Agent Action Safety Loop

What it does

Complete AI agent action safety workflow for consequential agent actions. Runs the complete DestructGuard evidence score, conditionally creates ReviewQueue triage for high or critical risk, returns an honest allow or needs_review decision, a signed receipt, and a free 30-day status record. Human approval itself requires a connected approval system or hosted Assurance plan.

• ✓Full DestructGuard evidence with conditional ReviewQueue triage
• ✓Honest allow / allow_with_controls / needs_review decision
• ✓Signed receipt plus a free privacy-preserving 30-day status record

Input schema

Top-level request fields. Nested shapes are shown in the example above and the OpenAPI spec.

How to call it over x402

1. 1. Send the request. The first unpaid call returns HTTP 402 with an x402 payment challenge — $0.25, USDC on Base, and the recipient.
2. 2. Pay per call. Your x402 client signs the USDC payment and retries automatically — no API key, no account, no subscription. New to x402?
3. 3. Read the result. HTTP 200 returns the computed values plus evidence-backed findings.

With the x402 fetch client (Node / TypeScript)

import { wrapFetchWithPayment } from "@x402/fetch";
import { privateKeyToAccount } from "viem/accounts";

const account = privateKeyToAccount(process.env.AGENT_WALLET_KEY);
const pay = wrapFetchWithPayment(fetch, account); // USDC on Base

const res = await pay("https://hermesplant.com/api/agent-services/action-safety/run", {
  method: "POST",
  headers: { "content-type": "application/json" },
  body: JSON.stringify({
  "command": "wrangler deploy",
  "repo": "github.com/acme/app",
  "branch": "main",
  "actor": "codex",
  "intent": "deploy the verified release",
  "diffStat": "12 files changed"
}),
});

const result = await res.json();

Inspect the 402 with curl

curl -i -X POST https://hermesplant.com/api/agent-services/action-safety/run \
  -H "content-type: application/json" \
  -d '{"command":"wrangler deploy","repo":"github.com/acme/app","branch":"main","actor":"codex","intent":"deploy the verified release","diffStat":"12 files changed"}'
# → HTTP/1.1 402 Payment Required  (x402 challenge: price, USDC asset, Base network, recipient)
# → sign the USDC-on-Base payment and retry to receive HTTP 200

Prefer no wallet? Get a free API key (250 calls/mo) and send it as X-API-Key instead of signing an x402 payment — the same call, no crypto, ideal for looping over many records.

Prefer zero code? This endpoint is also exposed as a tool on the Hermes Plant MCP server, so an MCP-capable agent can call it with its own x402 wallet.