{"_id":"@agentscore-xyz/x402-gate","_rev":"2-d3670b9dc5a3f55d091f955058f49987","name":"@agentscore-xyz/x402-gate","dist-tags":{"latest":"1.0.0"},"versions":{"1.0.0":{"name":"@agentscore-xyz/x402-gate","version":"1.0.0","keywords":["x402","trust","ai-agents","reputation","agentscore","middleware","micropayments","base","usdc"],"license":"MIT","_id":"@agentscore-xyz/x402-gate@1.0.0","maintainers":[{"name":"agentscore_zenmonster","email":"michaelo@januscompliance.co.uk"}],"homepage":"https://agentscores.xyz","bugs":{"url":"https://github.com/Thezenmonster/x402-gate/issues"},"dist":{"shasum":"d4361de97daedf58c9837e0fcf59fb6e4495fcc7","tarball":"https://registry.npmjs.org/@agentscore-xyz/x402-gate/-/x402-gate-1.0.0.tgz","fileCount":5,"integrity":"sha512-S6CrDNLCuTdtI6fEvAXs/4J32O33up1FsRiRB0MR9faMnutQah3GVjMIp6Ss13EQGY+mD/OJqiiqURXl3vo+Tg==","signatures":[{"sig":"MEUCIQCUi0SOT/j4ylLXlM0jyNg+StDdiVDLXXYsLtTWQknvdwIgGxVXO6yuun45f2/IBPzmiHNk7u05VfSE080TH2nl5z4=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":15750},"main":"index.js","types":"index.d.ts","engines":{"node":">=18"},"gitHead":"b285826ae5deb8e047405c5fa4f6e4c0c6adf7d8","_npmUser":{"name":"agentscore_zenmonster","email":"michaelo@januscompliance.co.uk"},"repository":{"url":"git+https://github.com/Thezenmonster/x402-gate.git","type":"git"},"_npmVersion":"10.9.3","description":"Trust-gate your x402 API. Check agent reputation before accepting payment.","directories":{},"_nodeVersion":"22.18.0","_hasShrinkwrap":false,"peerDependencies":{"next":">=13"},"peerDependenciesMeta":{"next":{"optional":true}},"_npmOperationalInternal":{"tmp":"tmp/x402-gate_1.0.0_1772897897640_0.41297145773450716","host":"s3://npm-registry-packages-npm-production"},"deprecated":"This package is deprecated. Use mcp-trust-guard for MCP server security instead: https://www.npmjs.com/package/mcp-trust-guard"}},"time":{"created":"2026-03-07T15:38:17.541Z","modified":"2026-03-27T03:29:44.429Z","1.0.0":"2026-03-07T15:38:17.790Z"},"bugs":{"url":"https://github.com/Thezenmonster/x402-gate/issues"},"license":"MIT","homepage":"https://agentscores.xyz","keywords":["x402","trust","ai-agents","reputation","agentscore","middleware","micropayments","base","usdc"],"repository":{"url":"git+https://github.com/Thezenmonster/x402-gate.git","type":"git"},"description":"Trust-gate your x402 API. Check agent reputation before accepting payment.","maintainers":[{"name":"agentscore_zenmonster","email":"michaelo@januscompliance.co.uk"}],"readme":"# @agentscore/x402-gate\r\n\r\n**Trust-gate your x402 API.** Check an AI agent's reputation before accepting payment.\r\n\r\nYour x402 API accepts payment from anyone. That's a problem. A scammer agent, a flagged bot, an agent with zero history — they all get the same access as a trusted agent with 50K karma.\r\n\r\nThis middleware fixes that. **3 lines of code.**\r\n\r\n## Quick Start\r\n\r\n```bash\r\nnpm install @agentscore/x402-gate\r\n```\r\n\r\n### Next.js\r\n\r\n```js\r\nimport { withTrustGate } from \"@agentscore/x402-gate\";\r\n\r\nasync function handler(request) {\r\n  return Response.json({ data: \"your API response\" });\r\n}\r\n\r\n// Reject agents with trust score below 40\r\nexport const GET = withTrustGate(handler, { minScore: 40 });\r\n```\r\n\r\n### Express\r\n\r\n```js\r\nconst { trustGateMiddleware } = require(\"@agentscore/x402-gate\");\r\n\r\napp.use(\"/api/paid\", trustGateMiddleware({ minScore: 40 }));\r\n```\r\n\r\nThat's it. Agents with low trust scores get blocked before they can pay.\r\n\r\n## How It Works\r\n\r\n1. Agent calls your API with `X-Agent-Name: AgentName` header\r\n2. Middleware checks the agent's trust score via [AgentScore](https://agentscores.xyz)\r\n3. Score below your threshold? → **403 rejected** (or warned, or surchanged)\r\n4. Score above? → Request passes through with trust headers attached\r\n\r\nTrust scores are cached for 5 minutes. Your API stays fast.\r\n\r\n## Modes\r\n\r\n### Block (default)\r\nReject low-trust agents outright.\r\n\r\n```js\r\nwithTrustGate(handler, { minScore: 40, action: \"block\" });\r\n```\r\n\r\nResponse when blocked:\r\n```json\r\n{\r\n  \"error\": \"trust_insufficient\",\r\n  \"message\": \"Agent \\\"SketchyBot\\\" scored 12/100 (LOW). Minimum required: 40.\",\r\n  \"score\": 12,\r\n  \"grade\": \"LOW\",\r\n  \"required\": 40,\r\n  \"improve\": \"https://agentscores.xyz\"\r\n}\r\n```\r\n\r\n### Warn\r\nServe the response but attach warning headers. Let the caller know they're on thin ice.\r\n\r\n```js\r\nwithTrustGate(handler, { minScore: 40, action: \"warn\" });\r\n```\r\n\r\nResponse headers:\r\n```\r\nX-AgentScore: 12\r\nX-AgentScore-Grade: LOW\r\nX-AgentScore-Action: warning\r\nX-AgentScore-Warning: Agent scored 12/100. Minimum recommended: 40.\r\n```\r\n\r\n### Surcharge\r\nCharge more for low-trust agents. Higher risk = higher price.\r\n\r\n```js\r\nwithTrustGate(handler, {\r\n  minScore: 40,\r\n  action: \"surcharge\",\r\n  surchargeMultiplier: 3,  // 3x price for untrusted agents\r\n});\r\n```\r\n\r\nResponse headers include `X-AgentScore-Surcharge: 3` for your payment layer to read.\r\n\r\n## Options\r\n\r\n| Option | Type | Default | Description |\r\n|--------|------|---------|-------------|\r\n| `minScore` | `number` | `0` | Minimum trust score (0-100) |\r\n| `action` | `\"block\" \\| \"warn\" \\| \"surcharge\"` | `\"block\"` | What to do below threshold |\r\n| `surchargeMultiplier` | `number` | `2` | Price multiplier (surcharge mode) |\r\n| `allowUnknown` | `boolean` | `true` | Allow agents with no score data |\r\n| `apiUrl` | `string` | `https://agentscores.xyz/api/score` | AgentScore API endpoint |\r\n| `cacheTtl` | `number` | `300000` | Cache TTL in ms (5 min default) |\r\n\r\n## Response Headers\r\n\r\nEvery gated response includes:\r\n\r\n| Header | Value | Description |\r\n|--------|-------|-------------|\r\n| `X-AgentScore` | `0-100` or `unknown` | The agent's trust score |\r\n| `X-AgentScore-Grade` | `CRITICAL` / `LOW` / `MODERATE` / `HIGH` / `EXCELLENT` | Trust grade |\r\n| `X-AgentScore-Action` | `trusted` / `warning` / `blocked` / `surcharge` | Action taken |\r\n\r\n## Agent Identity\r\n\r\nThe middleware identifies agents via:\r\n\r\n1. `X-Agent-Name` request header (recommended)\r\n2. `x-agent-name` query parameter (fallback)\r\n\r\nNo header = no gate check (human users pass through).\r\n\r\n## Trust Score Dimensions\r\n\r\nAgentScore checks 5 dimensions (0-20 each, 100 total):\r\n\r\n- **Identity** — Moltbook registration, verification, account age\r\n- **Activity** — Post volume, engagement, recency\r\n- **Reputation** — Karma score, follower count, on-chain feedback\r\n- **Work History** — Tasks completed, success rate\r\n- **Consistency** — Cross-platform presence, profile completeness\r\n\r\nScores are aggregated from Moltbook, ERC-8004, ClawTasks, and Moltverr.\r\n\r\n## Use with x402\r\n\r\nCombine with `@x402/next` for payment + trust gating:\r\n\r\n```js\r\nimport { withX402 } from \"@x402/next\";\r\nimport { withTrustGate } from \"@agentscore/x402-gate\";\r\n\r\nasync function handler(request) {\r\n  return Response.json({ result: \"premium data\" });\r\n}\r\n\r\n// Trust gate first, then payment gate\r\nexport const GET = withTrustGate(\r\n  withX402(handler, { price: \"$0.05\", network: \"base\" }),\r\n  { minScore: 30 }\r\n);\r\n```\r\n\r\nNow your API only accepts payment from agents that have earned trust.\r\n\r\n## Links\r\n\r\n- [AgentScore](https://agentscores.xyz) — Check any agent's trust score\r\n- [API Docs](https://agentscores.xyz/docs) — Full API documentation\r\n- [Agent Manifest](https://agentscores.xyz/.well-known/agent.json) — Machine-readable API spec\r\n- [x402 Protocol](https://x402.org) — HTTP micropayment standard\r\n\r\n## License\r\n\r\nMIT\r\n","readmeFilename":"README.md"}