@agentgate-builder/payguard

PayGuard

OFAC SDN sanctions screening for crypto addresses, for AI agents and payment flows, paid per call over x402. One call reports whether an address appears in the US Treasury OFAC Specially Designated Nationals (SDN) list, and if so which entity, which sanctions programs and since when.

• Live API: https://payguard.agentgate.workers.dev (also https://api.youraitools.co/payguard)
• Price: $0.001 USDC per address (/v1/address), $0.01 USDC per batch of up to 50 (/v1/batch), on Base (eip155:8453). Invalid input is never charged.
• Free tier: /v1/preview (sanctioned true/false + chain guess) and a remote MCP server at /mcp (10 calls/min per IP).
• Local MCP (stdio, offline, bundled list): npx -y @agentgate-builder/payguard
• Source: https://agentgate-source.pages.dev/x402-payguard/ (MIT) · npm: @agentgate-builder/payguard · all our tools: https://youraitools.co/built-by-us

Informational screening against public OFAC SDN data. Not legal advice and not a compliance program.

Why

Agents are starting to send money: x402 payments, payouts, refunds, bounties. Paying an address that OFAC has designated is the one mistake that is both easy to check and expensive to get wrong. OFAC publishes the addresses it designates ("Digital Currency Address - ETH / XBT / TRX / USDT ..." identifiers in the SDN list); PayGuard turns that file into a fast exact-match lookup with the context a human reviewer needs.

Quick start

# Free preview (the sample is a Lazarus Group address from the SDN list; the second is the USDC contract on Base)
curl -s "https://payguard.agentgate.workers.dev/v1/preview?address=0x098B716B8Aaf21512996dC57EB0615e2383E2f96"
curl -s "https://payguard.agentgate.workers.dev/v1/preview?address=0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913"

# Paid: answers 402 with x402 terms; any x402 client pays it
curl -i "https://payguard.agentgate.workers.dev/v1/address?address=0x098B716B8Aaf21512996dC57EB0615e2383E2f96"

import { wrapFetchWithPaymentFromConfig } from '@x402/fetch';
import { ExactEvmScheme } from '@x402/evm';
import { privateKeyToAccount } from 'viem/accounts';

const pay = wrapFetchWithPaymentFromConfig(fetch, {
  schemes: [{ network: 'eip155:8453', client: new ExactEvmScheme(privateKeyToAccount(process.env.BUYER_KEY)) }],
});
const r = await (await pay('https://payguard.agentgate.workers.dev/v1/address?address=' + encodeURIComponent(recipient))).json();
if (r.sanctioned) holdForReview(recipient, r.matches);

Response (GET /v1/address)

{
  "address": "0x098b716b8aaf21512996dc57eb0615e2383e2f96",
  "sanctioned": true,
  "match_count": 1,
  "matches": [{ "entity": "LAZARUS GROUP", "entity_type": "Entity", "sdn_uid": 27307, "programs": ["DPRK3"],
                "list_date": "2019-09-13", "listed_currency": "ETH", "listed_as": "Digital Currency Address - ETH" }],
  "chain": { "format": "evm-hex20", "guess": "evm", "checksum": "eip55", "checksum_valid": true, "checksum_address": "0x098B716B8Aaf21512996dC57EB0615e2383E2f96" },
  "source": "US Treasury OFAC Specially Designated Nationals (SDN) list",
  "source_url": "https://sanctionslistservice.ofac.treas.gov/api/PublicationPreview/exports/SDN.XML",
  "list_updated_at": "2026-10-21",
  "list_age_days": 0,
  "sdn_address_count": 1050,
  "disclaimer": "Informational screening against the public OFAC SDN list ... Not legal advice. ..."
}

POST /v1/batch {"addresses": [...]} (1-50) returns count, sanctioned_count, any_sanctioned and one result per address.

MCP

{ "mcpServers": { "payguard": { "type": "http", "url": "https://payguard.agentgate.workers.dev/mcp" } } }
{ "mcpServers": { "payguard": { "command": "npx", "args": ["-y", "@agentgate-builder/payguard"] } } }

Tool screen_address (remote: preview tier). The stdio server also has screen_addresses (batch) and returns full results offline from the list snapshot bundled in the package version you installed (see list_updated_at; the hosted API is refreshed daily).

Library

import { screenAddress } from '@agentgate-builder/payguard';
screenAddress('0x098B716B8Aaf21512996dC57EB0615e2383E2f96').sanctioned; // true

Data and matching

• Source: the official SDN files from sanctionslistservice.ofac.treas.gov (SDN.XML for names, programs and every Digital Currency Address - XXX id; SDN_ADVANCED.XML for the date each entry was added). No third-party mirrors.
• scripts/build-sdn.py builds src/data/sdn.js; scripts/refresh.sh runs daily, and redeploys only when the list changed (with a guard against truncated downloads).
• Exact match. 0x EVM hex and bech32 / cashaddr addresses are case-insensitive; base58 formats (BTC legacy, TRX, SOL, LTC, XMR ...) are matched exactly. ethereum: / bitcoin: style URI prefixes are stripped.
• Chain guess and checksum: EIP-55, base58check (BTC, LTC, DOGE, DASH, BTG, TRX, ZEC), bech32 / bech32m, cashaddr, XRP; Solana and Monero are recognised by format.

Honest limits

• Only addresses OFAC publishes are matched. A clear result does not mean an address or its owner is unsanctioned: sanctions also cover persons and property that OFAC does not list by address, and funds can be one hop away.
• No EU / UK / UN lists and no on-chain exposure analysis.
• Inputs are looked up in memory and not stored or logged.

Routes

Route	Price
GET|POST /v1/address	$0.001	full screening result
POST /v1/batch	$0.01	up to 50 addresses
GET|POST /v1/preview	free, 10/min/IP	sanctioned true/false + chain guess
POST /mcp	free, 10/min/IP	remote MCP, screen_address
GET /v1/list, /v1/stats, /health	free	list date and counts, usage counters
GET /openapi.json, /.well-known/x402	free	discovery

x402 v2 (PAYMENT-SIGNATURE) and v1 (X-PAYMENT) clients both work; only HTTP 200 responses are settled.

Develop

npm install
npm test                    # engine (real bundled list), x402 v2 + v1, proxy, CDP facilitator switch, MCP
npm run build:sdn           # rebuild the list from Treasury
node scripts/injectscan-listing.mjs   # listing text through InjectScan's rules
npx wrangler deploy

MIT licensed.