MNNR is authorization and evidence infrastructure for agent-initiated payment workflows. It identifies actors, binds mandates, evaluates transaction intents against policy, and preserves decision evidence above existing payment infrastructure. MNNR does not move or custody money, issue cards, or replace a payment processor.

Does MNNR move money or settle payments?

No. MNNR evaluates whether an agent-initiated transaction intent is authorized under its mandate and policy, records the decision with reason codes, and exports evidence. Payment execution remains with your existing payment infrastructure.

Is MNNR compliant with PSD3, MiCA, or GDPR?

MNNR provides PSD3/PSR-aligned authorization controls and is designed to support MiCA and EUDI Wallet trajectories, with privacy-by-design data handling. MNNR does not certify compliance or guarantee regulatory outcomes; compliance determinations remain with the customer.

What does MNNR record for audit purposes?

Each evaluated transaction intent produces a decision record with reason codes, the policy and mandate versions applied, and an exportable evidence package (JSON or CSV) for internal oversight and review.

Security - MNNR

Live security headers

Probed server-side from https://mnnr.app/ just now. Refresh the page to re-probe.

Header	Status	Observed value
Strict-Transport-Security HTTPS-only for at least 1 year, including all subdomains. Expected: `max-age >= 31536000; includeSubDomains; preload`	✓ PASS	`max-age=63072000; includeSubDomains; preload`
Content-Security-Policy Nonce-bound CSP set per-request in middleware. Blocks inline scripts/eval. Expected: `no 'unsafe-inline', no 'unsafe-eval'`	✓ PASS	default-src 'self'; script-src 'self' 'nonce-YWQwYTYyZjItNmVkYy00NjllLWJlYzYtNGQ1NzI0ZjA2OGRh' https://challenges.cloudflare.com https://js.stripe.com https://.clerk.accounts.dev https://.clerk.com https://clerk.mnnr.app https://.clerk.services https://clerk-telemetry.com https://us-assets.i.posthog.com; style-src 'self' 'nonce-YWQwYTYyZjItNmVkYy00NjllLWJlYzYtNGQ1NzI0ZjA2OGRh' https://fonts.googleapis.com; img-src 'self' data: blob: https:; font-src 'self' data: https://fonts.gstatic.com; connect-src 'self' https://.neon.tech https://challenges.cloudflare.com https://api.stripe.com https://m.stripe.com https://m.stripe.network https://eth-mainnet.g.alchemy.com https://base-mainnet.g.alchemy.com https://.clerk.accounts.dev https://.clerk.com https://clerk.mnnr.app https://.clerk.services https://clerk-telemetry.com https://us.i.posthog.com https://us-assets.i.posthog.com https://.ingest.sentry.io https://.ingest.us.sentry.io https://.sentry.io; frame-src 'self' https://challenges.cloudflare.com https://js.stripe.com https://hooks.stripe.com https://*.clerk.services; worker-src 'self' blob:; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; upgrade-insecure-requests; report-uri /api/csp-report
X-Frame-Options Prevents clickjacking by disallowing framing entirely. Expected: `DENY`	✓ PASS	`DENY`
X-Content-Type-Options Forbids MIME-type sniffing. Expected: `nosniff`	✓ PASS	`nosniff`
Referrer-Policy Limits referer leakage to other origins. Expected: `strict-origin-when-cross-origin (or stricter)`	✓ PASS	`strict-origin-when-cross-origin`
Permissions-Policy Disables powerful browser APIs we do not use. Expected: `camera=(), microphone=(), geolocation=()`	✓ PASS	`camera=(), microphone=(), geolocation=(), payment=(self), usb=(), magnetometer=(), gyroscope=(), accelerometer=()`
Cross-Origin-Opener-Policy Isolates browsing context group - kills Spectre-class cross-window attacks. Expected: `same-origin`	✗ FAIL	`same-origin-allow-popups`
Cross-Origin-Embedder-Policy Forces explicit opt-in for cross-origin embedded resources. Expected: `require-corp`	✗ FAIL	`unsafe-none`
Cross-Origin-Resource-Policy Forbids other origins from loading our resources via <img>/<script>. Expected: `same-origin`	✓ PASS	`same-origin`

Security controls

CSRF Protection

Fail-closed in production. Tokens HMAC-signed with CSRF_SECRET. Missing secret aborts boot - the app will not start without it.

lib/security.ts (source) →

Rate Limiting

Upstash Redis required in production. Sensitive routes fall CLOSED (5xx) on backend error rather than open. Per-route tiers in middleware.

utils/rate-limit.ts (source) →

Row-Level Security (RLS)

All 7 production tables have RLS enabled. Policies bind to auth.uid() / app.current_user_id - there is no row a logged-in user can read that does not belong to them.

prisma/migrations/20260619000000_init_rls →

Authentication

Clerk required for /api/* and /dashboard. Unauth API requests return 401 + WWW-Authenticate: Bearer realm="mnnr-api" (not a 307 redirect).

middleware.ts (source) →

Payment Verification (x402)

On-chain transaction verification + replay protection via a unique tx_hash table. Currently feature-flagged off pending Base testnet smoke; flips to true once verified.

__tests__/unit/lib/x402-verify.test.ts →

Verify yourself in 60 seconds

Copy these commands. No account, no API key - they all run against production right now.

1. Confirm /api/keys is auth-gated (expect 401 + WWW-Authenticate):

curl -sI https://mnnr.app/api/v1/keys | grep -iE 'HTTP|WWW-Authenticate'

2. Confirm /api/health surfaces configured services (expect JSON, no secrets):

curl -s https://mnnr.app/api/health | python3 -m json.tool

3. Confirm security headers on the landing page:

curl -sI https://mnnr.app/ | grep -iE 'strict-transport|content-security|x-frame|x-content-type|referrer-policy|permissions-policy|cross-origin'

4. Confirm Turnstile widget is in raw HTML on mnnr.app:

curl -s https://mnnr.app/ | grep -c 'cf-turnstile'

Security at MNNR

Live security headers

Security controls

CSRF Protection

Rate Limiting

Row-Level Security (RLS)

Authentication

Payment Verification (x402)

CI & audit health

Documents

Verify yourself in 60 seconds

CAPTCHA (Cloudflare Turnstile)

Audit Logging