# Monarch Shield

Monarch Shield is an open-source, import-aware CI linter for selected automatic x402 v2 buyer-payment calls.

Run it locally:

```bash
npx @monarch-shield/x402@0.2.0 doctor
```

Run it in CI:

```bash
npx @monarch-shield/x402@0.2.0 doctor --ci --strict
```

Use Doctor when reviewing JavaScript or TypeScript that imports official x402 Fetch, Axios, MCP, or core-client buyer APIs.

Doctor:

- parses supported source files and tracks selected imports, aliases, clients, and source order
- flags supported x402 payment creation without a recognized policy seam
- accepts specific syntactic abort or denial returns on the same x402 client path and trusted Monarch callbacks
- fails closed on selected incomplete-analysis conditions
- returns a failing exit code for unsafe findings in CI
- can emit SARIF
- runs without an account or API key

Evidence boundary:

- import-aware, single-file static analysis only
- does not cover custom or cross-file wrappers, unsupported languages, computed code, or every x402 API
- can report false positives
- does not verify policy quality, authorization, amounts, runtime behavior, settlement, delivery, compliance, or production readiness

The local `checkPayment` and `checkBeforePayment` helpers evaluate caller-supplied evidence. They do not independently verify it. A supplied callback is returned behind an explicit `execute()` closure and never runs implicitly. Monarch Shield 0.2.0 has no hosted payment-check API or usage reporting.

Primary resources:

- Source: https://github.com/ghostmonarch/x402ms
- Documentation: https://x402ms.ai/docs/
- First-party evidence: https://x402ms.ai/proof/
- Adversarial benchmark: https://x402ms.ai/docs/adversarial-benchmark.html
- GitHub Action: https://x402ms.ai/docs/github-action.html
- Agent instructions: https://x402ms.ai/AGENTS.md
- Full boundary and examples: https://x402ms.ai/llms-full.txt