Guardian is the check that runs first. An agent submits the transaction it intends to sign; Guardian returns ALLOW, WARN or DENY — with every reason. It never sees a private key.
Every verdict here is computed by the live endpoint at /api/mcp — the same one an OKX.AI agent calls. Nothing is mocked.
| unlimited_approval | approve(spender, MAX_UINT256) — the most exploited pattern in crypto. One compromised contract and the balance is gone, years later. |
| approval_to_eoa | Spending power granted to a personal wallet instead of a contract. Real protocols are contracts. This is a drainer signature. |
| fresh_recipient | Zero balance, zero nonce, no code — the wallet an attacker generated ten minutes ago. |
| set_approval_for_all | A blanket grant over an entire NFT collection. |
| zero_address | Funds sent into the void and destroyed. |
| max_spend_exceeded | An agent exceeding its budget. |
| unknown_selector | Calldata the agent cannot prove the meaning of. |
| simulation_revert | A transaction that reverts on-chain. |
A security tool that guesses when it cannot see is worse than no security tool, because it is trusted. Guardian separates the chain says no from the chain did not answer. DENY is computed offline, so a flaky RPC can never soften it. A failed lookup never manufactures a finding. And if the chain is unreachable, the response carries degraded: true and the verdict is capped at WARN — Guardian will never hand out a confident ALLOW while blind.
POST https://guardian-mcp.vercel.app/api/mcp
{ "jsonrpc": "2.0", "id": 1, "method": "tools/call",
"params": {
"name": "guardian_assess_transaction",
"arguments": {
"to": "0xa0b8…eb48", // USDC
"from": "0xd8da…6045",
"data": "0x095ea7b3…ffffffff", // approve(spender, MAX)
"chainId": 196 // X Layer
}
}
}