Pontage

Payments for AI Agents, Without the Middleman

Pontage gates any Model Context Protocol tool behind a per-call USDC micropayment using the x402 protocol — and unlike the reference x402 deployments, it verifies and settles the payment directly against the chain, with no third-party facilitator in the path.

The name is the medieval toll paid to cross a bridge: the agent pays pontage; the gateway takes it straight across to the chain.

How It Works

The buyer signs an EIP-3009 transferWithAuthorization — a gasless authorization that moves USDC directly from the buyer's wallet to the seller's receiving address. The gateway only verifies the signature and broadcasts the authorization. It never custodies buyer funds and never holds spendable revenue; the single key it holds pays gas and holds dust.

Key Features

• No facilitator dependency: Verify + settle happen in-process over plain JSON-RPC. No hosted service, no third-party account, no facilitator economics.
• A reproducible attack-test harness: The paper Five Attacks on x402 found every audited open-source x402 SDK exploitable. Pontage ships each attack class as a runnable test that succeeds against a naive gateway and fails against this one.
• Payment bound to the exact request: The gateway issues the EIP-3009 nonce and binds it to a specific tool + argument set, closing the request↔payment binding gap that underlies most x402 replay attacks.
• Confirm-before-serve: Serving is gated on money moved, not on signature validity — the replay lock is an atomic nonce claim backed by a database unique constraint.

Stack

Python 3.12, FastAPI, the official MCP SDK, SQLAlchemy async, web3.py on Base (USDC / EIP-3009), with strict mypy and a network-free test suite built on an in-memory fake chain. Published on PyPI.