block / review / clear before your agent signs.
Warden is the pre-execution security layer for agents transacting on Base. Give it a token, a pending transaction or an address — and collapse honeypots, unlimited allowances, sanctions, liquidity and holder concentration into a single decision. Decisions are deterministic; the LLM only explains them.
Live demo — token · address · transaction
Deterministic decisions
The decision and risk score come from fixed rules. The LLM never touches the verdict — it only writes the plain-language rationale. Fully auditable.
Fails safe
If a security signal can't be fetched, it never returns a false 'clear' — it degrades to 'review' at worst.
Provable track record
Every verdict is snapshotted and its outcome re-measured. We show, in numbers, the rugs we flagged before they rugged.
For agents — API & MCP
# token guard
curl "https://warden402.xyz/api/guard?type=token&address=0x..."
# pre-sign (pending transaction)
curl -X POST https://warden402.xyz/api/guard \
-H "content-type: application/json" \
-d '{"type":"tx","from":"0x..","to":"0x..","calldata":"0x.."}'{
"mcpServers": {
"warden402": {
"command": "npx",
"args": ["-y", "warden402-mcp"]
}
}
}Running a fleet of agents?
The Firewall puts spend caps, allow/deny, drain protection and a kill switch in front of every agent payment and transaction — every decision audited.
Frequently asked
+ − What is pre-execution security for an AI agent?
It is a check that runs before an agent signs anything. Warden takes the token, pending transaction or counterparty address the agent is about to touch, collects independent risk signals, and returns one of three answers — block, review or clear — with the reasons behind it. Nothing is signed until that answer comes back.
+ − How does Warden detect honeypot tokens and rug pulls on Base?
Seven signals per token: honeypot simulation, contract permissions (mint, blacklist, upgradeable proxy), holder concentration, liquidity and LP lock status, deployer reputation, sanctions screening and trading history. Any single hard failure escalates the verdict to at least review, so a token never comes back clear on partial evidence.
+ − What stops an agent from approving an unlimited token allowance?
Warden decodes the calldata before signing — approve, increaseAllowance, Permit2 and EIP-2612 permit included — and flags any allowance at or above a practical-unlimited floor. If the calldata cannot be decoded at all, the verdict degrades to review rather than falsely clearing.
+ − Does an LLM make the decision?
No. The decision and the risk score are fully deterministic — fixed rules over the collected signals. The language model only writes the plain-language summary of a verdict that has already been decided, so every outcome is reproducible and auditable.
+ − What happens if a risk signal is unavailable?
It never returns a false clear. A missing or failed signal is marked unknown, the response is flagged degraded, and the verdict falls back to review at worst. Fail-safe beats fail-silent when money is about to move.
+ − How do I add Warden to my agent?
Three ways, all free to start: the HTTP API at /api/guard, the warden402-mcp MCP server (npx -y warden402-mcp, no API key required), or the SDK. Teams running fleets add the Firewall — spend caps, allow and deny lists, drain protection and a kill switch in front of every payment.