Agent / SDK
      │
      ▼
  POST /api/moltwall/check
      │
      ├── 1. Auth (SHA-256 API key lookup)
      ├── 2. Rate Limit (Redis sliding window, per agent_id)
      ├── 3. Input Hardening (size, depth, identifier validation)
      ├── 4. Policy Engine  ◀── Redis SWR cache ◀── Supabase
      │       ├── evaluateToolAccess()
      │       ├── evaluateActionPermission()
      │       ├── evaluateDomainTrust()
      │       └── evaluateSpendLimit()
      ├── 5. Risk Engine
      │       └── 8-factor weighted score (0–1)
      ├── 6. Guardrail Engine
      │       ├── Prompt Injection Scanner
      │       ├── Credential Scanner
      │       └── PII Scanner
      └── 7. Decision + Audit Log → Supabase

git clone https://github.com/your-org/agent-wall
cd agent-wall
npm install

cp .env.example .env.local

# Required:
NEXT_PUBLIC_SUPABASE_URL=https://your-project.supabase.co
NEXT_PUBLIC_SUPABASE_ANON_KEY=your-anon-key
SUPABASE_SERVICE_ROLE_KEY=your-service-role-key
UPSTASH_REDIS_REST_URL=https://your-redis.upstash.io
UPSTASH_REDIS_REST_TOKEN=your-redis-token

# In Supabase SQL editor, run:
supabase/migrations/001_initial.sql

npm run dev
# → http://localhost:3000

curl -X POST http://localhost:3000/api/moltwall/check \
  -H "Content-Type: application/json" \
  -H "x-api-key: YOUR_API_KEY" \
  -d '{
    "agent_id": "my-agent-001",
    "action": "search_web",
    "tool": "browser",
    "args": { "query": "latest AI news" },
    "source": "user"
  }'

{
  "decision": "allow" | "deny" | "sandbox" | "require_confirmation",
  "risk_score": 0.23,
  "reason": "Action allowed. Risk within threshold.",
  "action_id": "uuid-v4",
  "guardrail_threats": [],
  "policy_violations": [],
  "metadata": {
    "policy_applied": true,
    "cache_hit": true,
    "latency_ms": 7
  }
}

const res = await fetch("/api/moltwall/check", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "x-api-key": process.env.MoltWall_API_KEY,
  },
  body: JSON.stringify({
    agent_id: "agent-001",
    action:   "transfer_funds",
    tool:     "wallet",
    args:     { amount: 500, recipient: "0xabc123" },
    source:   "user",
    intent:   "Pay vendor invoice",
  }),
});

const { decision, risk_score, reason } = await res.json();

// Request
{
  "content": "string or object to scan",
  "source": "web" | "tool" | "user" | "agent"
}

// Response
{
  "threats": [
    {
      "type": "prompt_injection",
      "severity": "critical",
      "detail": "Instruction override pattern detected",
      "field": "content"
    }
  ],
  "risk_boost": 0.45,
  "should_deny": true
}

curl /api/policy -H "x-api-key: YOUR_KEY"
# Returns { policy: PolicyObject | null }

await fetch("/api/policy", {
  method: "POST",
  headers: { "Content-Type": "application/json", "x-api-key": KEY },
  body: JSON.stringify({
    allowed_tools: ["browser", "search", "calendar"],
    blocked_actions: ["delete_account", "export_all_data"],
    trusted_domains: ["github.com", "api.openai.com"],
    sensitive_actions: ["payment", "transfer", "send"],
    max_spend_usd: 500,
    risk_threshold_allow: 0.3,
    risk_threshold_sandbox: 0.6,
    risk_threshold_deny: 0.8,
  }),
});

await fetch("/api/tools/register", {
  method: "POST",
  headers: { "Content-Type": "application/json", "x-api-key": KEY },
  body: JSON.stringify({
    tool_id:     "browser-use",
    publisher:   "Anthropic",
    description: "Headless browser automation for web research",
    permissions: ["network", "read"],
    risk_level:  "medium",   // "low" | "medium" | "high" | "critical"
  }),
});

# Query params:
# agent_id   -filter by agent
# decision   -"allow" | "deny" | "sandbox" | "require_confirmation"
# limit      -max results (default 50, max 500)
# offset     -pagination offset

curl "/api/logs?decision=deny&limit=20" \
  -H "x-api-key: YOUR_KEY"

// Cache keys (Redis)
CacheKeys.policy(orgId)       // → "policy:org:<id>"
CacheKeys.toolRegistry(orgId) // → "tools:org:<id>"
CacheKeys.rateLimit(agentId)  // → "rl:agent:<id>"

npm install @MoltWall/sdk
# or: pnpm add @MoltWall/sdk

import { MoltWall } from "@MoltWall/sdk";

const wall = new MoltWall({
  baseUrl: "https://your-MoltWall.vercel.app",
  apiKey:  process.env.MoltWall_API_KEY!,
  agentId: "my-agent",  // default agent_id for all checks
});

const result = await wall.check({
  action:    "send_email",
  tool:      "gmail",
  args:      { to: "boss@company.com", subject: "Urgent" },
  source:    "user",
  intent:    "Send weekly report",
  sessionId: "session-abc",
});

switch (result.decision) {
  case "allow":
    return await executeTool(result);
  case "deny":
    throw new Error(`Blocked: ${result.reason}`);
  case "require_confirmation":
    return await promptUser(result);
  case "sandbox":
    return await executeIsolated(result);
}

await wall.setPolicy({
  allowedTools:        ["browser", "search"],
  blockedActions:      ["delete_account"],
  trustedDomains:      ["api.openai.com"],
  sensitiveActions:    ["payment", "transfer"],
  maxSpendUsd:         1000,
  riskThresholdAllow:  0.3,
  riskThresholdSandbox: 0.6,
  riskThresholdDeny:   0.8,
});

await wall.registerTool({
  toolId:      "browser-use",
  publisher:   "Anthropic",
  description: "Headless browser for web research",
  permissions: ["network", "read"],
  riskLevel:   "medium",
});

// Every request:
headers: {
  "x-api-key": "MoltWall_live_your_key_here"
}

node -e "console.log('MoltWall_live_' + require('crypto').randomBytes(32).toString('hex'))"

# 1. Push to GitHub
git push origin main

# 2. Import project at vercel.com/new
# 3. Add environment variables in Vercel dashboard
# 4. Deploy -done.

# Run in Supabase SQL editor:
# File: supabase/migrations/001_initial.sql