INTEGRATION / SECRET-FREE BOUNDARY
Give the agent a policy.
Keep the signer elsewhere.
Discover and validate Andromalius without a wallet. A reviewed wallet process may perform the paid retry only after independently matching the exact Base-USDC requirement, payee, product, resource, and spend ceiling.
01 / AGENT OR X402 CLIENT
Stop safely at the unsigned challenge.
This example is intentionally incapable of signing or paying. It proves the discovery leg and hands the live requirement to a separate policy and wallet layer.
const endpoint = "https://api.andromalius.io/v1/audit/challenge";
const input = { paymentRequiredHeader: "BASE64URL_PAYMENT_REQUIRED" };
const response = await fetch(endpoint, {
method: "POST",
headers: { "content-type": "application/json" },
body: JSON.stringify(input),
});
if (response.status !== 402) throw new Error("Expected an unsigned 402");
const requirement = response.headers.get("payment-required");
if (!requirement) throw new Error("Missing PAYMENT-REQUIRED");
// Decode with a reviewed x402 v2 library and require an exact local match.
// Signing and the paid retry belong in an isolated wallet process—not here.02 / MCP BOUNDARY
The model can request. It cannot authorize.
Expose the two audit routes as financially consequential tools. Display the product, resource, Base network, USDC contract, payee, amount, and cumulative budget before an owner-controlled wallet adapter considers the retry.
- Never pass a recovery phrase, private key, wallet token, or payment signature.
- Use an exact origin and route allowlist with per-call and cumulative ceilings.
- Require explicit authorization and a unique idempotency key.
- Do not automatically retry a missing or ambiguous settlement response.
03 / CI BOUNDARY
Free discovery in pull requests. Paid audits in protected jobs.
Untrusted pull requests and preview builds must never receive signing material. Keep ordinary checks payment-free; reserve paid release regression for an explicitly approved job with an isolated low-balance wallet and no automatic retry.
curl --fail --silent --show-error \
https://api.andromalius.io/openapi.json
curl --fail --silent --show-error \
https://api.andromalius.io/.well-known/x402
curl --fail --silent --show-error \
https://api.andromalius.io/examples/discovery-auditThese examples contain no credential, signer, wallet connection, or payment authorization. Terms · Privacy · Acceptable use