Frisk is a pre-transaction risk screening tool for autonomous AI agents, provided by the GitHub repository Jiangw2718i/frisk. Its core purpose is: before an AI agent pays an x402 seller or calls an unfamiliar tool, first determine whether the counterparty is trustworthy and whether the transaction complies with established policy.
Main capabilities Frisk returns one of three verdicts: allow, review, or block, along with a trust score and a human-readable reason. It is explicitly advisory: it does not hold funds and does not intercept payments, and the final decision is still made by the agent's code. The screening covers: whether the counterparty can be resolved to an address and is not on a blacklist, whether the payTo requested by the endpoint matches the specified counterparty, whether the endpoint is served over HTTPS, and whether the amount and asset fall within the provided policy range. In hosted mode, allow also means that no adverse reputation history was found.
Frisk does not judge the returned content, that is, whether the response matches the expected structure, whether it contains the data paid for, or whether it is worth the money; this falls under the buyer's own verification after the call. At the same time, allow does not mean safe in a general sense; in lite mode the confidence is always low, because the checks are structural: a counterparty with no history and no defects produces the same screening result as a counterparty with a long clean record.
How to use Frisk provides two SDKs, TypeScript and Python, both exposing the same model: a Client with a screen() call, a lite mode that runs locally with zero dependencies, and an optional hosted mode for obtaining reputation history and real-time threat intelligence. The TypeScript SDK is built on the platform fetch API (works in Node, Bun, Deno, Workers, and browsers); the Python SDK uses only the standard library. Both SDKs come with complete type information.
For agents that cannot import a library, and for scenarios that require asking questions interactively, the same checks are also provided as an MCP server, exposing one tool, screen_payment. No API key, no account, and with no configuration the screening is performed entirely on the local machine. The server is registered in the MCP registry as dev.tryfrisk/frisk.
Note: MCP tools only run when the model chooses to call them, so a check the model can skip has weakerassurance than performing the same check on the code path that signs the payment. Where funds actually move, the SDK should be preferred.
Applicable scenarios and limitations Frisk is suitable for autonomous AI agents that need to pay x402 sellers or call unfamiliar tools, and can be used as pre-payment screening on the code path, or for interactive questioning via the MCP tool. Its design principles include: advisory rather than intervening in the path, zero runtime dependencies, and fully typed.
In terms of limitations: lite mode can only catch obvious problems (malformed counterparties, payTo substitution, insecure endpoints, policy violations, and a small seed blacklist), and the confidence is always low; checks corresponding to inputs that are not provided will not run and will not fail, for example, omitting observedPayTo means no payTo comparison occurs; it does not evaluate the quality of the returned content. The hosted API is located at https://api.tryfrisk.dev，额外受服务条款约束。仓库另提供 documentation such as CONTRIBUTING.md and SECURITY.md.
