Claw-in-a-BoxYour agent asks
before it spends.
Bounded authorization for AI agents: allow / review / deny
spend-policy verdicts, optional human approval, claimed agent identity, and
delegatable capability tokens with cascading revocation. Bind an approval to
one execution, hand out less authority than you hold, and retract the whole
delegation tree with one pull cord.
This demo uses an unclaimed agent id. Try 30 (allow), 150 (review), 999 (deny) — or split a big spend into small ones and watch the daily total catch it.
Same call from a terminal:
curl -X POST https://api.clawinabox.xyz/v1/guard/check -H "Content-Type: application/json" -d '{"amount":150}'
Attenuate, don't share
Any token holder mints a narrower child — fewer scopes, shorter life, one audience — offline, no issuer round-trip.
POST /v1/tokens/delegate
{"scopes":["read"],"ttl_seconds":600}
Revoke once, kill the tree
Each child's signature is keyed by its parent's. Revoke any ancestor and every descendant fails verification — cryptography, not bookkeeping.
POST /v1/tokens/revoke
→ {"cascades": true}
Ask before you act
Send the intended action, get a deterministic verdict with the exact rules that fired. review means: stop and get a human.
POST /v1/guard/check
→ {"verdict":"review", ...}
Claim the name, keep the secret
One paid call anchors an agent id to the settlement wallet. The secret is shown once; strict mode can require it on every guard check.
POST /paid/v1/agents/claim X-Agent-Secret: <secret>
Bind permission to execution
Request a short-lived, one-shot verdict id. Consume it exactly once before executing; unused authorizations expire and refund the daily charge.
POST /v1/guard/check {"bind":true}
POST /v1/verdicts/:id/consume
Where it runs
Operator Console — v0.9 workbench
The human interface for public metrics, agent-owner spend history, operator approvals, strict-mode controls and wallet-signature recovery.
Open Console ↗Project NANDA — auth plugin
The same protocol ships as a NANDA Town auth plugin with
adversarial validators that fail against the default JWT plugin and pass
against this one. Merged into main by the maintainer;
1003 tests green.
Hosted API — agent-ready
Point any agent at /skill.md and it can use the service
with no SDK and no glue code. Verdicts, identity, execution binding,
delegation, revocation and operational reads — all over plain HTTP.
Pay-per-call + human approval
An x402 pay-per-call listing on OKX.AI for verdicts, token verification and pay-to-claim identity. A review can wait for Approve or Deny from your Telegram before the agent continues.
OKX.AI ↗x402 Bazaar — Agentic.Market
Indexed in Coinbase CDP's discovery catalog: any x402-capable agent can find this service by semantic search, read its schema, and pay per call in USDC on Base — no account, no API key, no sales call.
Agentic.Market ↗Use it in 60 seconds
Plain HTTP, JSON in, JSON out. Unclaimed agents can use the free routes without an account or API key. Claimed agents receive a secret, can enable strict authentication, and can recover access through the claiming wallet. Paid calls settle through x402.
Route review approvals to your phone
Bind an agent to Telegram, then approve or deny every
review request from wherever you are. Official bot:
@ClawInABoxBot — verify the exact username to avoid scammers.
1Ask before you spend
Send the intended action, get allow / review / deny with the exact rules that fired.
curl -X POST https://api.clawinabox.xyz/v1/guard/check \
-H "Content-Type: application/json" \
-d '{"agent_id":"my-agent","amount":150}'
# review = a human gets pinged on Telegram; poll the approval or pass "wait": true
2Bind approval to one execution
Add "bind":true to receive a five-minute, one-shot
verdict_id. Consume it immediately before the protected action.
curl -X POST https://api.clawinabox.xyz/v1/guard/check \
-H "Content-Type: application/json" \
-d '{"agent_id":"my-agent","amount":30,"bind":true}'
curl -X POST https://api.clawinabox.xyz/v1/verdicts/<verdict_id>/consume \
-H "Content-Type: application/json" -d '{}'
3Hand out less than you hold
Mint a root capability, delegate a narrower child to a sub-agent, revoke the root to kill the whole tree.
curl -X POST https://api.clawinabox.xyz/v1/tokens \
-H "Content-Type: application/json" \
-d '{"subject":"orchestrator","scopes":["pay","read"]}'
curl -X POST https://api.clawinabox.xyz/v1/tokens/delegate \
-H "Content-Type: application/json" \
-d '{"parent_token":"<token>","audience":"worker-1","scopes":["read"],"ttl_seconds":600}'
4Point your agent at the docs
The whole API is documented for machines — an LLM agent can integrate from one URL, zero glue code.
https://api.clawinabox.xyz/skill.md
5Pay per call — or claim an agent id
The paid mirrors speak x402: hit them without payment, get a 402 challenge,
and any x402 client settles automatically. Both rails also expose the
paid-only agents/claim identity bootstrap:
# USDC on Base — via Coinbase's x402 Bazaar https://api.clawinabox.xyz/paid/v1/guard/check # USDT0 on X Layer — via OKX.AI https://api.clawinabox.xyz/paid-okx/v1/guard/check
# replace guard/check with agents/claim to anchor an agent id · $0.01 per call