# XGuard

> XGuard is a guarded x402 v2 verification and settlement gateway for autonomous agents and applications on Base mainnet USDC.

XGuard charges $0.002 only for a successful billable settlement. Verification, malformed requests, failed settlements, duplicates, replays, and discovery requests are not billable.

## Discovery
- [Provider manifest](https://www.xguardgate.com/.well-known/x402/facilitator.json): machine-readable facilitator identity, integration, pricing, onboarding, and safety metadata
- [Agent Card](https://www.xguardgate.com/.well-known/agent-card.json): machine-readable agent/service capability metadata
- [MCP server metadata](https://www.xguardgate.com/.well-known/mcp/server.json): official remote MCP server metadata
- [Remote MCP](https://www.xguardgate.com/mcp): streamable HTTP MCP endpoint for agent discovery
- [Bazaar resources](https://www.xguardgate.com/discovery/resources): machine-readable catalog of x402-paid HTTP APIs and MCP tools
- [Bazaar search](https://www.xguardgate.com/discovery/search?query=x402): searchable XGuard catalog surface
- [OpenAPI](https://www.xguardgate.com/openapi.json): complete HTTP API description
- [Supported x402 kinds](https://www.xguardgate.com/supported): live x402 capabilities and authoritative signer attribution
- [Status](https://www.xguardgate.com/status): operational status
- [Readiness](https://www.xguardgate.com/readyz): live mainnet route readiness

## Core API
- POST https://www.xguardgate.com/v1/register — create a merchant identity and receive a Bearer API key
- POST https://www.xguardgate.com/verify — verify an x402 v2 payment authorization
- POST https://www.xguardgate.com/settle — settle an x402 v2 payment with duplicate protection and finality tracking

## Authentication
Protected merchant and payment endpoints use Authorization: Bearer <merchant-api-key>.

## Protocol
x402 version 2; Base mainnet (eip155:8453); exact scheme; native USDC.

## Merchant balance
- GET https://www.xguardgate.com/v1/balance — current prepaid XGuard service balance
- POST https://www.xguardgate.com/v1/topups/intents — create an exact Base USDC top-up intent
- POST https://www.xguardgate.com/v1/topups/claim — claim a finalized top-up transaction

## Provider selection
Use https://www.xguardgate.com/.well-known/x402/facilitator.json when a catalog, agent, or integration tool needs XGuard provider metadata. Use https://www.xguardgate.com/supported as the authoritative live x402 capability and signer response. The provider manifest is XGuard-specific metadata and does not claim to be part of the x402 protocol specification.

## Settlement safety semantics
XGuard derives stable payment identities, rejects conflicting active authorizations, coordinates settlement durably, prevents automatic retries when downstream outcome is ambiguous, tracks Base USDC finality, and earns its service fee only after successful finality confirmation.

## Settlement execution
XGuard is the merchant-facing facilitator-compatible gateway. The current downstream transaction submitter is xpay. XGuard independently verifies finalized Base USDC settlement evidence before recognizing its service fee.

## HTTP behavior
- 200: successful discovery/verification/settlement response
- 400: malformed or unsupported request
- 401: merchant API key missing or invalid
- 402: merchant service balance cannot cover the XGuard fee
- 409: duplicate/conflicting/in-progress settlement state
- 429: request or concurrency limit exceeded
- 503: protected dependency unavailable or settlement result is ambiguous

## Machine-readable contract
Use https://www.xguardgate.com/openapi.json as the authoritative HTTP interface description and https://www.xguardgate.com/supported for live x402 network/scheme/signer support.
## Agent discovery
MCP: https://www.xguardgate.com/mcp (preferred protocol 2026-07-28; Streamable HTTP; stateless)
MCP manifest: https://www.xguardgate.com/.well-known/mcp/server.json
Bazaar resources: https://www.xguardgate.com/discovery/resources
Bazaar search: https://www.xguardgate.com/discovery/search?query=<terms>
Safe migration kit: https://www.xguardgate.com/.well-known/xguard/migrate?from=<cdp|payai>&name=<merchant>
Settlement truth: https://www.xguardgate.com/v1/settlements/<logicalPaymentKey>/truth (merchant API key required)
Settlement resolve: https://www.xguardgate.com/v1/settlements/<logicalPaymentKey>/resolve (merchant API key required; POST)
Settlement truth states are FINALIZED, PENDING, PROVEN_FAILED, and CONFLICT; only FINALIZED is release-safe.
The resolver checks independent Base finality and EIP-3009 recovery evidence and never blindly resubmits an ambiguous authorization.
The migration kit is instruction-only and does not move funds, change third-party infrastructure, or synthesize x402 settlements.