crewai-sra-riskgate

SRA-RiskGate for CrewAI: check a USDC payment before an agent sends it, and gate the tool that moves money so a held or rejected payment is never sent.

pip install crewai-sra-riskgate

Gate the transfer tool (recommended)

Wrap the tool that actually sends money. Every call is checked first; only approve lets it run.

from crewai import Agent
from crewai_sra_riskgate import risk_gated

safe_send = risk_gated(
    send_usdc_tool,                       # your existing CrewAI tool that sends USDC
    to_payment=lambda a: {                # map its arguments to the payment being made
        "chain_id": 8453, "sender": MY_WALLET,
        "recipient": a["to"], "amount_usdc": a["amount"],
        "untrusted_text": a.get("memo"),  # the invoice or memo text exactly as received
    },
    max_amount=500,
    known_recipients=MY_VERIFIED_PAYEES,  # a payee not on this list is held
    blocked_addresses=MY_BLOCKLIST,
)

treasurer = Agent(role="Treasurer", goal="Pay approved invoices", backstory="...", tools=[safe_send])

Give the agent only the wrapped tool, never the original. Held and rejected payments return a message saying so, starting with HELD or BLOCKED, and the original tool is not called.

Or give the agent a check tool

from crewai_sra_riskgate import SRARiskGateTool

checker = SRARiskGateTool(max_amount=500, known_recipients=MY_VERIFIED_PAYEES)
treasurer = Agent(role="Treasurer", goal="...", backstory="...", tools=[checker, send_usdc_tool])

The agent calls check_stablecoin_payment before paying and gets approve, hold or reject with reasons. This is advisory: an agent that ignores a hold could still call the transfer tool, so prefer risk_gated wherever you control the payment path.

What is checked

The sra-riskgate rules: an offline match against OFAC's published SDN crypto addresses (a dated snapshot, not a screening service), your blocklist, a hold on the first payment to a payee you have not verified, address and amount validation, a per-payment limit, USDC depeg if you pass peg_deviation_pct, and payment text that vouches for itself ("pre-approved", "risk level: low (verified offline)"). Every error is a hold.

Known payees and the blocklist come only from your code, never from the agent's arguments or the payment's text, so an agent whose input was tampered with cannot mark an attacker's address as known.

Related

• SDK and model: sra-riskgate, SRA-RiskGate-4B
• Also for LangChain, MCP and GitHub Actions

License

Apache-2.0