RFC-402 LAB

Agent x402 Payment Threat Lab & Defense Studio

Wallet Balance: $50.00
Defense Engine: ARMED
Threat Configuration
Active Guardrails
Agent x402 Execution Pipeline READY
1. Reasoning Core
Awaiting goal dispatch
2. Tool Broker
Routing endpoint
3. 402 Paywall Node
HTTP challenge listener
4. Settlement Vault
Token signing locked
Live Transaction Tracer (RFC-402 / L402 Headers)
Telemetry & Mitigation Impact
ATTACK INTERCEPTED
TRUE
INTERCEPTING LAYER
quotation_attestation
MITIGATION LATENCY
14 ms
WALLET SAVED (USD)
$47.50
Exportable Defense Spec (YAML/JSON)
# Loading guardrail manifest...

Fixture paywall labels and boolean guard matching

Read the explanation

The default rogue-paywall fixture starts with wallet fifty and attempted drain forty seven point five. Without a matching enabled guard, displayed remaining value is two point five, shown as three hundred and fifteen pixel bars at six pixels per local amount. Interception simply scans that scenario list and accepts the first enabled named guard. It does not verify a signature, parse a live challenge, invoke an intent model, or enforce a real wallet. Four timed captions end after one second, while the displayed mitigation latency is a fixed fourteen milliseconds. Endpoint names and security claims are fixture text; no external request or payment is performed. The cap input writes state and policy JSON, but the outcome expression never compares demanded amount to that cap. Moving the displayed cap from two point five to point one changes the bars from two hundred to eight pixels at eighty pixels per amount, while the interception result stays driven by guard membership. A enabled circuit-breaker name therefore represents a boolean scenario match, not a numerical spend constraint. Setting wallet zero is also replaced by fifty through logical OR. In a breach branch the remaining value is computed but not assigned back to state wallet, so repeating a simulated drain can show two point five again rather than accumulating loss. After a default unprotected fixture run, the header may show two point five, while exported budget constraints still report the stored wallet fifty. The bars span fifteen and three hundred at six pixels per amount. The last result contains the computed remaining value separately. Reset restores controls and labels but never clears lastResult, so the next export can retain an earlier breached result beside newly enabled guards. Export before any result uses a fixed safe fallback. Inspect stored inputs and result together. These local receipts do not establish genuine mitigation, actual HTTP four hundred two handling, wallet loss, cryptographic attestation, exhaustive security coverage, or public playback.

Super generates helpful tools and automates fact-checking across the internet proactively. If you enjoyed this tool, build your own with Super and share it with a friend.