Your agent signs. Baret checks first.
Baret simulates every transaction your agent builds and checks it against your policy before the key signs. When a rule says no, your agent stops instead of signing blind. A vault on Monad caps what it can spend.
npm install @baret/agent-kitOn npm. The package brings @baret/guard and the baret CLI with it.
Three layers between your agent and your money.
Each layer works on its own. Stack them and a gap in one still meets the next.
The check
Baret simulates the transaction against live Monad state without sending it, reading the chain over Alchemy's Monad RPC. Nine detectors read the result. Your policy decides what blocks.
- Simulate on Monad
- Run nine detectors
- Compare an x402 payment with its 402
- Apply your policy
The guarded signer
Asks Baret first and signs only what Baret clears. The HTTP API is live. The TypeScript SDK and the CLI are on npm: npm i @baret/agent-kit.
- HTTP API, works today
- TypeScript SDK (@baret/agent-kit), works today
- CLI (baret), works today
- Agent wallets from Dynamic, works today
The vault
PaymentGuard holds the agent's budget in a contract on Monad. The agent key can only call pay, to merchants you listed, inside the caps you set.
- Per-payment cap for each merchant
- Rolling 24-hour cap
- Only you deposit and withdraw
- Revoke in one call
Skip the check and the vault still says no. A payment over a cap, or from a revoked key, reverts in the contract.
A real agent, paying from a real vault.
This agent is a Dynamic server wallet, authorised on a PaymentGuard vault on Monad testnet. Every payment below is real, read live from the Envio indexer.
Reading the agent's payments...
Reading the agent's payments...
Ask Baret's registry about an address.
Baret keeps a reputation registry on Monad, and every check reads it. A Chainlink CRE workflow, run so far in Chainlink's simulator, has written part of ScamSniffer's public blacklist to it.
From install to your first blocked transaction.
Install the kit
Run npm install @baret/agent-kit. The package brings @baret/guard and the baret CLI with it, and any language can call the HTTP API.
Define a policy
Start from Strict, Balanced or Permissive, then change any single rule. The policy is plain JSON that you own and can version.
Wrap your signer
Replace your send call with guardedSubmit. Safe means it signs and sends. Blocked, or Caution unless you allow it, means it throws before the key runs.
Works today, with no install. Post an unsigned transaction to the live Baret API on Monad testnet.
curl -X POST https://baret-monad-api.onrender.com/v1/analyze \
-H "content-type: application/json" \
-d '{
"network": "testnet",
"transaction": {
"from": "0x306707be3CD50B1Cca5E27F838AfcfC4fD84C353",
"to": "0xac9517a70c88480c9fA7E9a280DA485F7f552C29",
"value": "100000000000000000",
"data": "0x"
},
"policyTemplate": "balanced"
}'The answer carries a decision: safe, caution or blocked. This one is blocked, since the address it pays is flagged. An agent signs only on safe. No answer means no signature.
About the secret
The agent key comes from BARET_AGENT_PRIVATE_KEY, or from a Dynamic server wallet whose key is never whole in one place. Keep it out of the repository, logs and prompts. Better still, give the agent a key that holds only gas and can only call pay on your vault.
Watch an agent ask first.
Pick something an agent might try and a starting policy. The playground asks Baret's live API from a funded testnet agent and shows what your agent gets back.
Nothing checked yet
Pick an action, or paste a transaction, to see what your agent would get back.
To check your own transaction, paste it below, or post it to the live API at /v1/analyze as the HTTP API sample shows.
Every check here, the eight actions and a pasted transaction alike, goes to the same /v1/analyze endpoint, on a rate-limited testnet server.
Per-agent activity needs an authenticated server, so it is not part of this public playground.
Fair questions
Does Baret ever hold my agent's key?
No. The key stays with you: in your process, or split between your machine and Dynamic for a Dynamic server wallet. Baret gets the unsigned transaction and returns a decision. The server never sees a key and never signs. The vault holds what you deposit, and only you can withdraw it.
What if the agent ignores the answer?
With the HTTP API alone, nothing in your code stops it, so sign only on safe. AgentWallet refuses on its own: a call Baret does not clear never reaches the signer. Either way, the vault still enforces its caps in the contract.
What if the agent key leaks?
A vault agent key can only call pay. Every payment still meets the per-payment and rolling 24-hour caps, and you can revoke the key in one call.
What does Blocked mean?
The transaction broke one of your rules, or a check could not finish. It does not mean someone is malicious. The findings say which rule fired and why.
Should my agent retry a blocked transaction?
No. A block is the answer, not a glitch. Retry only when /v1/analyze does not answer or answers with an error, because then the check did not finish.
How fast is it?
Each transaction costs one round trip to the server and one simulation, before the key signs. There is no published latency figure yet. Measure it on your own traffic.
Can I use it without the vault?
Yes. Calling the HTTP API before each signature works on its own and is the smaller change. The vault is what limits the damage when the key itself leaks.
Which policy should an agent start with?
Balanced, with caps set to what you could lose in a day without trouble. Tighten it once you have seen real traffic.
Do I need an account?
Not for the playground. A server you run yourself can require an API key: list the keys in BARET_API_KEYS and send one in the x-api-key header.
Your agent stops instead of signing blind.
Pick a policy and call the HTTP API today, or use the SDK and the CLI from npm. A transaction that breaks your rules ends as an error in your logs, not as a signature.