The Secure Financial
Infrastructure for the
Agentic Economy
AI agents discover, negotiate, and settle digital intelligence assets at machine speed — protected by a 9-layer cryptographic security pipeline.
Marketplace at a glance
Business communities exchanging AI assets under SEP protocol with UECIID provenance tracking
Platform commission on cleared M2M transactions — computed with Decimal math, zero float drift
Causal Transfer Guard evaluates every trade — blocks exfiltration at P ≥ 0.70 in under 20ms
SOVA agent manages your marketplace SOC: visual patrol, shadow AI discovery, corpus watchdog
Recognize these pain points?
Shadow Warden solves them without changing a line of your code.
15 regex patterns + Shannon entropy scanning. API keys, JWTs, passwords, PII — stripped before reaching the LLM.
Per-department and per-vendor spend tracking. Budget caps, threshold alerts, and approval workflows built in.
AI vendor registry, DPA status tracking, expiry alerts, and compliance scoring — fully automated.
Every incident logged into a STIX 2.1 tamper-evident audit chain with a causal XAI explanation attached.
Marketplace-grade security built into every trade
Every M2M transaction passes through a 9-layer cryptographic guardrail. Agents cannot collude, exfiltrate, or bypass governance — by design.
ML-DSA-65 (FIPS 204) hybrid signatures on every M2M trade proof. X25519 + ML-KEM-768 key encapsulation. Quantum-resistant by default on Enterprise.
HybridSigner · ML-DSA-65
Every agent request is authenticated, rate-limited, and jurisdiction-routed through MASQUE tunnels. No implicit trust — every hop is attested.
MASQUETunnel · SovereigntyAttestation
Autonomous SOC operator running 24/7. Monitors agent collusion, goal misalignment, and model poisoning via the MAESTRO detector suite.
SOVA · MAESTRO · WardenHealer
Every request. Every time.
Full cycle <2ms — faster than your network RTT
Integration in 3 steps
Connect your AI services
Point Shadow Warden as a proxy for OpenAI, Anthropic, Gemini, or any LLM. Change one URL — no code changes required.
Traffic flows through Shadow Warden
The 9-layer filter processes every request: blocks jailbreaks, strips secrets, and writes incidents into the STIX audit chain.
Alerts and reports
Real-time Slack/Teams/PagerDuty notifications. Grafana dashboard, XAI explanations, SOC 2 evidence — audit-ready from day one.
AI incidents drop after deployment
Average reduction across SMB customers — first 6 months
Shadow Warden scales with you
SMB
- ✓ SMB Governance Suite — one setup wizard
- ✓ Vendor Governance + DPA tracking
- ✓ Budget Dashboard + Cost Allocation
- ✓ Shared Prompt Library with injection screening
- ✓ Employee AI Training Records + HMAC attestation
Enterprise
- ✓ Post-Quantum Auth (Ed25519 + ML-DSA-65)
- ✓ Sovereign AI Cloud across 8 jurisdictions
- ✓ MasterAgent multi-agent SOC coordinator
- ✓ GDPR DPIA + SOC 2 Type II ready
- ✓ Unlimited requests · 99.95% SLA
DevOps / MLOps
- ✓ OpenAI-compatible proxy — one line of code
- ✓ LangChain WardenCallback integration
- ✓ OTel tracing + Jaeger + Grafana
- ✓ CI/CD: Docker + GitHub Actions ready
- ✓ Python SDK + REST API (50+ endpoints)
Three ways to earn with Shadow Warden
Whether you protect, build, or trade — every role on the platform has a clear revenue model.
Avoid the $4.88M breach
IBM 2024 reports the average AI-related data breach costs $4.88M. Shadow Warden's 9-layer filter blocks prompt injection, strips secrets, and enforces GDPR — reducing incidents by 87% within 6 months of deployment.
Sell AI assets, keep 98.5%
List AI models, datasets, fine-tunes, and prompt templates on the Intelligence Marketplace. Each asset gets a UECIID provenance token. Buyers pay in USDC via x402 nanopayments. Platform takes 1.5% — you keep the rest.
Run your own AI marketplace
Launch a private B2B marketplace for your industry. Members buy and sell through your community — you collect a cut of the GMV. SOVA agent runs compliance and SOC automatically, so you earn without hiring a security team.
Blocks 3 prompt injections/day targeting customer data. SOC 2 Type II audit passes with zero findings. Cyber insurance premium drops 40%.
Lists 12 financial datasets on Marketplace. Each purchase auto-issues a UECIID provenance token. Buyers pay in USDC with no chargebacks.
Runs a Healthcare AI Community with 200 members. HIPAA compliance built in. SOVA watches for data exfiltration. Members trade models inside the SEP framework.
What users are saying
In the first week Shadow Warden blocked 3 prompt injection attempts against our corporate chatbot. The XAI explanations saved us hours of incident triage.
Setup took 20 minutes. One URL change in config — and all AI traffic is under control. SecretRedactor caught 2 accidental JWT tokens on day one.
The SMB Governance Suite helped us pass a GDPR audit with zero findings. Vendor Governance tracks all DPAs automatically — it's invaluable.
Agentic Commerce & Web3
The first AI security gateway with built-in mandate controls for AI-driven purchasing — signed on-chain, audited via STIX, compliant by design.
# Any AI agent — mandate-controlled purchasing
from shadow_warden_sdk import SecureAgent
agent = SecureAgent(api_key="sw-...", tenant_id="acme")
mandate = agent.create_mandate(max_amount=200.0)
order = agent.purchase({ "store_url": "shop.com", "items": [...] })Changelog
Full roadmap →What's New
Shadow Warden ships every two weeks. Here's what landed recently.
Every tier price, tier alias, and annual figure now lives in a single table, and annual pricing is derived from the monthly price rather than written by hand. Three copies had drifted apart across the billing API, the feature gate, and the margin engine.
The MasterAgent and Evolution Engine — the two most expensive code paths — now record their token spend against the tenant, with prompt-cache reads billed at a tenth of the input rate. Model pricing resolves by family, so a new model snapshot can never rate as a cheaper one.
Each plan carries a monthly inference allowance derived from its own price. As the allowance is consumed, agent runs move down the model ladder instead of being refused — the gate never blocks a request, never drops below the capability a task requires, and serves the most capable model if anything goes wrong.
GET /billing/margin reports plan revenue against month-to-date inference cost, and a new FinOps CLI prints unit economics, per-model turn cost, and node capacity from the code’s own price book.
Global Statistic Agentic Marketplace — a metadata-only agent observation stream (ClickHouse + fail-open NDJSON spool) fed by 5 GDPR-allowlist ingest taps. Tool-input text never leaves the process; only shape, timing, and payload_kind are recorded.
Pure-function EWMA total-variation drift against per-agent payload_kind baselines, gated by an anti-inflation co-occurrence rule (mirrors the Causal Arbiter’s 25% CPT drift gate). A breach quarantines the agent through an additive gate layered onto staff_dispatch — the existing boundary and velocity checks are never weakened.
warden/gsam/jit_lease.py issues single-use, HMAC-signed credential leases — fail-CLOSED (503 with no key material) and never returns a secret on issue; only a scope-bound redeem call returns the capability, once.
GET /gsam/heatmap, /gsam/agents/{id}/stats, and /gsam/compliance/score read the hourly SQLite rollup (never ClickHouse directly). New gsam_agent_stats Semantic Layer model plus Streamlit and SOC dashboard panels.
--gsam-posture added to the warden-scan CI driver — surfaces marketplace agent compliance score and quarantine count directly in the CI job summary.
Pinned fastapi<0.136 / starlette<1.0 after discovering an unpinned starlette 1.x resolution silently dropped every /marketplace/* route on include_router() of a self-prefixed router — routes were handed to FastAPI but never reached the live app. Affected any fresh install (CI and production) that resolved the newer starlette major.
warden/models/community.py lived inside a gitignored directory (doubling as the HuggingFace model cache) and was never committed — the entire /community API (NIM moderation + Obsidian bridge) was silently absent everywhere except the original author’s machine. Relocated to the tracked warden/community_models.py.
The guard now measures the app surface in a clean subprocess, grouped by owning module. It tolerates a whole subsystem being absent from a missing optional dependency while still catching real route regressions — and is immune to pytest-session state pollution that previously caused false failures.
scripts/ci_import_audit.py walks every warden.* module plus a cold import warden.main, naming the exact missing dependency or import failure behind any skipped router directly in the CI job summary — no more digging through raw logs to find a root cause.
chrome-devtools in .mcp.json was a misplaced top-level key and was never actually loaded as a server despite being documented as active. Moved into mcpServers and pinned to a specific upstream commit for build reproducibility.
The warden.main god-module is being dissolved into a layered modular monolith (api → services → domains → runtime). A dependency-free runtime container holds shared singletons; the FilterPipeline service is the stable seam over the 9-stage flow. Fully backward-compatible — zero external API changes.
A CI-enforced AST test guarantees no module under warden/ imports warden.main upward — the historic import-cycle source is eliminated and cannot regress. The last four reach-backs (poison_guard, threat_store, intel_bridge, rate-limit setter) now resolve from the runtime container.
An executable OpenAPI diff snapshots all 713 routes; any added, removed, or renamed route fails CI. This makes incremental extraction of endpoints out of main.py provably surface-preserving — /api/contact and the 8 /threats/* routes moved to dedicated routers with zero externally-visible change.
SSRF guard (net_guard) validates every outbound webhook URL against private/loopback/cloud-metadata ranges with full DNS resolution; signing keys resolve fail-closed via resolve_key (no public defaults); approval-gate and admin checks hardened; SemanticQueryEngine gains identifier/operator/literal validation for defense-in-depth against SQL injection.
GET /health/pipeline reports per-stage status for all 9 filter stages (topology → obfuscation → secrets → semantic_rules → brain → causal → phish → ers → decision) with model_loaded flag and Turso connection summary. Enables precise alerting on partial pipeline degradation.
PAYMENT-SIGNATURE now validated for nonce (UUID4) and issued_at (Unix timestamp) within ±5 min window. Consumed nonces tracked in x402_used_nonces SQLite table — prevents double-spend replay attacks. Backward-compatible: old clients without nonce/issued_at pass through with a debug log.
warden.x402.audit logger emits fixed-schema JSON on every x402 gate fail-open event (tenant_id, resource, reason, payment_bypassed=true). Enables Loki/Grafana alerts on unexplained payment bypasses without relying on ad-hoc grep.
autonomous-security-loop.yml now pre-writes /home/runner/.claude.json (hasTrustDialogAccepted + hasCompletedOnboarding) before Maker/Checker claude --print calls. Fixes "workspace not trusted" and "not logged in" errors that blocked the nightly autonomous loop.
warden/mcp/gateway.py — Claude-compatible MCP server exposing all 9 pipeline stages as tools with x402 nanopayment gate. Agents pay per tool call (filter, explain, mask/unmask, scan). JWT bearer auth, per-tool credit gating, Turso-backed billing audit.
warden/protocols/acp/ — AP2 multi-agent auction engine with HMAC-signed payment tokens, shared cart semantics, refund intents, and Turso-backed token vault. Agents negotiate, bid, and settle payments programmatically without a human in the loop.
warden/billing/audit_chain.py — SHA-256 hash chain (genesis block → sequential events). Every MCP call, ACP checkout, and staff agent cost appends a tamper-evident event. Chain integrity verifiable offline. Turso-backed in production (warden-billing-audit).
5 production databases on aws-us-east-1: warden-billing-audit, warden-acp, warden-marketplace, warden-sep, warden-staff. sqlite3-compatible HTTP adapter (warden/db/turso.py) — zero code changes to callers. Auto-fallback to local SQLite when TURSO_URL_* unset.
warden/app_factory.py — RouterSpec + register_router_safe() catches all exceptions (not just ImportError), isolating each sub-router so a broken staff agent initializer can never crash the security pipeline. 30+ routers in OPTIONAL_ROUTERS registry.
warden/staff/economics.py — per-action LLM token cost tracking (Haiku/Sonnet/Opus pricing) in SQLite. GET /staff/agents/economics/report + /alerts. Wired into every StaffAgentRunner.run() call.
warden/staff/a2a.py — HMAC-SHA256 signed cross-functional routing between staff agents with an ALLOWED_ROUTES whitelist. SupportAgent consults ComplianceAgent before high-risk-country refunds. Full SQLite audit trail at GET /staff/agents/a2a/audit.
warden/staff/structured_log.py — AgentSpan emits fixed-schema JSON lines (agent_id, tool_name, cost_usd, latency_ms, status) for every staff agent lifecycle event. Drop-in for Grafana/Loki dashboards, no regex parsing needed.
Usage-Based (Metered) Billing for agentic API — report_usage() async method with JSON:API payload to /v1/usage-records. ls_sub_item_id extracted from first_subscription_item in webhooks. M2M search meter offloaded to FastAPI BackgroundTasks for zero latency impact.
tenant_feature_flags table gates PQC, SOVA, and marketplace_node per subscription tier. _enforce_feature_flags() fires on every lifecycle event — PQC and SOVA access revoked instantly on downgrade or cancellation.
Every SOVA tool call wrapped in an OpenTelemetry span (sova.tool.{name}). GDPR-safe attributes: tool name, byte sizes, tenant_id, duration_ms, success. Fail-open when OTEL_ENABLED=false.
scripts/db_snapshot.py — Fernet-encrypted point-in-time SQLite snapshots before every autonomous loop run. Step 1b in autonomous-security-loop.md safety gate. Supports --list, --restore, --purge with 7-snapshot rotation.
Community, Marketplace, and Agentic pages merged into one unified /agentic destination. Searchable community grid with topology network canvas, live network activity feed, and 6-step creation flow. /community and /marketplace now redirect 301.
Fixed mypy "Name Order not defined" in m2m_store/inventory.py via relative import. Silenced Pydantic v2 stub false positives in communities/router.py. Full suite: 4305 tests passed, 81.21% coverage (gate: 79%).
Complete machine-to-machine marketplace: DID registration with protocol schema discovery (GET /protocol/schema/{action}), semantic search (Layer 3 pgvector), Brand Agent 4-gate filter (deny-list/TrustRank/rate-limit/capability), and ClearingEngine final clearing with dual-write SQLite+PostgreSQL.
AgentHandoffMemory (Layer 2) compresses conversation context by ~61% for cost-efficient multi-agent handoffs. SOVA tools #70-74: write_handoff_memory, read_handoff_memory, semantic_listing_search, get_protocol_schema, send_order_proposal.
Autonomous buyers must evaluate minimum 3 alternatives before purchase. Best offer selected by price x (1 - reputation) utility function, not arrival order. Confused Deputy protection scopes analytics SQL to caller DID.
Agent DID registration, asset tokenization (rules/models/signals), escrow flow, and full marketplace commerce with multi-agent auctions. 9 analytics endpoints, Streamlit dashboard, SOC page with Recharts charts.
Real-time event notifications via email, Slack, and Microsoft Teams for all community activity: member joins, transfers, peering changes, compliance events, and incident escalations.
GET /deploy/status probes all 11 Docker services concurrently with latency. SOC Dashboard /platform/status page with auto-refresh every 30s. Portal /deployment/ infrastructure view with quick-links to Grafana, Jaeger, MinIO, and Prometheus.
Syntax-highlighted Python and TypeScript SDK installation and usage docs at /sdk. OTel span processor, streaming proxy, LangChain callback, and agent monitor covered with live code examples.
Pre-merge security gate: scans every commit message and per-file diff through the 9-layer pipeline. Composite action with PR comment risk table, 90-day audit artifact, and fail-on BLOCK/HIGH. Local git pre-commit hook mode included.
Real-time posture across SOC 2 · GDPR · ISO 27001 · HIPAA · NIS2. SVG score gauge, 168-snapshot ring buffer, 30s auto-refresh, per-standard drilldown, evidence download panel.
All 93 Annex A controls mapped across 4 themes (Organizational/People/Physical/Technological) with platform evidence strings. Per-theme coverage %, print-ready HTML report, SOC dashboard drilldown.
9 built-in semantic models covering security, risk, billing, incidents, vendors, commerce, sovereignty, compliance, and AI spend. Redis cache (10 min TTL). SOVA can query any model with natural language.
Every AP2 payment passes a Semantic Layer budget check before execution. Reads actual MTD spend from ai_spend model, enforces per-transaction limits, approval thresholds, and monthly caps. Slack alert on block.
Tenants register custom semantic models via API or Streamlit. Persisted to SQLite, hot-loaded into engine without restart. Access rules enforce per-tenant data isolation.
Headless BI: centralized metric contracts, dimension mappings, access rules. LLM translates natural language into deterministic SQL. OSI 1.0 export/import for external BI systems.
Unified settings across Agents (SOVA/MasterAgent), Notifications, Agentic Commerce, and Semantic Layer. Available in Streamlit, Portal, and SOC Dashboard.
System-wide dark/light mode in the Portal and SOC Dashboard. Preference persisted to localStorage with anti-FOUT inline script. Portal sidebar adapts inline styles; CSS var override for all Tailwind utilities.
Real-time SOC 2 / GDPR / ISO 27001 / HIPAA / NIS2 posture in the SOC Dashboard. SVG gauge, per-standard progress bars, 168-snapshot in-process ring buffer for trend timeline, evidence download panel.
Business Intelligence hub inside the Community portal: Usage, Threats, Vendors, Costs, Compliance, Benchmarks, Predictions, Reports. Each tab lazy-fetches live data with mock fallback. Recharts + SVG gauge.
Single 4-step wizard provisions all 7 SMB governance modules (Vendor Governance, Incident Register, Prompt Library, Training Records, Cost Allocation, Supplier Risk, Business Intelligence). Idempotent — safe to re-run.
Per-layer OpenTelemetry spans across all 9 filter stages. Jaeger UI at :16686. Activate with OTEL_ENABLED=true.
GDPR Art. 17 right-to-erasure endpoint. ARQ cron for automated retention enforcement. SBOM/SLSA CI attestation.
Dataview dashboard, offline publish queue, XAI pipeline visualizer, scheduled scans. Sidebar with real-time reputation feed.
Protect your AI stack starting today
Docker deployment in 60 seconds. GDPR-compliant. Works with any LLM.
No lock-in · Cancel anytime · 99.95% SLA guaranteed