Guardian

Every AI agent that can sign can also be tricked. We are handing autonomous agents the ability to move money, and the only thing between a prompt-injected agent and an empty wallet is the agent's own judgment. That is not a security model.

Guardian is the layer that says no. An agent submits the transaction it intends to sign; Guardian returns ALLOW, WARN or DENY, with every reason. It never sees a private key and it never signs.

WHAT IT CATCHES

- unlimited_approval — approve(spender, MAX_UINT256), the most exploited pattern in crypto. One compromised contract and the whole balance is gone, years later.

- approval_to_eoa — spending power granted to a personal wallet instead of a contract. Real protocols are contracts. This is a drainer signature.

- fresh_recipient — zero balance, zero nonce, no code: the wallet an attacker generated ten minutes ago.

- set_approval_for_all — a blanket grant over an entire NFT collection.

- zero_address, max_spend_exceeded, unknown_selector, simulation_revert.

Raw calldata becomes plain language: "Grant 0x1111… UNLIMITED permission to spend your USDC."

IT TELLS YOU WHEN IT DOESN'T KNOW

A security tool that guesses when it cannot see is worse than no security tool, because it is trusted. Guardian separates "the chain says no" from "the chain did not answer". DENY is computed offline, so a flaky RPC can never soften it. A failed lookup never manufactures a finding. If the chain is unreachable the response carries degraded: true and the verdict is capped at WARN — Guardian will never hand out a confident ALLOW while blind. This is enforced by tests, not by convention.

Five MCP tools, seven chains, X Layer native. Free.