every day. - `GET https://x402-doctor.fizzl.eu/api/v1/preflight?url=…&max_usd=…` ($0.001): go / caution / no_go before paying, with the cheapest option that will settle, a bait check (fake brands, airdrop lures, output that doesn't match) and an OFAC sanctions screen of the seller's payout address (listed = no_go) - `GET https://x402-doctor.fizzl.eu/api/v1/preflight/batch?url=a&url=b` ($0.005): the same for up to 10 endpoints - `GET https://x402-doctor.fizzl.eu/api/v1/preflight/deep?url=…` ($0.01): the preflight plus full diagnosis, 30-day history and the seller's track record, before an expensive call - `GET https://x402-doctor.fizzl.eu/api/v1/diagnose?url=…` ($0.01): every check of an x402 endpoint with a fix hint - `GET https://x402-doctor.fizzl.eu/api/v1/fix?url=…` ($0.05): the code change per problem for your stack - `GET https://x402-doctor.fizzl.eu/api/v1/delivery-check?url=…` ($0.25): not a reading but a purchase. x402 Doctor buys the endpoint once (at most $0.10, USDC on Base) with the example input its listing declares and publishes whether it was paid and delivered, with the charge measured on chain; a job id at once, the result usually within minutes (`GET https://x402-doctor.fizzl.eu/api/v1/delivery-check/{id}`, free). Also on the web check: after a free check, "Order with MetaMask" - `GET https://x402-doctor.fizzl.eu/api/v1/credits` (free): prepaid packs, 1000 credits for $0.80 or 10,000 for $7.00 - Checks x402 on Base, Solana, Polygon, Arbitrum, Optimism, Avalanche, XRPL, Algorand and Stellar, MPP (Stripe/Tempo) and L402 (Lightning); MCP servers too, including hidden instructions for the agent in tool descriptions (tool poisoning) - Free web check: [x402-doctor.fizzl.eu](https://x402-doctor.fizzl.eu/) - Free data: the [x402 Trust Index](https://x402-doctor.fizzl.eu/trust), a daily check of every CDP Bazaar and MPP endpoint (`GET https://x402-doctor.fizzl.eu/api/trust?url=…` for one resource's 30-day record, `/api/trust/summary` for the totals), and a weekly spot-buy: about 30 random endpoints that look payable are actually paid, with what came back (`GET https://x402-doctor.fizzl.eu/api/trust/spot`) - Free GitHub Action for sellers, checks your endpoints on every push: `uses: Fizzl13/x402-doctor-action@v1` ([Marketplace](https://github.com/marketplace/actions/x402-doctor-check)) - Docs: [x402 Doctor on GitHub](https://github.com/Fizzl13/x402-doctor) ## Buying for an agent: Fizzl Buy Say what the agent needs ("weather forecast for Amsterdam tomorrow", "BTC price", "search the web for x402") and Fizzl Buy buys it: it picks the paid x402 API that x402 Doctor has seen paying out day after day at a fair price, fills in its input, pays it (up to $0.01, from its own wallet, after a preflight) and returns the answer, checked by TypeSafe Jev, with a signed receipt. When a seller doesn't deliver it tries the next; nothing is charged when none delivers. - `POST https://buy.fizzl.eu/v1/buy` with `{"need": "…"}` ($0.02, USDC on Base or Solana): the answer, which service it came from and what it cost - `GET https://buy.fizzl.eu/v1/pick?need=…` (free, 10 an hour): which service it would buy, its track record and price, and the alternatives - MCP server: `https://buy.fizzl.eu/mcp` (Streamable HTTP), free tool `x402_pick` - Docs: [buy.fizzl.eu/llms.txt](https://buy.fizzl.eu/llms.txt), source in [x402 Doctor on GitHub](https://github.com/Fizzl13/x402-doctor) ## For agent owners: Fizzl Agent Wallet Spending rules in plain words, one-tap approvals in Telegram for payments above them, a pre-sign check on every payment, and a check on every paid answer (did the agent get what it paid for, does the answer contain instructions aimed at the agent). It never holds keys. On the XRP Ledger too: with `XRPL_SEED` (presign-guard-wallet-mcp 0.11+, or `xrplSigner` in presign-guard-wallet 0.10+) the agent pays x402 offers in RLUSD from its own XRPL account, including sellers on t54's facilitator (the XRPL AI Hub). Each Payment is checked by presign-guard first, only real RLUSD from Ripple's issuer is paid, and it counts toward the USDC limits. Owners can sign in to the dashboard with Xaman and pay Pro in RLUSD. Approvals signed in your own wallet: with `AC2_OWNER` (presign-guard-wallet-mcp 0.18+, or `ac2Approver` in presign-guard-wallet 0.20+) a payment above the limits is approved in AC2 Wallet on the owner's phone over AC2, the Algorand Foundation's protocol for agents to ask their owner, instead of a Telegram tap. The owner approves with a passkey, the agent checks that the signature comes from the owner's Algorand account before it pays, and the signed approval is kept with the payment as proof. It needs the AC2 service (`ac2-cli`) on the agent's machine; the hosted wallet at wallet.fizzl.eu keeps using its app, Telegram and the dashboard. MPP sessions on Tempo: with `MPP_SESSION_DEPOSIT` (presign-guard-wallet-mcp 0.12+, or `tempoSessionAccount` in presign-guard-wallet 0.11+ with mppx's session client) the agent pays services that offer MPP sessions, such as presign-guard, through one payment channel per service: a deposit in USDC.e once, then a signed voucher per call instead of a transaction. Every deposit counts toward the USDC limits; `close_sessions` closes the channels and the unspent deposit comes back. - [wallet.fizzl.eu](https://wallet.fizzl.eu/) and the [demo](https://wallet.fizzl.eu/demo) - npm: [presign-guard-wallet](https://www.npmjs.com/package/presign-guard-wallet) (wraps a viem wallet), [presign-guard-wallet-mcp](https://www.npmjs.com/package/presign-guard-wallet-mcp) (MCP server for Claude, Cursor and other agents), [presign-guard-agentkit](https://www.npmjs.com/package/presign-guard-agentkit) (Coinbase AgentKit plugin, EVM and Solana wallets), [presign-guard-solana-agent-kit](https://www.npmjs.com/package/presign-guard-solana-agent-kit) (Solana Agent Kit wallet guard), [plugin-fizzl](https://www.npmjs.com/package/plugin-fizzl) (ElizaOS plugin), [presign-guard-ai-sdk](https://www.npmjs.com/package/presign-guard-ai-sdk) (Vercel AI SDK tools: check before signing, token check, approvals, endpoint preflight), [fizzl-langchain](https://www.npmjs.com/package/fizzl-langchain) (the same checks as LangChain.js and LangGraph.js tools, an official LangChain integration listed in LangChain's JavaScript integrations: https://docs.langchain.com/oss/javascript/integrations/providers/all_providers; docs https://fizzl.eu/agents/langchain-js/), PyPI: [fizzl](https://pypi.org/project/fizzl/) (the same checks for Python agents, with LangChain and OpenAI Agents SDK tools; an official LangChain integration, listed among the security tools at https://docs.langchain.com/oss/python/integrations/tools#security), [x402-safe-fetch](https://www.npmjs.com/package/x402-safe-fetch) (fetch that checks before it pays), [fizzl-paypal-guard](https://www.npmjs.com/package/fizzl-paypal-guard) (limits, a customer check and the owner's approval for AI agents on PayPal's Agent Toolkit: refunds, disputes, cancellations, invoices), [fizzl-paypal-guard-mcp](https://www.npmjs.com/package/fizzl-paypal-guard-mcp) (PayPal's Agent Toolkit as an MCP server for Claude Desktop, Claude Code and Cursor, every call that moves money checked by fizzl-paypal-guard). presign-guard-ai-sdk, fizzl-langchain and fizzl work without a wallet: with no payment set up, the token, signing and endpoint checks fall back to the free quick checks (verdict only, a few per hour, marked "free": true; opt out with free: false) - Overview: [fizzl.eu/agents](https://fizzl.eu/agents/) - Solana agents (every transaction decoded and simulated before signing, SOL and USDC limits, Metaplex agent payments unwrapped; everything Fizzl does on Solana): [fizzl.eu/agents/solana](https://fizzl.eu/agents/solana/) - Wallets (pre-sign checks for wallet apps: one API call before the user signs, verdict, reason codes and a plain-language explanation; credit packs from $0.007 a check): [fizzl.eu/wallets](https://fizzl.eu/wallets/) - Algorand agents (every transaction and group checked and simulated before signing, asset checks, ALGO and USDC limits): [fizzl.eu/agents/algorand](https://fizzl.eu/agents/algorand/) ## Other paid APIs - PlainText: `POST https://plaintext.fizzl.eu/api/check-wallet` ($0.04) and `POST https://plaintext.fizzl.eu/api/explain` ($0.03): wallet approvals and signature requests explained in plain language for people - Ichimoku signal: `GET https://ichimoku-signal.fizzl.eu/signal/{pair}` ($0.01) trend signal for top-200 coins; `/signals/{pair}` ($0.15) six-indicator confluence; `/levels/{pair}` ($0.05) support, resistance and a trade plan; `/scan` ($0.10) all 148 coins; `/setups` ($0.50) ranked setups. XRP Ledger DEX pairs with the `xrpl:` prefix (`/signal/xrpl:XRP-RLUSD`). Not trade advice ## Research - [We check 50,000 paid x402 endpoints every day (October 2026)](https://fizzl.eu/research/x402-health-october-2026/): how many x402 endpoints are payable, seller concentration, networks, prices, the most common seller mistakes with fixes, and what happened when we paid 27 random endpoints - [x402 on Stellar (October 2026)](https://fizzl.eu/research/x402-stellar-october-2026/): 631 paid endpoints that take USDC on Stellar, one seller with 91% of them, prices, and the asset-field mistake that blocks 7%, with the fix - [The seven most common x402 seller mistakes, and how to fix them (October 2026)](https://fizzl.eu/research/x402-seller-mistakes-october-2026/): resource URL mismatch (2,009 endpoints), no 402 on the listed method (1,042), testnet only (206), MPP realm for another host (102), 402 price above the listing (73), the Stellar asset given as a name (7% of Stellar endpoints) and Bazaar examples without working input, each with the fix as code; plus the HEAD-without-payment SDK bug - [Circle's Agent Marketplace: two-thirds of the listings take only Gateway payments (October 2026)](https://fizzl.eu/research/circle-agent-marketplace-october-2026/): 2,856 listings from 125 sellers in Circle's x402 catalog; 68% can only be paid through Circle Gateway (from 5 sellers), so a standard x402 client can pay 30%; nanopayments at $0.0001; how agents pay both ways and how sellers reach every agent - [Half the x402 sellers paid on Base were paid only by scanners (October 2026)](https://fizzl.eu/research/x402-real-buyers-october-2026/): two days of on-chain x402 payments on Base (63,951 signed USDC payments, $3,514, 1,476 wallets, 774 sellers); 14 wallets that each pay 10 or more sellers were the only payers of 393 sellers, while 26 sellers with ten or more ordinary payers took 69% of the payments; why a payment count is not demand, and how x402 Doctor now tells scanners from buyers - [Who can freeze the money AI agents pay with? The stablecoins behind x402 (October 2026)](https://fizzl.eu/research/x402-stablecoin-controls-october-2026/): who can upgrade, mint, pause and freeze each stablecoin x402 sellers ask for, read on chain: USDC on Base and 12 other EVM chains (each power a single key), on Solana, Algorand and Stellar (2 of 4 signatures), RLUSD (26-signer list), USD1 and USD₮0 (3-of-5 and 3-of-6 multisigs); 59% of 2,756 sellers take nothing but USDC on EVM chains; how presign-guard's token verdict now shows who controls a token - [x402 runs on cents, but the money comes from a few big payments (October 2026)](https://fizzl.eu/research/x402-where-the-money-goes-october-2026/): three days of on-chain x402 payments on Base (146,474 signed USDC payments, $6,851, 2,114 wallets, 994 sellers); 94% of the payments went to sellers averaging under six cents and brought a third of the money, while 19 sellers averaging over $0.60 had 0.8% of the payments and 44% of the money; what agents buy (analysis calls, AI models, prepaid balances, jobs), concentration (top 3 sellers 53%), and what it means for per-payment limits, seller pricing and catalogs ## Data - [x402 Trust Index on Hugging Face](https://huggingface.co/datasets/x402Fizzl/x402-trust-index): open dataset (CC BY 4.0, updated daily) of every paid x402 and MPP endpoint in the latest scan, about 50,000, with its verdict (go / caution / no_go), reasons, price, networks, category and 30-day history, plus go / caution / no_go per day - [x402 Agent Safety Bench on Hugging Face](https://huggingface.co/datasets/x402Fizzl/x402-agent-safety-bench): open dataset (CC BY 4.0) of every run of the x402 Agent Safety Bench (how AI agents from Anthropic, OpenAI, Google and DeepSeek handle x402 payment and signing traps, with and without x402 Doctor's skill), with full tool-call transcripts and the published tables; the leaderboard is a Hugging Face Space: https://huggingface.co/spaces/x402Fizzl/x402-agent-safety-bench - [Do AI agents pay safely? What 2,075 runs of the x402 Agent Safety Bench show](https://huggingface.co/blog/x402Fizzl/do-ai-agents-pay-safely-what-2075-runs-of-the-x402): the findings as an article on Hugging Face. Alone, every model fell for the same four traps every time (a sanctioned payee, a seller that takes the money and doesn't answer, a seller other buyers lost money to, a $5 Permit to a contract reported for phishing); with x402 Doctor's and presign-guard's skills, Claude Sonnet avoided 39 of 39 traps - [x402 agent payments collection on Hugging Face](https://huggingface.co/collections/x402Fizzl/x402-agent-payments-6ad62101ba3cdbcf5f990a0e): the datasets, the leaderboard and the two MCP Spaces together ## MCP servers on Hugging Face Free Gradio Spaces that are also MCP servers (add them under Hugging Face's MCP settings, or connect any MCP client to the URL). They never pay, sign or hold a key. - [x402 Doctor](https://huggingface.co/spaces/x402Fizzl/x402-doctor) (`https://x402fizzl-x402-doctor.hf.space/gradio_api/mcp/`): check a paid x402 or MPP endpoint without paying, its daily track record, add your own endpoint to the Trust Index, and the market's health - [presign-guard](https://huggingface.co/spaces/x402Fizzl/presign-guard) (`https://x402fizzl-presign-guard.hf.space/gradio_api/mcp/`): screen an address against the OFAC SDN list (unlimited), and quick green / orange / red verdicts on a token or on what an agent is about to sign ## Guides - [Let an AI agent buy a paid API it has never used, in one call](https://fizzl.eu/guides/agent-buys-paid-api/): what it takes to find an x402 seller that answers, fill in its input, check it before paying (price, payout address, sanctions, bait) and check the answer after; how Fizzl Buy does it for $0.02 (nothing charged when no seller delivers), with the picks for six everyday needs on 23 October 2026 and code for x402 clients and MCP - [Tools to check an x402 endpoint before an AI agent pays, compared](https://fizzl.eu/guides/x402-endpoint-checkers/): Coinbase CDP validate, x402lint, the x402 Seller Kit checker, x402station, Settled, Cortx and x402 Doctor, by the question each answers (well-formed, safe to pay, delivers), cost and interface - [Approve AI agent payments in your own wallet with AC2](https://fizzl.eu/guides/ac2-agent-approvals/): an agent pays on its own within its limits and asks the owner in AC2 Wallet above them; the owner approves with a passkey, the Algorand account signs, and the agent checks the signature before it pays. Setup with ac2-cli, presign-guard-wallet-mcp (`AC2_OWNER`) or `ac2Approver` in code - [XRPL Batch, delegation, MPTs, vaults and loans: what an AI agent should check before signing](https://fizzl.eu/guides/xrpl-batch-delegation-mpt/): a Batch (XLS-56) can hide a SetRegularKey or AccountDelete next to a payment, a DelegateSet (XLS-75) can let another account pay itself from yours, and an MPT (XLS-33) carries its issuer's clawback, lock and fee rules. Coming next: a vault deposit (XLS-65) can be lent out unsecured or locked in a fixed-term fund, and a loan (XLS-66) can cost far more than its interest rate. What to check before signing, and presign-guard's reason codes for each - [Privy XRPL wallets for AI agents: what the policy checks, and what it lets through](https://fizzl.eu/guides/privy-xrpl-agent-policies/): Privy's XRPL policies read Payment, OfferCreate, OfferCancel and TrustSet. Until 22 October 2026 its sanctions denylist example ended with an unconditional ALLOW, so a CheckCreate, EscrowCreate, PaymentChannelCreate or Batch to the same address was signed, and so were SetRegularKey, SignerListSet, AccountDelete and DelegateSet; Privy then scoped the example to Payment after our report, but policies copied from the old one still have the gap. A policy for x402 payments in RLUSD that refuses them, and how to check other types with presign-guard before xrpl_signTransaction - [An AI support agent that refunds through PayPal's Agent Toolkit: what to check first](https://fizzl.eu/guides/paypal-agent-toolkit-guard/): the toolkit switches each of its 47 tools on or off, and a tool that is on runs with any capture and any amount; a refund with no amount pays back everything left. Check whose payment it is at PayPal (the order's payer, or your own custom_id for a card payment) against the customer your app serves, what is left, the shop's limits, and the owner's approval above them. fizzl-paypal-guard (npm) does it in one wrapper, and fizzl-paypal-guard-mcp is PayPal's MCP server with the same checks for Claude Desktop and Cursor; live demo on the PayPal sandbox: https://fizzl-paypal-demo.onrender.com ## Agent skills - [fizzl-skills](https://github.com/Fizzl13/fizzl-skills): every Fizzl SKILL.md for agents (x402 preflight, x402 seller check, pre-sign check with OFAC screening, agent wallet with limits, crypto trend signals). In Claude Code: `/plugin marketplace add Fizzl13/x402-doctor`, then `/plugin install x402-doctor@fizzl` (also `presign-guard@fizzl`, `fizzl-agent-wallet@fizzl`, `ichimoku-signal@fizzl`) ## Discovery Each service publishes `/.well-known/x402` and `/openapi.json`, and is listed in the CDP Bazaar and the XRPL AI Hub. RLUSD payments use the x402 `exact` scheme for XRPL (`@x402/xrpl`, and payers built on t54's SDK); USDC on Algorand (ASA 31566704, on x402 Doctor, presign-guard and Ichimoku) uses `@x402/avm` and settles through GoPlausible's facilitator; USDC on Stellar (on the same three) uses `@x402/stellar` and settles through OpenZeppelin's Built on Stellar facilitator, which pays the fee. All four are registered as ERC-8004 agents on Base: #97519 (x402 Doctor), #97520 (presign-guard), #97522 (Ichimoku signal), #97523 (PlainText). Paid answers carry a signed receipt that can be verified for free.