Automaton Sovereign + Agent Safe: signed oracles and a pre-flight firewall for agents, inside a budget

Automaton Sovereign serves signed DeFi oracles, a pre-flight transaction firewall (revert simulation, honeypot scan, safe slippage) and other agent tools over x402, paid per call in USDC on Base. Agent Safe adds the guardrail people need before leaving an agent running: payments go only to Automaton Sovereign's address, never above your per-call cap, never past the budget, whatever the agent was told.

Tested live on Base mainnet (2026-10-09): an agent paid Automaton Sovereign 0.001 USDC for GET /v2/oracle/base and got the signed Base oracle (gas and prices). Transaction. The same 402 checked against a different payee was refused with zero signatures.

Verified on both ends. Automaton Sovereign's maintainer re-checked our payments against the chain with their own GET /v1/verify-payment and confirmed them from the seller side (coinbase/agentkit#1544). Our three payments on 2026-10-09:

Their public counters at https://api.automaton-sovereign.workers.dev/stats, as read by the maintainer at 2026-10-09 14:27 UTC: settledCalls 22 (19 before our run), settledByEndpoint /v2/oracle/base 3 and /v2/firewall/simulate-tx 5, rejected 45 (one is our deliberate replay of an already-settled proof, answered 402 payment_invalid / nonce_already_used_locally with no second transfer). These counters keep moving; read them live rather than trusting this snapshot.

On a paid 200 the seller's origin sends a standard PAYMENT-RESPONSE (with network: "base", a v1 name, and an extra settledAt) together with X-Payment-Settled and X-Payment-Tx; per its maintainer, its edge worker sends only the vendor pair. agent-pay 0.8.5 reads the standard receipt (mapping base to eip155:8453); 0.8.3 and 0.8.4 fall back to X-Payment-Settled / X-Payment-Tx. A replayed proof is classified settled_not_delivered (report, never re-sign).

1. Add Automaton Sovereign as a merchant

import { createAgentPay, MerchantRegistry } from "@deepfirstsearch/agent-pay";

const registry = new MerchantRegistry([{
  origin: "https://api.automaton-sovereign.workers.dev",
  payTo: "0x71DEAc098914A009E3720524642A6bE6F65EE528", // Automaton Sovereign's Base address, as in its 402
  network: "eip155:8453",
  maxPerTx: 5_000n, // never more than 0.005 USDC per call
  pricePin: 1_000n, // 0.001 USDC, the published price
  label: "Automaton Sovereign",
}]);

2. Pay per call

const pay = createAgentPay({
  registry,
  policy: { allowedNetworks: ["eip155:8453"], periodBudget: { amount: 1_000_000n, periodMs: 86_400_000 } },
  payer: () => yourWallet, // any viem account: local key, Turnkey, Privy, CDP, KMS
  session: { readsUntrustedInput: true, accessesSensitiveData: false, canPay: true },
});
const plan = pay.commitPlan([{ origin: "https://api.automaton-sovereign.workers.dev", maxSpend: 100_000n }], 60 * 60_000);

const res = await pay.fetch("https://api.automaton-sovereign.workers.dev/v2/oracle/base", { method: "GET" }, { plan });
console.log(res.status, res.payment?.settlement.transaction);

A 402 that asks for a different payee, a higher price or a different network is refused before anything is signed. Requires @deepfirstsearch/agent-pay 0.8.3 or later.

If Automaton Sovereign changes its price or address

The pins are deliberate. The 402 is written by the server, and a 402 that suddenly names another address or a higher price is exactly what a redirected or hijacked payment looks like. So when Automaton Sovereign reprices or rotates its wallet, Agent Safe refuses and nothing is signed:

• a higher price gives price_changed (action ask_owner), or over_cap if it is also above your per-call cap;
• a different address gives payee_mismatch (action report).

Confirm the change through Automaton Sovereign's own channels (its site, docs or announcement), then update pricePin or payTo in the registry, or price or payTo in the MCP config. To absorb small price changes without a prompt, allow a tolerance instead of removing the pin: toleranceBps in the registry (1000 = up to 10% over the pin) or tolerancePct in the MCP config.

Agent Safe is an independent open-source project (MIT), live on Base mainnet as an unaudited beta. Not affiliated with Automaton Sovereign.