feat(relayshield): add RelayShield action provider

[nzdsf2-gif]

Description

Adds a RelayShield action provider with four screening actions, each paid per call over x402 from the agent's own wallet.

Action	Answers	Price
screen_wallet	Is this counterparty address associated with scams, exploits, drainers or sanctions?	$0.05
check_token_security	Is this token a honeypot, mintable, blacklistable or otherwise restricted?	$0.05
check_nft_security	Is this NFT collection fake, copied or transfer-restricted?	$0.10
screen_url	Is this link phishing or malware?	$0.05

screen_wallet detects the chain from the address format and covers EVM, Solana, TON and Bitcoin, so the agent never has to ask the user which chain an address is on.

Why no API key

The endpoints answer with an HTTP 402 challenge and the agent's wallet settles in USDC in the same request cycle. There is no account to create and no key to store or rotate, which is the only shape that works when the buyer is software. This reuses the same x402Client / wrapFetchWithPayment / registerExact*Scheme pattern as the existing x402 action provider rather than introducing a second payment path.

supportsNetwork returns true for base-mainnet and solana-mainnet. That reflects where a payment can settle, not which chains can be screened, and the README says so explicitly to avoid the obvious misreading.

A failed check is never reported as a clean one

If the endpoint errors or the payment fails, the action returns a message stating plainly that the check did not complete and the item should be treated as unverified. A screening tool that looks like it found nothing when it actually failed is worse than one that admits it could not answer, and there are tests covering both the non-200 and the thrown-error paths.

The action descriptions also instruct the model to report a clean result as "nothing currently known against it" rather than as a safety guarantee.

Testing

• pnpm exec jest src/action-providers/relayshield — 9 tests, all passing, covering network support, argument-to-body mapping for each endpoint, a HIGH verdict passing through unchanged, and both failure paths.
• pnpm run build — clean.
• pnpm run lint — clean.
• pnpm run format — clean.
• Full suite re-run to check for regressions: 61 suites, 873 tests, all passing.

Not tested: a live end-to-end paid call against a funded wallet. The tests mock wrapFetchWithPayment, so the payment path itself is exercised only through the same interface the x402 provider uses. Flagging that rather than implying broader coverage than exists.

The endpoints themselves were verified live before submitting: all four return a well-formed 402 challenge with USDC payment options on both Base and Solana.

Checklist

• Changeset added (patch, per the contributing guide's guidance for new action providers)
• README for the action provider
• Export added to action-providers/index.ts, in alphabetical position
• Generated with generate-action-provider rather than hand-rolled

[cb-heimdall]

🟡 Heimdall Review Status

Requirement	Status	More Info
Reviews	🟡 0/2	Denominator calculation Show calculation 1 if user is bot 0 1 if user is external 0 2 if repo is sensitive 0 From .codeflow.yml 1 Additional review requirements Show calculation Max 0 0 From CODEOWNERS 0 Global minimum 0 Max 1 1 1 if commit is unverified 1 Sum 2