crewai-tollwarden

TollWarden payment security for CrewAI agents — crews inherit "scan before you pay" by default.

pip install crewai-tollwarden

Two additions

from crewai import Agent
from tollwarden import TollWardenClient
from crewai_tollwarden import tollwarden_tools, register_tollwarden_provenance

tollwarden = TollWardenClient(agent_id="my-agent")   # free API key auto-minted (100 free scans)
register_tollwarden_provenance(tollwarden)           # ← the important line (call once at startup)

agent = Agent(
    role="Purchasing agent",
    goal="Buy data over x402 safely",
    tools=tollwarden_tools(tollwarden),
    # ...
)

Every x402 payment the agent scans gets an allow / flag / block verdict with machine-readable reasons: prompt-injection-triggered payments, replayed nonces, overpayment vs the quote, secrets/PII leaking in payment metadata, lookalike-token contracts, address poisoning, counterparty reputation.

Why the provenance registration is the important line

TollWarden's strongest detector catches payments whose decision came from content the agent just read — a prompt-injected page or tool result that says "send payment to 0x…". That check needs to know what the agent read. register_tollwarden_provenance installs a CrewAI after-tool-call hook that observes every tool output automatically, so the very next scan is provenance-tagged and the injection check runs with real input. No prompt engineering, no developer learning what "provenance" means. (TollWarden's own tool outputs are excluded, so verdicts never pollute the signal.) CrewAI's tool-call hooks are process-global — call it once at startup.

Enforcement: payments that can't execute when blocked

Tools rely on the model choosing to scan. guarded_payment doesn't:

from crewai.tools import BaseTool
from crewai_tollwarden import guarded_payment

safe_pay = guarded_payment(execute_x402_payment, tollwarden)   # strict=True to refuse flags too
# build your payment tool's _run from safe_pay — on a block verdict it raises
# TollWardenBlockedError BEFORE execute_x402_payment is ever invoked.

For wallet-level enforcement (the signer itself refuses unscanned payments), see TollWardenEnforcer in the tollwarden SDK.

The toolset

Verdicts are Ed25519-signed and payment-bound; the underlying client verifies them against a pinned key automatically.

MIT. TollWarden is advisory and non-custodial: it never touches keys, wallets, or funds.