m2m-sentinel-sdk

M2M Sentinel SDK is the official multilingual client library for M2M Sentinel, and also provides a Model Context Protocol (MCP) server and a Coinbase AgentKit ActionProvider. It is aimed at autonomous applications running on Base and provides deterministic EVM bytecode capability observation and common proxy resolution. The caller has the final say over the transaction strategy.

Main capabilities

• EVM bytecode capability analysis: performs deterministic observation on the bytecode of a given address, returning factual capability evidence and limitations, rather than security guarantees or transaction advice.
• Common proxy resolution: supports the resolution of common proxy patterns such as EIP-1967.
• Multilingual SDK: provides JavaScript, TypeScript, and Python clients.
• MCP server: can connect to Claude Desktop, Cursor, Windsurf, or any MCP-compatible LLM agent.
• Coinbase AgentKit integration: provides an ActionProvider.
• Base Account wallet_sendCalls guard: guardWalletSendCalls is a client-side execution identity boundary for Base Account / EIP-5792 batching. It first prechecks the anchor call and evaluates the caller's policy, then schedules the remaining calls, and pins the remaining calls in waves of at most four to the first trusted block identity. After each wave settles, verification and policy checks are performed in ascending order of the request index, and failure or rejection stops subsequent scheduling. Only after all checks pass does it forward the original separated requests. It does not sign, does not broadcast, does not custody funds, does not infer internal UserOperation semantics, and makes no security claims.
• Transaction preflight example: the public repository contains a simulation-only transaction boundary example examples/transaction_preflight.js, which observes a caller-provided Base transaction, passes the observation results to a caller-owned policy, and only reaches the simulated signing/sending callback. It refuses to continue when the evidence is unverified, execution is unresolved, observations do not match, or the Diamond selector mapping is missing. It never signs or sends transactions; the optional live mode uses only caller-provided API key headers, and is the caller's responsibility.
• Autonomous x402 micropayments: supports headless machine-to-machine(M2M) scenarios.

Usage

• MCP server: can be installed with one click via Smithery, or use local Stdio (claude_desktop_config.json), or remote Streamable HTTP. Current MCP endpoint:https://api.m2msentinel.com/mcp；旧版 HTTP+SSE compatible endpoint:https://api.m2msentinel.com/sse，消息地址：https://api.m2msentinel.com/messages。
• JavaScript/TypeScript client: provides an authentication SDK quick start.
• Python client: provides transaction-specific preflight examples.
• Quick try: you can use the Base USDC example address 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913 for a quick try without a wallet or API key. The response contains factual capability evidence and limitations, not security guarantees or transaction advice. The live demo may be rate-limited (HTTP 429 with Retry-After) or unavailable when the upstream evidence source fails (HTTP 503). Other addresses only receive a public preview. Full /v1/audit/:address analysis remains protected by an API key or explicitly authorized x402 payment; the demo will not silently pay. The client will not automatically retry or fall back to the protected route after a demo error. The source code SDK export includes a runnable credential-free JavaScript example examples/try_public_demo.js, but it is not included in the last verified npm 1.2.7 artifact.

Use cases

• Autonomous applications or agents running on Base that need bytecode capability observations and proxy resolution before transactions.
• LLM agents using MCP (such as Claude Desktop, Cursor, Windsurf) that need to integrate on-chain intelligence.
• Developers using Coinbase AgentKit who need an ActionProvider.
• Scenarios requiring Base Account / EIP-5792 batching preflight and policy evaluation.
• Headless machine-to-machine micropayment scenarios.

Limitations

• The caller owns the transaction strategy; the SDK does not provide security guarantees or transaction advice.
• It does not sign, broadcast, or custody funds.
• Full analysis requires an API key or x402 payment.
• The demo may be rate-limited or unavailable.
• The client will not automatically retry or fall back to the protected route.
• The current export marks npm 1.2.8 as a local release candidate, not a verified release artifact; this candidate does not establish registry publication or installability. Installation commands use the last verified npm release 1.2.7.
• License: MIT License. Copyright (c) 2026 M2M Sentinel.