nemo-tollwarden

TollWarden payment security for the NVIDIA NeMo Agent Toolkit — screen every x402 payment before your workflow settles it.

pip install nemo-tollwarden

Installing registers three NeMo functions via the nat.plugins entry point. Add them to your workflow YAML:

functions:
  scan:
    _type: tollwarden_scan_payment
    agent_id: my-agent          # optional; labels scans (limits are scoped to your API key's account)
  reputation:
    _type: tollwarden_check_reputation
  report:
    _type: tollwarden_report_counterparty

A free API key (100 free scans) is auto-minted on first use — set api_key: to pin one. Verdicts come back allow / flag / block with machine-readable reasons: prompt-injection-triggered payments, replayed nonces, overpayment vs the quote, secrets/PII leaking in payment metadata, lookalike-token contracts, address poisoning, counterparty reputation.

Provenance: the strongest check

TollWarden's best detector catches payments whose decision came from content the agent just read — a prompt-injected page or tool result saying "send payment to 0x…". In NeMo, pass that text as the scan function's optional content argument:

tollwarden_scan_payment(payment={...}, direction="outgoing", content="<the page/tool text the agent just read>")

If the pay_to address appears in that content, the payment is blocked. (LangChain and CrewAI integrations auto-tag this via a callback; NeMo has no global tool-output hook, so it's an explicit parameter the agent — or your workflow — fills.)

Enforcement, so a blocked payment can't execute

The scan function returns a verdict, and a model can ignore it. guarded_payment wraps your workflow's payment executor so a block verdict raises TollWardenBlockedError before the executor is ever called. It takes a sync or an async executor, and with an async one it returns a coroutine function and runs the scan off the event loop.

from nemo_tollwarden import guarded_payment

safe_pay = guarded_payment(execute_x402_payment, tollwarden)  # strict=True refuses flags too
await safe_pay(payment, content=page_text)

Pass content here too, for the reason above. The wrapper scans with whatever text you hand it and nothing else.

The functions

The three functions share one TollWarden client per (base_url, api_key, agent_id), so they draw on the same free-tier quota. Verdicts are Ed25519-signed and payment-bound; the underlying client verifies them against a pinned key automatically.

For wallet-level enforcement (the signer itself refuses unscanned payments), see TollWardenEnforcer in the tollwarden SDK.

MIT. TollWarden is advisory and non-custodial: it never touches keys, wallets, or funds.