Algate • Verify before you trust, pay, or interact

The exchange

settled on with instant finality

Agent requests GET /v1/pii
402 Payment Required + price
Agent sends signed USDC payment
200 + analysis data on Algorand with instant finality

402 Payment Required has been reserved in the HTTP spec since 1997 and never used. x402 is what it was waiting for: the server states its price, the client pays, no human in the loop.

Six routes

POST /v1/gate
Should I take this action?
Choose an action profile and send the context you have. The pay_x402 profile binds a payment request to the URL, method, spending policy, and optional unsigned transaction. Returns one decision and an executable next step without hiding missing coverage.

allowreviewblock
GET /v1/email
Is this address worth writing to?
Disposable providers from an 8,201-domain list, role mailboxes, consumer providers, machine-generated local parts.

acceptreviewreject
GET /v1/pii
Am I about to leak something?
Cards verified by Luhn, IBANs by mod-97, Algorand addresses by checksum. Plus API keys, JWTs and BIP39 recovery phrases. Returns a redacted copy.

cleanreviewblocked
GET /v1/url
Can I trust this link?
Brand impersonation by edit distance, punycode, confusable scripts, embedded credentials, IP literals, suspicious structure.

oksuspiciousdangerous
GET /v1/injection
Is this trying to hijack me?
Instruction overrides, role rewrites, exfiltration orders, forged delimiters, and characters invisible on screen.

cleansuspiciouslikely_injection
POST /v1/transaction
Does this transaction match my intent?
Decodes an unsigned Algorand transaction or complete group before signature. Flags rekeys, closes, clawbacks, dangerous types, invalid groups, excessive fees, and intent mismatches.

allowreviewblock

Integrate

See what it costs — no payment, no account:

curl -i -X POST "$ALGATE_URL/v1/gate" \
  -H "content-type: application/json" \
  --data '{"action":"open_url","url":"https://paypa1.com/login"}'

What the payer account needs first

No signup and no API key — but a paid call needs an Algorand account that can actually pay. Four things, once.

one-time setup

An Algorand account. Any keypair. The mnemonic stays in your process — Algate never receives it.
0.21 ALGO. Algorand locks 0.1 per account plus 0.1 per asset held, so 0.2 stays locked while you hold USDC. The rest pays the opt-in below.
An opt-in to USDC, asset 31566704. Algorand accounts must opt into an asset before they can receive it. Skip this and every payment fails.
USDC. 1 USDC covers 1,000 calls.

After that, each call costs $0.001 USDC and 0 ALGO — the facilitator sponsors the transaction fee. An agent cannot fund itself: steps 2 and 4 need an existing balance, so they belong to whoever owns the account. An account holding ALGO but never opted in looks funded and fails every settlement — it is the usual first mistake.

Give your agent one safety gate.

Choose the integration that fits its runtime. The wallet and signing stay local in every case.

one paid check

Best for agents. Installs one local tool, check_action, returning a decision and the exact next action.

0.001 USDC · local wallet · retry-safe

{
  "mcpServers": {
    "algate": {
      "command": "npx",
      "args": ["-y", "algate-mcp"],
      "env": {
        "ALGATE_PAYER_MNEMONIC": "your local Algorand payer mnemonic"
      }
    }
  }
}

Typed control. Call algate.guard(action) directly and keep the payment identifier with the logical operation.

npm install algate-mcp

import { Algate, createPaymentId } from 'algate-mcp/client';

const algate = Algate.fromMnemonic({
  mnemonic: process.env.PAYER_MNEMONIC
});
const paymentId = createPaymentId('invoice_');

const result = await algate.guard({
  action: 'pay_invoice',
  email: invoice.sender,
  url: invoice.paymentUrl,
  transaction: { transaction: unsignedTxnBase64, expected }
}, { paymentId });

Native Python. The same Gate contract with a local Algorand signer and an explicit retry identifier.

pip install algate-sdk · Python 3.11+

pip install algate-sdk
import os
from algate import Algate, create_payment_id

payment_id = create_payment_id("invoice_")

with Algate(os.environ["PAYER_MNEMONIC"]) as algate:
    result = algate.guard({
        "action": "pay_invoice",
        "email": invoice.sender,
        "url": invoice.payment_url,
        "transaction": transaction_context,
    }, payment_id=payment_id)

Complete agent flow

discover → inspect → approve → pay. The bundled example defaults to a free dry run: it never signs the target payment, and dry-run mode never spends USDC.

reference

Discover — request the target resource and capture 402 Payment Required.
Inspect — send that requirement, the real URL/method, and your spending policy to Algate Gate.
Approve — continue only when Gate returns allow and recommended_action: "pay".
Pay — sign the target payment locally with a persisted payment identifier. Algate’s analysis fee is separate; the target is never auto-paid.

# free dry-run (default) — no signatures, no USDC spent
npm run example:flow

# real MainNet only when you mean it:
# ALLOWED_PAY_TO="TRUSTED_ADDRESS" PAYER_MNEMONIC="..." \
#   npm run example:flow -- --execute --oui-vraiment

Pays only Algate’s $0.001 analysis fee when dry-run is turned off — never auto-pays the target merchant. Persist ALGATE_PAYMENT_ID and TARGET_PAYMENT_ID with the logical operation before signing; reuse them after timeouts.

What this does not do

No network calls, ever.

URLs are never fetched, mailboxes are never probed, no live phishing feed is queried. Phishing lists go stale within hours — shipping a frozen copy would mean answering “safe” from dead data, which is worse than saying nothing. Only what can be computed honestly offline is reported.

The injection scan has no model behind it.

It matches known shapes and obfuscation. A clean verdict means “no known pattern”, never “safe”. A crafted, paraphrased attack will pass.

Nothing you send is stored or logged.

A PII scanner that copies your PII into its logs would be absurd — it is precisely the risk this route exists to address. There is no access log at all: a rejected input writes only the route path, and a failed settlement only the facilitator's reason. The retry journal on disk holds hashes, never values.

Every response says so itself.

Each one carries a not_checked field listing what was out of scope for that call. It is not decoration: a security tool that overstates what it knows is worse than no tool at all.

Details

Price	`$0.001` per call, any route
Network	`network`
Settles to	`AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA`
Free demo	`/demo?route=…&q=…` — 40 per minute, powers this page
Health	`/health`
Max input	32 KB query · 64 KB JSON body

The exchange

Six routes

Should I take this action?

Is this address worth writing to?

Am I about to leak something?

Can I trust this link?

Is this trying to hijack me?

Does this transaction match my intent?