18M+
x402 payments audited on-chain. Payer, payee, amount and timing are public for every one.
Deep First Search ·
Safe rails for the agent economy.
AI agents are starting to pay for things, and anyone can talk them into paying the wrong party. We keep every payment inside limits you signed, and expose less of your business.
Live on Base · beta · npx @deepfirstsearch/agent-pay demo
The problem
Your agent reads untrusted content all day, and it can move money. One poisoned page is enough to make it pay the wrong party. And every payment it makes is public: who, how much, when. Attackers read your balance. Competitors read your suppliers.
$150K+
drained from one AI agent's wallet by a single prompt injection. The same trick worked again a year later.
77%
of employees paste company data into AI tools that keep logs.
Exposure control
What third parties can link to you today.
Same payment.
Less to link.
Each merchant sees a fresh payer with no history, and what your agent bought is shared with that merchant only, never with facilitators or the chain. Amounts and payees remain on-chain. Funding payers through a regulated exchange breaks the public link to you, while you can still prove any payment to an auditor.
x402 · payment
LINKABLE
The product
Three layers. One SDK.
01
Agent Safe
An on-chain vault that assumes your agent will be tricked. You sign a budget per merchant; the agent's key can spend inside it and never widen it. Revoke or pause instantly.
- Per-merchant budgets enforced on-chain
- Increases need your signature and a timelock
- You can always withdraw, even while paused
02
Policy gate
An x402 client that treats every payment request as hostile. Payee, asset, network and price must match what you approved before anything is signed. The model proposes; code decides.
- Pinned USDC, networks and prices
- Plans sealed before reading untrusted content
- Sanctions screening that fails closed
03
Exposure control
Expose less of your business. Each merchant sees its own payer, nothing extra leaves your machine, and payers can be funded through a regulated exchange so the public can't trace them back to you.
- A fresh payer address per merchant
- Exchange-funded payers via an owner-side service
- A tamper-evident log to prove any payment
Built to survive
Discreet. Never hidden from the law.
Non-custodial
We never hold funds or run relayers. Immutable contracts with no admin keys, open source.
Records you control
A tamper-evident payment log lets owners prove any payment to an auditor or tax authority, on their terms. Sanctioned addresses are screened before any payment.
A transparent token
Privacy lives in the app, not in the token. stays exchange-listable after EU AMLR 2027.
No single secret
No master key, no admin, no upgrade path. Enclaves are defense in depth, never the only lock.
Shipped, not promised
Real money. Real agents. Real limits.
3 / 3
Payments on Base mainnet
Real x402 payments through an owner-signed budget, reconciled to the cent, no double charge. See the transaction.
Claude
Paid for data on its own
A real Claude session with our MCP server bought a price index, then refused an API that asked to pay a different wallet, and explained why. Watch it.
4 → 0
Attacks in, signatures out
A swapped payee, a price hike, an injected merchant and a budget overrun: refused before anything is signed. Try it offline: npx @deepfirstsearch/agent-pay demo.
260+
Tests, two internal reviews
Fuzzing, invariants and a Base mainnet fork with real USDC on the contracts; attack regressions on the SDK. Unaudited beta: small amounts while the independent review runs.
Works with your stack
Minutes to integrate. Nothing to give up.
Claude, Cursor, any MCP client
npx @deepfirstsearch/agent-pay-mcp. Listed in the official MCP registry and on Glama. The model gets paid_fetch, never a payee or a limit.
Vercel AI SDK and LangChain
One tool for generateText, one for LangGraph. Refusals come back as data, so the agent can explain them.
Your wallet, unchanged
Any viem-compatible signer can pay: a local key, an embedded or server wallet, a KMS. During an attack it isn't even asked to sign.
Budgets from the command line
npx @deepfirstsearch/agent-pay owner budget … signs a per-merchant budget on Base. Pause and revoke are instant.
1,000,000,000
total supply, minted once
Tokenomics
A supply that only goes down.
One billion , minted once at genesis. The contract has no mint function at all, so the number can only shrink.
View as table
| Allocation | Share | Terms |
|---|
Usage burns supply
Fees fill the jar. Burning empties it.
Agent Safe
0.1% fee in USDC
Fee jar
50% of fees, immutable
Anyone
burns to claim the jar
Burned
supply goes down
No swaps, no oracle, no admin. The price to claim the jar doubles after every claim and halves every three days. Only Agent Safe, SDK and inference fees feed the jar. No transfer taxes, no reflections, no hidden market-maker deals.
0%
to venture capital
0
new tokens, ever
0%
of fees to the burn jar
0y
founder lock, on-chain
No token until there is revenue to burn.
Roadmap
Product first. Token last.
-
Phase 0 · Done
Research
Market pain, 30+ launches and failures studied, legal and security assessments, tokenomics.
-
Phase 1 · Done
SDK, integrations, testnet
x402 client with a policy engine outside the model, Agent Safe vaults, per-merchant payers, an owner CLI, an MCP server (official MCP registry), Vercel AI SDK and LangChain tools. Verified on Base Sepolia.
-
Phase 2 · Now
Mainnet beta on Base
Live since October 6, 2026, with the first real payments settled (unaudited, small amounts, verified factory). Next: design partners and wallet integrations, an independent review, then the public launch.
-
Phase 3
Fair launch
Wallet-only airdrop to real users, one-price public auction, liquidity burned, no mint function at all.
-
Phase 4
Deeper privacy
Integration with a compliant, third-party privacy pool. Later: private inference paid through the same rails.
Your agent will be tricked.
Make sure it can't spend.
npx @deepfirstsearch/agent-pay demo