Monarch Shield
One command that fails your build when an agent can pay without a policy check.
Copy the x402 quickstart, ship it, and your agent pays whatever it gets asked to pay.
No spend limit. No deny path.
You find out when the bill shows up.
npx @monarch-shield/x402 doctor --ci --strictDoctor scans JS and TS for paid client calls.
No recognized abort or deny before payment? The build fails.
If it can't finish the analysis, it fails closed.
Hooks that only log don't pass.
Hooks registered after the paid call don't pass.
Abort branches that can never run don't pass.
Lookalikes don't pass either.
On your machine. No account, no API key.
JSON for CI, SARIF for code scanning, a GitHub Action for PRs.
MIT licensed.
It runs at build time. It doesn't block a payment at runtime.
It checks one file and follows its imports. It doesn't prove your policy is right.
