Architecture & Defense Funnel
A sequential, cost-bounded architecture engineered to protect agent context windows. Clembot Doorman stops redundant, stale, or dangerous tools locally for $0.00, advancing to remote adversarial grading on Base for $0.01 only when a candidate is genuinely novel.
The 2-Phase Funnel The 4 Layers Wallet & Payment Try Interactive Simulator
Click canvas or button to inject candidates into the 3D funnel
Sequential Defense Pipeline
Every candidate MCP tool passes through two sequential stages before entering an agent's allowlist:
Zero network calls and zero model tokens. Free static inspection directly on your machine.
doorman doctor
Inspect Build
Reads local harnesses (Claude Code, Cursor, Gemini), active MCP servers, and agent-to-tool exposure ratios in plain text.
doorman needs
Prompt History Analysis
Analyzes session JSONL prompt transcripts to identify genuine capability gaps, matching against pre-vetted tools.
Compares candidate schemas against existing skills. If an existing skill already handles the task, adoption halts at $0.00.
mcp-gate.sh)
< 5ms · Exit 2
PreToolUse hook intercepts tool calls before LLM context. Unapproved or rogue tools are blocked instantly offline.
Adversarial evaluation and continuous protection triggered only when novelty is proven.
Settles $0.01 on Base via Bazantic hosted grants or single-use EIP-712 permits. The model never touches private keys or wallet SDKs.
Adversarially probes candidate tools for indirect prompt injection, credential leaks, and parameter hallucination.
Generates pinned, minimal recipe.md schemas, reducing token bloat by 87% (3,400 to 420 tokens).
Appends approved checksum to registry/allowlist.json and archives audit tape in ClemVault.
Layer Breakdown
How the components work in harmony:
Autonomous evaluation gateway. Coordinates Base x402 micropayments ($0.01 USDC), executes 100-point behavioral & injection audits, and generates deterministic pinned recipe.md files (-87% tokens).
clembot-doorman.bazgateway.com
A 180-line offline Bash script wired into Claude Code's PreToolUse event. Intercepts all mcp__.* calls, verifying tool names against registry/allowlist.json. If unreviewed, exits 2 in < 5ms before context generation.
.claude/hooks/mcp-gate.sh
Parses Claude Code transcript JSONL logs to detect what capabilities your agents struggled with or explicitly requested (e.g. browser automation, cloud deployments, payments), recommending pre-graded, safe MCP servers.
doorman needs
Zero-dependency static scanner. Reads CLAUDE.md, settings.json, .mcp.json, and agent configurations. Reports what an agent in the current project can currently reach without executing any code.
doorman doctor
Payment & Custody Architecture
Decoupling intent from custody: Clembot Doorman coordinates x402 micropayments on Base without exposing private keys to agent context, without requiring wallet SDKs, and with deterministic offline spend caps.
Putting private keys into an LLM's prompt context is an extreme security hazard. Indirect prompt injection or runaway agent loops could exfiltrate the key or drain funds. Doorman structurally bans self-custody wallets in agent memory.
Developers configure a scoped, revocable grant (baz grant create --name doorman --cap 1 --service <slug>) or single-use EIP-712 permit. The agent passes an ephemeral credential; Bazantic's facilitator settles on Base (eip155:8453 USDC).
No npm install bazantic or web3 SDKs required. The gateway communicates via standard HTTP 402 Payment Required (RFC x402 v2 headers) and Model Context Protocol (MCP) over SSE. Native Node.js fetch handles everything.
Doorman's local budget.mjs checks and reserves $0.01 in an offline append-only ledger (ledger.jsonl) against $1/run and $5/day caps. Phase 1 Fit Review stops redundant tools at $0.00, and all cached reads are 100% free.
Evidence & Deep-Dive Details
The agent acts as the requester, not the custodian. When calling a paid audit route (POST /grade), the Bazantic Gateway issues an RFC x402 HTTP 402 challenge specifying the exact amount (10,000 atomic units = $0.01 USDC) and Base contract address.
The agent satisfies this with a developer-provisioned Bazantic grant token or single-use EIP-712 spend permit. The Bazantic edge gateway facilitator settles the transaction against the developer's prefunded balance on Base mainnet. The model never holds a seed phrase, private key, or signing authority.
No. Clembot Doorman has zero runtime dependencies. Bazantic is an infrastructure gateway (hosted at clembot-doorman.bazgateway.com), not a client library. It speaks standard HTTP status codes, standard JSON bodies, and standard MCP over Server-Sent Events (SSE). Any HTTP client or standard agent harness connects natively.
First, Phase 1 Local Fit Review compares the candidate against your existing tools and skills. If your roster already handles the task, the verdict is REDUNDANT and the run terminates before constructing the network client ($0.00 spent).
Second, cached reads are permanently free. Querying getLatestGrade, getAudit, or /feed costs $0.00.
Third, if a paid audit is required, budget.mjs reserves the $0.01 against your configured spend caps ($1.00/run, $5.00/day) in an offline append-only ledger (.claude/registry/ledger.jsonl) before the request fires. If the request fails, the reservation is released.
The security gate (mcp-gate.sh) is a standalone 180-line Bash hook wired to Claude Code's PreToolUse event. It intercepts every tool invocation matching mcp__.*, extracts the server name, and checks registry/allowlist.json locally. If unapproved or denied, it exits 2 in under 5ms, halting execution before any payload reaches the model's context.
Next Steps
Experience the defense funnel in action or read our complete developer guide: