block / review / clear before your agent signs.
Warden is the pre-execution security layer for agents transacting on Base. Give it a token, a pending transaction or an address — a live sell simulation, owner powers, drain approvals, address poisoning, sanctions, liquidity and holder concentration collapse into a single decision. Deterministic rules over on-chain data; no LLM in the decision path.
Live demo — token · address · transaction
Deterministic decisions
The decision and risk score come from fixed rules over on-chain data — no LLM decides whether money moves. Same input, same verdict. Fully auditable.
Fails safe
If a security signal can't be fetched, it never returns a false 'clear' — it degrades to 'review' at worst.
Provable track record
Every verdict is snapshotted and its outcome re-measured. We show, in numbers, the rugs we flagged before they rugged.
For agents — API & MCP
# token guard
curl "https://warden402.xyz/api/guard?type=token&address=0x..."
# pre-sign (pending transaction)
curl -X POST https://warden402.xyz/api/guard \
-H "content-type: application/json" \
-d '{"type":"tx","from":"0x..","to":"0x..","calldata":"0x.."}'{
"mcpServers": {
"warden402": {
"command": "npx",
"args": ["-y", "warden402-mcp"]
}
}
}Running a fleet of agents?
The Firewall puts spend caps, allow/deny, drain protection and a kill switch in front of every agent payment and transaction — every decision audited.
Frequently asked
+ − What is pre-execution security for an AI agent?
It is a check that runs before an agent signs anything. Warden takes the token, pending transaction or counterparty address the agent is about to touch, collects independent risk signals, and returns one of three answers — block, review or clear — with the reasons behind it. Nothing is signed until that answer comes back.
+ − How does Warden detect honeypot tokens and rug pulls on Base?
Seven signals per token: honeypot simulation, contract permissions (mint, blacklist, upgradeable proxy), holder concentration, liquidity and LP lock status, deployer reputation, sanctions screening and trading history. Any single hard failure escalates the verdict to at least review, so a token never comes back clear on partial evidence.
+ − What stops an agent from approving an unlimited token allowance?
Warden decodes the calldata before signing — approve, increaseAllowance, Permit2 and EIP-2612 permit included — and flags any allowance at or above a practical-unlimited floor. An unlimited approval to a plain wallet (an address with no contract code) is blocked outright, and when an approval is too broad Warden returns an exact-amount alternative to sign instead. If the calldata cannot be decoded at all, the verdict degrades to review rather than falsely clearing.
+ − Does an LLM make the decision?
No. The decision, the risk score and the summary are fully deterministic — fixed rules over the collected on-chain signals, with no language model in the decision path. The same inputs always give the same verdict, so every outcome is reproducible and auditable.
+ − What happens if a risk signal is unavailable?
It never returns a false clear. A missing or failed signal is marked unknown, the response is flagged degraded, and the verdict falls back to review at worst. Fail-safe beats fail-silent when money is about to move.
+ − How do I add Warden to my agent?
Three ways, all free to start: the HTTP API at /api/guard, the warden402-mcp MCP server (npx -y warden402-mcp, no API key required), or the SDK (npm install warden402-sdk). Teams running fleets add the Firewall — spend caps, allow and deny lists, drain protection and a kill switch in front of every payment.