Is this a penetration test?

It is a scoped security review of the agent payment path, with prompt-injection tests where agreed. It is not a full red-team engagement.

No. We do not ask for keys or seed phrases.

A written report with severity, file/line or flow evidence, fixes, and one retest.

Draft v0.1 · open spec · no custody

Agent wallet security review

Agent wallet security review: keys, limits, allowlist, approval, kill switch, audit log, tool-output trust, MCP inventory, x402 flow and incident plan. $2,500, no custody.

Request a free scan Read the spec

Written scope and written report — no calls. No wallet access for the first scan.

Ten checks before the agent touches money

Keys and hot wallets outside prompts/config
Per-transaction and daily limits
Recipient/asset/network allowlist
Human approval above a threshold
Kill switch that stops the signer
Append-only audit log / receipts
Tool output treated as untrusted data
MCP servers and packages inventoried
x402 price/payee/replay/receipt checks
Incident plan: revoke, rotate, recover

Review

Agent Wallet Security Review: $2,500. Threat model, live prompt-injection tests, wallet permissions, limits, kill switch, x402 flow, report and retest. No custody.

Request a review

Why this is not a scanner report

A static scan is the first 30 minutes. The review reads the actual payment path, tests the prompts that can move money, and retests the fixes. If no finding is verified, the report says so.