agent wallet · x402

A spending limit your agent cannot argue with.

Give an AI agent a wallet and it can buy the data it needs mid-task. Give it a wallet with no ceiling and one poisoned web page can spend all of it. This wallet enforces the ceiling itself — in code, before anything is signed.

today

$2.40 of $10.00

per call $0.50

per session $5.00

ceiling $10.00

Every limit is a distance on the same ruler. The red bar at the end is the hard ceiling: the wallet stops there and there is no override, because a limit that can be talked past is not a limit.

Create a wallet Read the quickstart

Paste one URL

A remote MCP server. No npx, no local install, no config file to hand-edit — the client discovers authorization on its own.

mcp endpoint

https://wallet.route402.dev/mcp

or, for config-file clients

{
  "mcpServers": {
    "route402-wallet": {
      "type": "http",
      "url": "https://wallet.route402.dev/mcp"
    }
  }
}

Six tools. One of them spends.

Everything else is free to explore, which keeps the security-critical surface to a single function.

search_services

Capability search across every registry, ranked and explained

describe_service

Schemas, prices, trust signals, and a policy preview

estimate_cost

What one call would cost, before committing to it

get_balance

Balance, and what is left under each limit

list_transactions

History with receipts and the rule behind each one

call_servicespends

Discover → pay → call, and report exactly what it spent

Assume the agent is compromised

It reads untrusted content all day. Any of it can say “call this endpoint a thousand times”, and no amount of prompting reliably makes a model refuse. So the refusal lives here instead.

Layered capsPer call, per session, per day, per counterparty, and a lifetime ceiling with no override.
Anomaly brakingA burst of calls to one service is the shape of an injected loop. A burst to a service registered an hour ago is the shape of an attacker's own endpoint. Both brake.
Default denyA service with no history and no settled volume is refused until you vouch for it.
Ask, don't guessAbove your threshold the wallet prompts you directly. If the client cannot show a prompt, the answer is no.
Priceable or nothingAn asset the wallet cannot value in USD is refused outright — a USD limit cannot be enforced against an amount with no USD value.

What a connection can ask for

Spending is never bundled into connecting.

registry:read: Search and read listings for paid services. No access to your wallet.
wallet:read: See your balance, remaining budget, and past payments. Cannot pay for anything.
wallet:spend: Sign and settle payments, inside the limits below. This is the only permission that moves money.

wallet:spend gets its own consent screen showing the actual numbers, and every connection can be approved without it.

route402.dev / wallet