AgentRisk M2M has been a pay-per-call API since launch: 0.15 USDC via x402, no signup. That's great for autonomous agents that already have a wallet and a reason to call you. It's a terrible experience for a human who just wants to see if your tool is any good before committing to anything.
So I added a public web UI with a twist: connect a wallet (just a signature, no funds touched), and get 3 completely free scans — the exact same full analysis a paying customer gets, not a stripped-down demo.
Why the same analysis, not a limited preview
A lot of "free trial" designs give you a watered-down taste — fewer fields, vaguer verdicts — specifically to create FOMO for the paid tier. I didn't want that. If someone's evaluating whether to trust this tool with their trading decisions, showing them a deliberately weaker version defeats the point. The free scan returns honeypot detection, live sell simulation, LP lock verification, deployer wallet freshness, and brand impersonation checks — everything.
Why wallet-gated instead of just... open
The obvious question: why not just let anyone hit the endpoint unlimited times? Two reasons. First, abuse — without some identifier, nothing stops one person from burning the free tier in a loop. A wallet address is harder to mint infinitely than an IP address behind a VPN. Second, honestly: it makes the "3 free checks, then it's 0.15 USDC" transition feel less like a sudden paywall and more like a natural continuation — you're already connected, the door to paying is right there.
What happened when I tried to make the paid path work in-browser too
I initially wanted the full loop to work end-to-end in the browser: free checks, then seamlessly pay for more, no code required. I got surprisingly far — Coinbase's official @x402/fetch and @x402/evm packages do work in a browser via ES module imports from a CDN, no build step needed. I got a real TransferWithAuthorization (EIP-3009) signature request to render in MetaMask.
Then MetaMask's Blockaid integration flagged it as a "deceptive request" — the payment wallet, being new with limited on-chain history, tripped an "untrusted EOA" heuristic. Nothing was actually wrong with the transaction; it's a reputation-scoring false positive that new legitimate addresses run into constantly.
I could chase a Blockaid allowlist request, but stepping back, I realized the audience for in-browser payment doesn't really exist here. Someone who wants to keep using the API programmatically is going straight to the GitHub repo and writing two lines of Python. An autonomous agent doesn't touch a browser at all — it calls the endpoint directly with x402-fetch or the Python SDK. The only people who'd hit the in-browser payment flow are casual visitors who've already gotten their 3 free looks and are deciding whether to go further — and for them, a clear "grab the code" button is a more honest next step than fighting a wallet's fraud heuristics.
Where it stands
Free checks are live at agentrisk.dev. After the third one, there's a straightforward link to the repo instead of a payment prompt that might scare people off with a false-positive warning. Sometimes the right fix isn't debugging the flow further — it's noticing the flow wasn't the right one for the audience in the first place.
Repo: github.com/Neurobyteio/agentrisk
Top comments (0)