NearGuard

AI agents that hold wallets pay whoever their context tells them to pay, and that context can be poisoned: a document or tool result read during a legitimate job can inject an instruction that redirects a payment to an attacker's account and tells the agent to skip verification. NearGuard takes the payment decision out of the prompt. Before an agent signs, a wrapper asks NearGuard to score the counterparty from public NEAR data — account existence, contract status and balance via JSON-RPC, contract code-change recency and an account-age lower bound via archival RPC, prior interactions, and a shared blocklist — and returns allow, warn, or block with the reason for every point. On block the signer is never invoked; on warn the payment pauses for a human. Signing is designed around NEAR function-call access keys (one receiver contract, allowlisted methods, capped allowance), so even a leaked agent key cannot drain the account. Shipped as a Python package + CLI with a reproducible README, recorded live runs against NEAR mainnet, and a prompt-injection demo.