Get $TOLL

For agents and builders

Safety layer

Before an agent signs anything on Robinhood Chain, Toll reads it: the transaction run against the chain, what a signature would let someone take, and who an x402 payment really goes to. One word back: ALLOW, WARN or BLOCK, with the reasons.

On this page

Ask

Send what the agent is about to sign: a transaction, an EIP-712 or plain message, or an x402 payment. The answer is an ERC-8265 RiskAssessment with every warning, and a signed ERC-8481 report on request. Over MCP the tool is check_tx; over REST it is POST /api/tx/check (free within the daily coins) or POST /api/x402/tx (paid, no daily limit). Full field list on the pre-sign check.

curl -s https://t0ll.xyz/api/tx/check \
  -H 'content-type: application/json' \
  -d '{ "chainId": 4663, "from": "0xYourAgentWallet", "to": "0xTarget", "data": "0x…", "value": "0" }'

Transactions

  • A simulated run. The transaction runs against the latest block (eth_simulateV1) before anything is signed: every token that moves, every approval that changes, a revert, and the gas.
  • Intent against effect. When the agent says what it means to do (“swap 10 USDG for X”), the simulated result is compared with it.
  • Batches opened. Safe execTransaction, Multicall3, ERC-7579 batches and ERC-4337 UserOperations (EntryPoint v0.6 to v0.9) are read call by call.
  • EIP-7702. A delegation is BLOCK unless the delegate is on a short list pinned by code hash.
  • The coin a swap buys gets the full coin check (who is behind it, bundles, the dev’s record, the LP), plus its buy and sell tax measured by simulation.
  • Execution. Slippage against a live quote, a missing or far deadline, and the pool chosen against the best one.
  • Unknown calls with value get a stronger warning the more they move.

Signatures

  • What it lets someone take. Permit, Permit2 (single and batch), Seaport and UniswapX orders and other EIP-712 messages are decoded, and the answer names what could leave the wallet.
  • Plain messages. eth_sign is BLOCK. A sign-in message (SIWE) has its domain and chain checked.
  • Smart accounts. UserOperations and 7702 authorizations are read with facts about the delegate.

x402 payments

  • Who gets paid. The 402’s payTo is compared with the seller’s ERC-8004 registration and its agentWallet (ERC-8478), and with what the agent census read from its card.
  • The price. A payment more than 2x the seller’s usual price is a WARN, more than 5x a BLOCK (the usual price is the median the census recorded).
  • How long it lasts. An authorization valid for more than an hour is flagged: whoever holds it can settle it until then.
  • Standing permissions. A USDG allowance the payer left on Permit2 is flagged, with the amount.
  • No double pay. The facilitator at x402.t0ll.xyz settles a payment id once; a retry gets the first answer back.

Hidden instructions

Coin names, token text, sign-in messages, ERC-8004 agent cards, x402 sellers’ names and descriptions, and LARP pages are read for instructions aimed at an AI (“ignore previous instructions”, hidden unicode, fake tool calls). A hit is a warning, and the text Toll repeats back is the cleaned text. The fingerprints of our own MCP tool descriptions are published on the MCP page, so a change to them is visible.

Make it binding

  • Guard plugin. @tollxyz/guard wraps the agent’s wallet: it asks Toll first and adds your own rules (allowlists, spend caps per call, per day and per endpoint, a human yes above an amount).
  • ALLOW tickets. Toll signs a single-use ticket for one exact call; a contract or a MetaMask delegation can refuse calls without one. See ALLOW tickets.
  • Protect RPC. Point the wallet at https://rpc.t0ll.xyz: reads pass through, and a signed transaction Toll would BLOCK never reaches the chain. See Protect RPC.

After the trade

watch_coin keeps an eye on a coin an agent bought and says when its verdict turns. Approvals & revoke lists every token approval a wallet still has live, each with a revoke transaction Toll has checked (MCP wallet_approvals). The checked coins list and the on-chain record show how earlier calls ended.

Next

Being built now, in this order:

  • An agent’s ERC-8004 reputation and a seller score (real payers against self-paid volume) in check_agent.
  • Watches that react to trades within minutes, a wallet watch (new approvals, delegations) and alerts when a dev or a wallet group sells.