Deep First Search

An independent security review of our SDK found 9 issues. We fixed all 9 — each with a regression test. Get reviewed, fix what's found, show the work. Thanks to Guido Dipietro for the review. On-chain contracts audit next. deepfirstsearch.com

Your AI agent pays over x402. Does its client check WHO it's paying? Unguarded, the base client signs to any payee, any price, any network. Scan yours free with x402-scan — the fix is a policy layer. deepfirstsearch.com/x402-sca…

Your AI agent pays over x402. Does its client check WHO it's paying? Unguarded, the base client signs to any payee, any price, any network. Scan yours free with x402-scan — the fix is a policy layer. deepfirstsearch.com/x402-sca…

Keep your wallet. Agent Safe checks payee, price and budget before Turnkey, Privy, Coinbase CDP or Openfort is asked to sign, and its payers never sign transactions. Open source on npm.

Proof of concept: a Safe gives an AI agent an x402 budget through Zodiac Roles. The role allows only USDC.transfer to the owner's payer addresses within a daily allowance. Attacker payee, over the cap, approve and delegatecall are refused on-chain, on a Base fork.

For x402 sellers: a guarded buyer doesn't have to erase your attribution. agent-pay 0.9.0 echoes only the extensions the owner allows, so your Base Builder Code (ERC-8021) reaches settlement. Payee, amount, asset and network never change.

Some x402 sellers hand out a new payTo on every 402. With a pinned payee, every one is refused (payee_mismatch) and nothing is signed. Honest limit: those sellers can't be paid this way yet. What the owner could pin instead is an open design question.

The seller writes the 402, including the URL it claims to be. Agent Safe pins the payee to the origin your agent actually contacted. A different declared origin goes to the audit log as declaredOrigin and is never used to decide.

New in agent-pay 0.10.0: dryRun. Point it at a seller and get the policy's verdict with no key and nothing signed: allow, deny with a code (payee_mismatch, over_cap, unknown_merchant), or no_challenge. Audit sellers before any key exists.

No receipt came back. Does your agent pay again? With Agent Safe it resends the same proof while it's valid, then asks USDC whether it was used. Used means paid, not delivered: report it, never re-sign. One authorization, never a second.

Not a mockup. An Agent Safe on Base Sepolia paid a real x402 endpoint, settled by the public facilitator, inside limits its owner signed. 57 contract tests, 5 against a Base mainnet fork, 50 SDK tests. Open source, MIT. deepfirstsearch.com

A leaked agent key can spend inside the budget you signed. It can never widen it. A stolen owner session can propose a bigger budget, but it waits out a timelock, and you can revoke it instantly. On-chain, on Base.