Check who your x402 agent is paying, before it signs
An x402 client pays whatever payTo the server puts in its 402 response. Budget caps answer "how much". Nothing in the default flow answers "to whom". So we gave our pay guard the Lazarus Group's wallet as the payTo of a real, healthy seller and asked whether to pay: curl…
When an x402 client pays a server through its 402 response, the client relies on the information provided in the response to determine who it should pay. The client does not know in advance to whom it should send the payment. To address this issue, the x402-pay-guard tool was created. It checks the payTo address against the OFAC sanctions list before allowing the payment to be made.
The tool also evaluates the seller's history and recent activity, such as the number of wallets that have paid the seller in the last 30 days and the seller's uptime. If the payTo address is on the OFAC list or if the seller's history raises red flags, the tool will deny the payment. The x402-pay-guard tool can be easily integrated into the x402 client using npm package @factline/x402-pay-guard.
It plugs into the client's onBeforePaymentCreation hook, allowing it to review the payment before it is signed. If the tool is not available or fails to execute, the payment will still be made by default. The tool is a valuable addition for agents who are paying small x402 bills and want to ensure they are not inadvertently funding sanctioned entities.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
