wormhole-guard 0.1.1 · wormhole-x402 0.1.2

Two packages, one thesis: an agent obeys instructions it did not write, so the places those instructions live need integrity checks.

wormhole-guard (PyPI, Python 3.8+, zero dependencies) — integrity monitoring and hardening for agent instruction files (AGENTS.md, CLAUDE.md, .cursor/rules, and eleven more formats), MCP tool definitions, and agent-to-agent handoffs. Prevention first: harden drops the write bit and pre-creates absent config paths, guard inspects writes before they land, outbound refuses to pass a payload to another agent. Detection rules are triage on top, and every rule ships with a benign twin that must stay clean.

pipx install wormhole-guard
wormhole scan ~ --blast-radius

wormhole-x402 (npm, TypeScript) — refuses to sign a Solana payment that does not match the x402 quote. The quote arrives in the server's HTTP 402 response, on a channel the model never touches, so a compromised agent cannot forge either side of the comparison. Offline, ~1ms, no RPC.

npm install wormhole-x402

Everything runs locally. No account, no network calls, no telemetry — verifiable by grep, and the README shows the command.

Full story: https://agentwormhole.com

wormhole-x402 0.1.3

Security hardening from the post-launch review, plus first-class facilitator support.

Closed bypasses

• guardSigner now guards every signing method a wallet exposes — signAllTransactions, signAndSendTransaction, and signAndSendAllTransactions previously routed around the check entirely.
• The System program is now a strict allowlist (only AdvanceNonceAccount passes). TransferWithSeed, Assign, WithdrawNonceAccount, allocation instructions, and unclassifiable tags are refused (X402-007 / new X402-009).
• Burn / BurnChecked riding beside a correct payment are refused (X402-006).
• ATA RecoverNested — an in-allowlist instruction that moves tokens — is refused; only Create and CreateIdempotent pass.
• New priority-fee cap (X402-010): a conforming payment carrying an outsized compute-unit price is refused. Default cap 0.01 SOL, configurable via InspectOptions.maxPriorityFeeLamports.

Facilitator flow

• inspectPaymentPayload(xPayment, quote) inspects the X-PAYMENT payload (object or base64 header) — in the SVM exact scheme the client still partially signs the settlement transaction, so the same bytes get the same checks.
• quoteFromRequirements(accepts[0]) maps a 402 response entry to the quote.
• EVM authorization payloads (EIP-3009) abstain rather than allow.

40 tests, each new rule with an attack case and a benign twin.

Docs: https://agentwormhole.com/docs