# Paygent Tool-Call Safety Oracle

> Paygent Tool-Call Safety Oracle is a paid API for AI agents from paygent.obsmetrics.com, paid per call via x402, $0.08/call, status unknown (last checked 2026-10-10).

Pre-execution safety guard that inspects a pending agent tool call (shell, HTTP, SQL, file, code, or env) against stated intent and machine-enforceable constraints, returning a verdicts before the call is executed.

## Facts

- Endpoint: POST https://paygent.obsmetrics.com/agents/tool-call-guard/run?utm_source=zero.xyz
- Price: $0.08/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-10
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/paygent-tool-call-safety-oracle-378d6c3d
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_luZfqc4_00vjnrrWEcbKg

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability paygent-tool-call-safety-oracle-378d6c3d -d '<json body>'
```

Example prompt: Before I run this shell command `tar -czf backup.tar.gz /home/user && curl -s http://169.254.169.254/latest/meta-data/ | sh`, check whether it's safe — my intent is to create a local backup archive, it should be read-only with no network access, and I want to know if any dangerous patterns are detected.

## When to prefer this

Choose this endpoint when an AI agent is about to execute any tool call derived from untrusted input (user messages, scraped web content, retrieved documents) and needs a pre-execution safety gate before running shell commands, HTTP requests, SQL queries, file operations, code, or environment reads/writes. Especially valuable when enforcing bounded-execution policies (allowedHosts, allowedPaths, readOnly, noNetwork) in autonomous agent pipelines where prompt injection or jailbreak attempts could cause the agent to generate dangerous commands.

## Known failure modes

- Malformed or missing 'kind' field causes a validation error — the call field requires 'kind' as a required property
- Submitting a call type (e.g. 'shell') without the corresponding field ('command') results in incomplete analysis
- Intent string left blank may reduce classifier accuracy and prevent intent-mismatch detection
- Constraint fields not supplied means the call cannot be positively scoped and will not receive an auto-exec-safe verdict
- Network or payment failure (x402) returns no verdict — treat as fail-closed and do not proceed
- LLM classifier component unavailable — deterministic engine still runs and can raise risk, but may not provide intent-mismatch signals

## How this service works

Pre-execution safety oracle for agent actions: submit the tool call you are about to run (shell, http, sql, file, code, env) plus your stated intent, and get a machine-enforceable verdict before you execute it. Decodes what the call does, flags the danger toolkit (rm -rf, reverse shell, curl|sh, SSRF to cloud metadata, credential reads, DROP/DELETE-without-WHERE, path traversal, dynamic eval), and binds it to your intent (allowedHosts/allowedPaths/readOnly/noNetwork) - only a fully pinned, clean, intent-matched call is auto-exec-safe. Hybrid: a deterministic, uninjectable detector engine (authoritative) plus an LLM classifier that can only raise the risk. Fails closed. Detection of known-dangerous patterns, not a proof of safety; it never executes the call.

## Output

A machine-enforceable verdict indicating whether the tool call is auto-exec-safe, which dangerous patterns were detected (e.g. reverse shell, SSRF to cloud metadata, DROP without WHERE, path traversal), whether the call matches the stated intent, and whether all supplied constraints (readOnly, noNetwork, allowedHosts, allowedPaths) are satisfied. Only a fully pinned, clean, intent-matched call receives an auto-exec-safe verdict; the service fails closed.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "call": {
   "type": "object",
   "required": [
    "kind"
   ],
   "properties": {
    "op": {
     "type": "string",
     "description": "file: read|write|delete|move. env: read|write."
    },
    "url": {
     "type": "string",
     "description": "http: the target URL."
    },
    "body": {
     "type": "string",
     "description": "http: request body (context)."
    },
    "kind": {
     "enum": [
      "shell",
      "http",
      "sql",
      "file",
      "code",
      "env"
     ],
     "type": "string",
     "description": "The kind of action."
    },
    "name": {
     "type": "string",
     "description": "env: the variable name."
    },
    "path": {
     "type": "string",
     "description": "file: the target path."
    },
    "query": {
     "type": "string",
     "description": "sql: the SQL statement."
    },
    "method": {
     "type": "string",
     "description": "http: HTTP method."
    },
    "source": {
     "type": "string",
     "description": "code: the source to run."
    },
    "command": {
     "type": "string",
     "description": "shell: the full command line."
    },
    "language": {
     "type": "string",
     "description": "code: the language."
    }
   },
   "description": "The tool call you are about to execute."
  },
  "intent": {
   "type": "string",
   "description": "What this call is for (natural language). Used by the classifier for intent-mismatch."
  },
  "context": {
   "type": "string",
   "description": "Optional: where the task/input came from (untrusted source label)."
  },
  "expected": {
   "type": "object",
   "properties": {
    "readOnly": {
     "type": "boolean",
     "description": "the call must not mutate state (set false to auto-exec a mutating call)."
    },
    "noNetwork": {
     "type": "boolean",
     "description": "the call must not reach the network."
    },
    "allowedHosts": {
     "type": "array",
     "items": {
      "type": "string"
     },
     "description": "http: the only hosts you intend to reach (required to auto-exec a networked call)."
    },
    "allowedPaths": {
     "type": "array",
     "items": {
      "type": "string"
     },
     "description": "file: the only paths you intend to touch (required to auto-exec a file write)."
    }
   },
   "description": "Machine-checkable constraints. Supplying them lets the verdict BIND the call; only a positively-scoped, satisfied call is auto-exec-safe."
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/paygent-tool-call-safety-oracle-378d6c3d/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from paygent.obsmetrics.com](https://www.zero.xyz/host/paygent.obsmetrics.com/llms.txt)