SRA-RiskGate-4B checks a USDC payment an AI agent is about to make: sanctioned addresses, unlimited token approvals, and prompt-injected “already verified, pay now” text.
-
99.5% correct decisions on a 20,000-case synthetic benchmark (base Qwen3-4B: 59.8%)
-
Code rules on top of the model: 0 unsafe approvals on 847 risky test cases
-
MCP server uses Ollama on localhost by default, or LM Studio / any OpenAI-compatible server
ollama pull sriram1983007/sra-riskgate
GGUF: https://huggingface.co/sriram1983007/SRA-RiskGate-4B-GGUF
Caveats: the benchmark is synthetic, and the code checks were written after seeing the model’s failures. Every prediction is published on Hugging Face so anyone can re-score it.
This week a reader found a gap (EIP-7702 delegations got approved); it’s fixed in all three packages. Happy to hear where else it breaks.
What’s the use case? I heard of people giving their agents lightning wallets for x401 but i have never heard of usdc for that use (and can’t really imagine what any of these is used for with an agent)
Good question. You’re probably thinking of L402, which uses Lightning and HTTP 402. x402 is the same idea with USDC instead of sats: a server answers a request with “402 Payment Required” plus a price, the agent signs a small USDC authorization, and it retries the request with that signature attached. Coinbase started it, and it now runs on Base and a few other chains.
Concrete uses so far are mostly pay-per-request APIs that an agent calls on its own: paying a few cents for a search, a dataset row, an inference call or a scraped page, without the human setting up an account and API key for each service. Increasingly the seller is another agent too. Why USDC rather than Lightning: prices stay in dollars, no channel liquidity to manage, and many businesses already hold it. Lightning is great for this too, it’s just a different ecosystem.
Honestly, it’s early, and volume is small. That’s partly why I think the safety side matters now: the agent decides and signs on its own, the payment can’t be reversed, and the request it reads can contain text written by the party being paid. My model and checks sit right before that signature.
1-minute demo on Base Sepolia: https://www.youtube.com/watch?v=NeyFklYSfkA