x402 payment security for CrewAI agents

TollWarden is a payment security firewall for x402 micropayments. Agents that pay for APIs and data over x402 get drained in predictable ways, through payments triggered by prompt-injected content, replayed authorizations, inflated prices, secrets leaking through payment metadata, lookalike tokens, and address poisoning. crewai-tollwarden gives a CrewAI crew an allow / flag / block verdict on every payment before it settles, plus a tool-call hook that makes TollWarden's strongest detector work automatically.

Installation

pip install crewai-tollwarden

Two additions

from crewai import Agent
from tollwarden import TollWardenClient
from crewai_tollwarden import tollwarden_tools, register_tollwarden_provenance

tollwarden = TollWardenClient(agent_id="my-agent")   # free API key auto-minted (100 free scans)
register_tollwarden_provenance(tollwarden)           # call once at startup

agent = Agent(
    role="Purchasing agent",
    goal="Buy data over x402 safely",
    backstory="You screen every payment with TollWarden before settling.",
    tools=tollwarden_tools(tollwarden),
)

Why the provenance registration matters

TollWarden's strongest check catches payments whose decision came from content the agent just read (a prompt-injected page or tool result). register_tollwarden_provenance installs a CrewAI after-tool-call hook that observes every tool output automatically, so the next scan is provenance-tagged and that check runs with real input. No prompt engineering required. TollWarden's own tool outputs are excluded so verdicts never pollute the signal. CrewAI's tool-call hooks are process-global; call this once.

The toolset

• tollwarden_scan_payment screens a payment before your crew settles it (direction="outgoing") or before it pays a received 402 offer (direction="incoming"). Returns allow / flag / block with per-check reasons and an Ed25519-signed verdict.
• tollwarden_check_reputation checks community reports on a counterparty wallet before dealing with it.
• tollwarden_report_counterparty reports a bad counterparty (always free) to warn other agents.

Payments that cannot execute when blocked

from crewai_tollwarden import guarded_payment

safe_pay = guarded_payment(execute_x402_payment, tollwarden)
# raises TollWardenBlockedError on a block verdict; the executor is never called

Build your CrewAI payment tool's _run from safe_pay. For wallet-level enforcement (the signer itself refuses unscanned payments), see TollWardenEnforcer in the tollwarden SDK.

Reference

• The crewai-tollwarden package on PyPI and its source
• The service's integration guide and OpenAPI contract
• TollWarden is advisory and non-custodial. It never touches keys, wallets, or funds.

Other integrations

• LangChain, langchain-tollwarden
• Vercel AI SDK, @tollwarden/ai-sdk
• Coinbase AgentKit, agentkit-tollwarden
• NVIDIA NeMo Agent Toolkit, nemo-tollwarden
• All integrations