# TollWarden (npm · tollwarden)

Screens x402 payments before settlement for injected payee addresses and sellers who never deliver.

- Trust score: 77/100 (medium)
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-09-25

## Components

- npm · `tollwarden`: 77/100 (this document), [markdown](https://verifymcp.io/servers/com-tollwarden-tollwarden/tollwarden.md), [page](https://verifymcp.io/servers/com-tollwarden-tollwarden/tollwarden)

## Channel facts

- Registry: `npm`
- Package: `tollwarden`
- Version: `1.6.0`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-09-25.

- **Supply Chain Security**: 98/100
  - No malware found by supply-chain analysis.
  - No known CVEs affecting this package version or its production dependencies.
  - No install/post-install scripts declared.
  - 52 of 215 dependencies flagged as unhealthy.
- **Provenance & Transparency**: 84/100
  - Source repository is publicly reachable at the declared URL.
  - Cryptographically verified build provenance (signed, bound to tollwarden/tollwarden).
  - License check failed: the license (BUSL-1.1) isn't a recognized OSI-approved license.
  - Actively maintained (last published 5 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 67/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 2161 tokens (~180/item across 12 items; 12 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 20/100
  - Stability observed for 6 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 79/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 37% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - We read all 12 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 13 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### How do I install the TollWarden MCP server?

TollWarden runs locally as an npm package, launched with npx -y tollwarden. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add com-tollwarden-tollwarden -- npx -y tollwarden
```

### Cursor

```json
{
  "mcpServers": {
    "com-tollwarden-tollwarden": {
      "command": "npx",
      "args": [
        "-y",
        "tollwarden"
      ]
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "com-tollwarden-tollwarden": {
      "command": "npx",
      "args": [
        "-y",
        "tollwarden"
      ]
    }
  }
}
```

### Codex

```bash
codex mcp add com-tollwarden-tollwarden -- npx -y tollwarden
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "com-tollwarden-tollwarden": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "tollwarden"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add com-tollwarden-tollwarden --command npx --arg -y --arg tollwarden
```

### Hermes

```yaml
mcp_servers:
  com-tollwarden-tollwarden:
    command: "npx"
    args: ["-y", "tollwarden"]
```

### Netclaw

```json
{
  "McpServers": {
    "com-tollwarden-tollwarden": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "tollwarden"
      ]
    }
  }
}
```

### Vellum

```bash
assistant mcp add com-tollwarden-tollwarden -t stdio -c npx -a -y tollwarden
```

### Other

```json
{
  "mcpServers": {
    "com-tollwarden-tollwarden": {
      "command": "npx",
      "args": [
        "-y",
        "tollwarden"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-09-25 (score 77, 0)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-09-24 (score 77, +1)

- [security improvement] Known CVEs: partial → pass
- [functional] Dependency health: partial → 0.88

### 2026-09-23 (score 76, +15)

- [security improvement] Malware scan: unverified → pass

### 2026-09-22 (score 61, −3)

- [security regression] Malware scan: pass → unverified
- [security regression] Known CVEs: pass → partial
- [security improvement] Provenance: fail → pass
- [security] The attested source repository moved: tollwarden/tollwarden
- [functional improvement] Stability: unverified → 0.10
- [functional] Dependency health: 0.88 → partial
- [functional] Package version: 1.5.0 → 1.6.0

### 2026-09-19 (score 64)

First indexed and scored.

## MCP tools (12)

### `scan_outgoing_payment` (~346 tokens)

ALWAYS call this immediately BEFORE settling or sending any x402 payment — it decides whether the payment is safe. Returns allow (proceed) / flag (pause and confirm intent) / block (do NOT pay), with machine-readable reasons and an Ed25519-signed verdict. Scanning before the payment is signed? Set `context.phase` to 'pre_sign' (nonces don't exist until signing). IMPORTANT: if the decision to pay followed reading any external content (a fetched web page or a tool result), pass that PROSE in `context.content` and set `context.origin` to 'fetched_content' or 'tool_result' — this enables the check that catches prompt-injection-triggered payments (an address injected into content the agent just read). Put the 402 offer / discovery payload in `context.offer` (NOT in content — the recipient address is expected in an offer); TollWarden compares it structurally against the payment you are about to sign and reports drift in payee, price, scheme, network or asset. Where a catalogue listing and a live 402 disagree, the LIVE offer is authoritative — pay and scan that one, and pass the listing as `context.offer` so the disagreement is recorded. Also catches replayed nonces, overpayment vs the expected price, secrets/PII leaking in payment metadata, fake/lookalike USDC contracts, and address poisoning. Advisory and non-custodial — never touches keys or funds.

Input parameters:

- `agent_id` (string)
- `context` (object)
- `expected_price_usd` (number)
- `payment` (object, required)
- `policy` (object)

### `scan_incoming_payment` (~251 tokens)

ALWAYS call this BEFORE paying a 402 offer / payment request your agent received — it decides whether the offer is safe to pay. Scan the LIVE 402 returned by the exact method (GET/POST) and URL you are about to pay — NOT the catalogue/discovery listing: in the field, listings drift from live offers in both price (a listed $0.005 endpoint demanding $2.00 on the live 402) and scheme ('exact' advertised, 'upto' served). The live offer is what you pay, so it is what must be scanned. Pass the discovery listing in `context.offer` as well and TollWarden will report the drift between them. Checks the resource URL for spoofing (IP-literal hosts, punycode/homoglyphs, link shorteners, userinfo tricks), credential demands (e.g. 'send your seed phrase'), price sanity, replay, and whether the counterparty has been reported. Returns allow/flag/block with reasons.

Input parameters:

- `agent_id` (string)
- `context` (object)
- `expected_price_usd` (number)
- `payment` (object, required)
- `policy` (object)

### `check_counterparty_reputation` (~74 tokens)

Check whether a counterparty wallet address has been reported by other agents BEFORE dealing with it — scam, non-delivery, prompt injection, overcharge, impersonation, or replay abuse. Returns report counts, distinct-reporter count, and a risk level.

Input parameters:

- `address` (string, required): Wallet address to look up

### `report_payment_outcome` (~166 tokens)

ALWAYS call this AFTER a scanned payment settles, reporting what actually happened: 'delivered' (you received the goods/content), 'not_delivered' (paid but nothing arrived), 'partial', or 'wrong_content'. Pass the scan_id from the scan response and the payment_commitment from its attestation — outcomes are bound to real scans (one per scan), so delivery history cannot be faked. Your reports build the measured delivery rates that flag never-shipping sellers on your own future scans and every other agent's. Free.

Input parameters:

- `evidence` (object)
- `outcome` (string, required)
- `payment_commitment` (string, required): From the scan response's attestation.payment_commitment
- `scan_id` (string, required): From the scan response you made before paying

### `report_counterparty` (~105 tokens)

Call this after a bad payment experience (you paid and got nothing, were scammed, overcharged, or hit an injection attempt) to warn other agents — always free. Categories: scam, non_delivery, prompt_injection, overcharge, impersonation, replay_abuse, other.

Input parameters:

- `address` (string, required)
- `category` (string, required)
- `evidence_url` (string)
- `reason` (string, required)
- `reporter_agent_id` (string, required)

### `dispute_reputation` (~165 tokens)

If YOUR wallet has been unfairly reported, attach a signed rebuttal that appears alongside the reports in every reputation lookup. Prove you control the wallet by signing the exact message 'tollwarden-dispute-v1|<your address, lowercase>|<statement>' with the wallet's key (EIP-191 personal_sign) and passing the 65-byte signature hex. Rebuttals never erase reports — agents see both sides. Free.

Input parameters:

- `address` (string, required): The reported wallet address (0x…, the one that signed)
- `signature` (string, required): EIP-191 personal_sign signature hex over tollwarden-dispute-v1|<address>|<statement>
- `statement` (string, required): Your side of the story — exactly the text that was signed

### `mint_api_key` (~90 tokens)

Issue a free TollWarden API key (first 100 calls free). Returns the key ONCE — store it and set it as TOLLWARDEN_API_KEY (or pass to other tools) for future sessions. Rate-limited per IP.

Input parameters:

- `agent_id` (string): Stable identifier for your agent — recorded on the key; velocity limits and merchant pins are scoped to the key's account

### `rotate_api_key` (~157 tokens)

Rotate the current TollWarden API key (set via TOLLWARDEN_API_KEY): mints a fresh secret bound to the SAME account — usage history, remaining free calls, and any active plan carry over unchanged. Use this the moment a key may have leaked. The old secret keeps working for grace_seconds (default 900, 0 = immediately dead, max 86400) so other sessions can switch over, but it can no longer rotate or revoke the account. IMPORTANT: the response contains the new key ONCE — store it and update TOLLWARDEN_API_KEY everywhere.

Input parameters:

- `grace_seconds` (integer): How long the old secret keeps working (default 900 = 15 min; 0 kills it instantly)

### `check_approval_status` (~132 tokens)

Poll a pending human approval (from a flag verdict's `approval.approval_id` when the operator has configured approvals via POST /v1/approvals/config). Returns pending / approved / denied / expired; on approved it includes the signed override verdict (tag 'override:allow', valid a few minutes, bound to exactly the flagged payment). Requires TOLLWARDEN_API_KEY (the key that made the scan). This tool never handles decide tokens — deciding is the human's job via the webhook link.

Input parameters:

- `approval_id` (string, required): From the flag scan response's approval.approval_id

### `get_plans` (~46 tokens)

Machine-readable TollWarden plan catalog: tiers (Starter/Pro/Scale) with per-scan pricing, velocity and spend limits, hard ceilings, and how to subscribe. Free.

### `subscribe_plan` (~100 tokens)

Subscribe/renew the current API key on a TollWarden plan (pro: $4.99/30d at $0.005/scan; scale: $19.99/30d at $0.002/scan). This endpoint is itself x402-paid at the plan's price: without an x402-paying transport the response is the 402 payment challenge to settle. Renewal extends from the current expiry.

Input parameters:

- `plan` (string, required)

### `verify_verdict_attestation` (~242 tokens)

LOCALLY verify a TollWarden scan's Ed25519 attestation before trusting an allow-verdict: checks the signature against the pinned server key (fetched from /.well-known/tollwarden-verdict-key unless trusted_key_hex is supplied), recomputes the payment commitment from the payment YOU are about to settle (rejects attestations issued for a different payment — replay defense), and enforces expiry. Also verifies the attestation's signed evidence record when present and returns pin_evidence: how long the merchant pin had held at scan time (age 0 = first sighting) and which named out-of-band sources corroborated it (e.g. cdp_bazaar) — weigh a young or uncorroborated pin against the payment size; that decision boundary is yours. Runs no network calls except the one-time key fetch; the verdict itself is never sent anywhere.

Input parameters:

- `payment` (object, required): The payment you are about to settle — commitment is recomputed from this
- `scan` (object, required)
- `trusted_key_hex` (string): Pin the server verdict key (SPKI DER hex); fetched once when omitted

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/com-tollwarden-tollwarden/tollwarden#diagnostics

## Score history

- 2026-09-25: 77
- 2026-09-24: 77
- 2026-09-23: 76
- 2026-09-22: 61
- 2026-09-21: 64
- 2026-09-20: 64
- 2026-09-19: 64

## Common questions

### What is the TollWarden MCP server?

TollWarden is an MCP server listed in the public MCP registry as com.tollwarden/tollwarden. Screens x402 payments before settlement for injected payee addresses and sellers who never deliver. This page covers its npm package (tollwarden).

### Is the TollWarden MCP server safe to use?

TollWarden scores 77 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 25 September 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the TollWarden MCP server expose?

TollWarden exposes 12 tools: scan_outgoing_payment, scan_incoming_payment, check_counterparty_reputation, report_payment_outcome, report_counterparty, and 7 more. Their descriptions and schemas cost roughly 1,874 tokens of context every time the server is loaded.

### Is the TollWarden MCP server still maintained?

TollWarden is still listed as active in the MCP registry. We last reached this channel on 25 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What licence is the TollWarden MCP server under?

TollWarden declares the BUSL-1.1 licence, which is not on the OSI-approved list. Read the terms before using it at work, and note this covers the source only, not the cost of any service it calls.

## Links

- npm package: https://www.npmjs.com/package/tollwarden
- Socket report: https://socket.dev/npm/package/tollwarden
- Repository: https://github.com/tollwarden/tollwarden
- Website: https://tollwarden.com/
- Changelog RSS feed: https://verifymcp.io/servers/com-tollwarden-tollwarden/tollwarden.xml
- Changelog JSON feed: https://verifymcp.io/servers/com-tollwarden-tollwarden/tollwarden.json
- HTML version of this page: https://verifymcp.io/servers/com-tollwarden-tollwarden/tollwarden