
Research
/Security News
Popular npm Packages in the keyv and Cacheable Namespaces Compromised in Active Supply Chain Attack
Popular npm packages keyv and cacheable compromised.
twzrd-agent-intel
Advanced tools
Pre-spend x402 counterparty reputation from observed behavior, with free preflight, signed V6 receipts, and a 24-tool MCP.
The trust + receipt layer that Solana agents call before and after paying over x402.
Before an autonomous agent pays a stranger's API, it should answer: what am I
buying, should I pay this seller, and what proof will I get? twzrd-agent-intel
answers that. Free resource join inventorizes callables; free preflight
returns allow/warn/block on the seller; a paid trust endpoint returns a portable,
offline-verifiable signed v6 receipt. Live on Solana mainnet.
TWZRD is a buyer-side reputation rail at the payment boundary. Services come from
bazaar / resource-join discovery first; settlement trust then enriches the
pay_to wallet when it appears in the Solana x402 corpus. The settlement graph is
not a service catalog. Corpus wallets are ecosystem observations — not TWZRD
customers, usage, or revenue. Read live counts from
/health and
get_top_intel_agents?limit=1
instead of frozen README snapshots.
Core product is the buyer gate: free ReadinessCard + wash refusal on the
merchant (payTo) before spend. Optional on npm twzrd-x402-gate@0.8.4
(canonical: installTwzrdAutoGate, also "mpp"):
resource-server createTwzrdSettleGuard / twzrdPayerScreen for merchant policy on
the payer before settle+serve (abuse/sanctions/bots) — not an equal mirror of the buyer
problem; wash resistance is mainly TWZRD scoring. Facilitator operators use
@wzrd_sol/plugin-trustgate/facilitator createOnBeforeSettleHook to screen the
merchant on brokered settle.
Resource → seller → preflight (discover callables, then score the payee):
# 1) resource join SOT — listed | live_402 claims; settlement overlay separate
curl -s "https://intel.twzrd.xyz/v1/intel/resources?limit=5" | jq '.honesty, .stats, .resources[0].url'
# 2) multi-bazaar overlay (optional; Base/Polygon wash often unknown)
# curl -s "https://intel.twzrd.xyz/v1/intel/x402-directory?limit=20"
# 3) free merchant graph card (refuse if wash_flagged)
curl -s "https://intel.twzrd.xyz/v1/intel/merchant_card/X4o2D8op42a2jcNJJVZcDq3eYivh1oR9XiezPWCXosZ"
# 4) free preflight on the 402 payTo
curl -s -X POST https://intel.twzrd.xyz/v1/intel/preflight \
-H "Content-Type: application/json" \
-d '{
"seller_wallet": "X4o2D8op42a2jcNJJVZcDq3eYivh1oR9XiezPWCXosZ",
"agent_intent": "swap_quote"
}'
# decision = allow | warn | block → abort on block
# 5) optional paid teaser ($0.001) or full trust receipt ($0.05)
# GET https://intel.twzrd.xyz/v1/intel/quick/{pubkey}
# GET https://intel.twzrd.xyz/v1/intel/trust/{pubkey}
# 6) verify any returned V6 receipt (or the sample first)
curl -s https://intel.twzrd.xyz/v1/receipts/example > /tmp/ex.json
curl -s -X POST https://intel.twzrd.xyz/v1/receipts/verify \
-H 'content-type: application/json' -d @/tmp/ex.json
One-command operator dogfood (logs day0 deltas):
python packages/twzrd-agent-intel/scripts/seller_first_flywheel_dogfood.py
Returns a ReadinessCard with decision (allow / warn / block), trust_score,
can_spend, caveats, and the path to the paid deep-dive receipt.
pip install -U twzrd-agent-intel==0.5.4
Add to your MCP config and restart. The remote server runs the live large cross-facilitator corpus — no env vars, no local server, no configuration:
{
"mcpServers": {
"twzrd-agent-intel": {
"type": "streamable-http",
"url": "https://intel.twzrd.xyz/mcp"
}
}
}
After restart your agent sees 24 tools (watch + seller signals + no-spend gate proof live). The most useful one to call first:
get_readiness_card_tool(seller_wallet="6EF8rrecthR5Dkzon8Nwu78hRvfCKubJ14M5uBEwF6P")
That's the full install. No database, no keypair, no USDC needed for the free tools.
Free discovery + preflight (no payment, no auth):
GET /v1/intel/resources — resource join inventoryget_x402_directory — multi-bazaar overlay by payTo (prefer HTTP /resources for join SOT)evaluate_x402_resource — fetch a resource's 402, extract payTo, and run preflightget_readiness_card_tool — primary ReadinessCardlow_level_preflight — lower-level preflight + spend recommendationscore_wallet_for_intel — wallet intel scoreget_top_intel_agents — secondary payer-wallet leaderboard research only (not a service catalog)Free corpus reputation + receipts:
get_provider_reputation — observed corpus reputation for a seller/merchant walletget_merchant_card — observed receive-side graph card (GET /v1/intel/merchant_card/{wallet})is_wash_fleet — circular-flow / wash-fleet check on a walletget_facilitator_footprint — which x402 facilitators a payer settled throughget_counterparties — capped teaser: top merchants a wallet pays (limit ≤ 25)score_wallets_batch — score up to 25 wallets in one callcompare_wallets — side-by-side intel for two walletsverify_receipt — offline v5/v6 receipt verification (recompute leaf + check Ed25519 sig)verify_root_inputs — recompute published leaves and server root inputs; this does not read an on-chain anchortwzrd_demo_gate — deterministic no-spend proof; block aborts before signer, attribution remains a candidateSolana market intel (free over MCP; $0.03 USDC each over HTTP x402):
get_solana_market_visibility_mapget_solana_market_orderbook_depthget_solana_market_shapeget_solana_market_onchain_trades_summaryget_solana_market_statusFree re-call watches:
twzrd_watch_addtwzrd_watch_listtwzrd_watch_removeThe paid trust receipt (GET /v1/intel/trust/{pubkey}, 0.05 USDC over x402) is also
available over HTTP with a portable signed v6 receipt you can verify offline.
After the free gate — paying a third-party x402 seller: see
docs/PAYABLE_CLIENT_PATH.md (feePayer-sponsored
Solana: use @x402/svm, not AgentCash; pin stable feePayer — per-request
feePayer pools make retries a lottery; see 2s-io/sdk#3).
# Free resource join SOT
curl -s "https://intel.twzrd.xyz/v1/intel/resources?limit=20"
# Free preflight (no payment required)
curl -s -X POST https://intel.twzrd.xyz/v1/intel/preflight \
-H "Content-Type: application/json" \
-d '{"seller_wallet": "<pubkey>", "agent_intent": "swap_quote"}'
# Paid trust receipt (0.05 USDC over x402 — use an x402-capable client)
curl -s https://intel.twzrd.xyz/v1/intel/trust/<pubkey>
# → 402 with x402 v2 payment-required if payment-signature is absent
# Free sample receipt for offline verify testing
curl -s https://intel.twzrd.xyz/v1/receipts/example
Note: Running
twzrd-agent-intel-mcplocally serves from a small static research registry by default — not the live large cross-facilitator corpus. Use the remote MCP above for real data. Self-host only if you need to run behind a firewall or extend the server.
# Local MCP stdio (static demo data by default)
twzrd-agent-intel-mcp
# Local HTTP server
uvicorn twzrd_agent_intel.server_http:app --port 8001
Point a self-hosted instance at live data with environment variables:
TWZRD_SIGNAL_SOURCE | What it does |
|---|---|
artifacts | Aggregate your own settlement volume from TWZRD_ARTIFACTS_DIR |
bazaar | Pull the live cross-facilitator x402 catalog (CDP Bazaar) |
score_version intel_renorm_v1) so
arbitrary wallets aren't penalized for lacking TWZRD-native execution history./v1/receipts/verify without trusting our server.npx twzrd-receipt-verifier@1.2.2 receipt.json --pubkey <published-key>
clawhub install twzrd-trust
MIT
FAQs
Pre-spend x402 counterparty reputation from observed behavior, with free preflight, signed V6 receipts, and a 24-tool MCP.
We found that twzrd-agent-intel demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Popular npm packages keyv and cacheable compromised.

Security News
A misconfiguration gave three Anthropic models internet access, and one, believing it was in a simulation, shipped a credential-stealing package to PyPI.

Security News
/Company News
Socket has joined the new Composer and Packagist sponsorship program as a launch sponsor, supporting the team that keeps PHP's package ecosystem secure.