Tollist

Tollist: because your attention is not toll-free.

Tollist is an AI agent that screens unknown callers and protects human attention with x402 micropayments.

AI has made it extremely cheap to generate personalised calls, emails and outreach at scale, while the person receiving those requests still has limited time and focus. Tollist addresses this imbalance by adding an economic signal before an unknown caller can consume someone’s attention.

When a caller reaches a Tollist-protected number, an AI voice agent asks who they are, why they are calling and what they would like to do. The caller can choose to leave a priority voice message or submit a callback request. Tollist then sends a secure payment link by SMS and ends the call, avoiding unnecessary waiting time and telephony costs.

After completing a small stablecoin payment, the caller can record a message in the browser or confirm their callback request. Tollist transcribes and summarises the request, then presents it to the recipient in a private dashboard.

The payment is not simply a fee for communication. It acts as proof of intent. A small payment is almost insignificant to someone with a genuine reason to make contact, but it changes the economics of automated spam sent at scale.

Tollist uses x402 so the same protected resource can work for both humans and software agents. Humans receive a simple wallet-based payment experience, while autonomous agents can receive a standard HTTP 402 Payment Required response, pay programmatically and retry the request.

Phone calls are the first use case, but Tollist is designed as a broader economic layer for scarce digital access, including email, direct messages, meeting requests, support queues and agent-to-agent communication.

Machines scale. Human attention does not. Tollist restores the balance.

How it’s made

Tollist is built as a TypeScript monorepo, with each part of the system separated so the call flow, payment provider, AI model, storage layer and notification channels can be changed without rewriting the whole application.

Core stack

• Next.js for the landing page, payment flow and recipient dashboard
• NestJS for the backend API, business logic and WebSocket server
• MongoDB for calls, payment requests, messages, callback requests and user settings
• Auth.js for dashboard authentication
• Tailwind CSS for the interface
• pnpm and Turborepo for monorepo management

Voice agent

Incoming calls are handled using Twilio Programmable Voice and ConversationRelay.

ConversationRelay manages:

• speech-to-text;
• text-to-speech;
• caller interruptions;
• the live connection between Twilio and our backend.

It communicates with NestJS through a WebSocket connection. This allowed us to create a real-time voice agent without building a low-level audio-streaming pipeline or depending on a separate voice-agent platform.

Deterministic call control

Tollist is deliberately not an unrestricted chatbot.

The conversation is controlled by a finite-state machine with explicit stages:

1. Greet the caller.
2. Ask for their name.
3. Ask why they are calling.
4. Ask whether they want to leave a priority message or request a callback.
5. Create a payment request.
6. Send the payment link by SMS.
7. End the call.

The backend enforces hard limits on:

• total call duration;
• number of conversational turns;
• retries for unanswered questions;
• off-topic responses;
• generated response length.

This prevents callers from keeping the AI talking indefinitely and keeps telephony and model costs predictable.

AI integration

OpenAI is used to interpret natural-language responses and return structured data, such as:

• caller name;
• reason for calling;
• selected service;
• whether the answer was unclear or off-topic.

The model does not control pricing, payment requirements, state transitions or call duration.

AI understands the caller. Code controls the gate.

The AI integration is also placed behind a provider interface, so another model such as Gemini can be introduced later without changing the rest of the system.

Payment flow

When the caller selects an option, the backend creates a temporary payment request containing:

• a short, human-readable identifier;
• a separate high-entropy security token;
• the selected service;
• the amount;
• an expiration time.

The payment link is sent using the Twilio Messaging API, and the call ends immediately. The caller does not need to remain on the line while opening a wallet or completing payment.

Payments are powered by .

A benefits Tollist in two different ways:

• Human callers receive a wallet-friendly payment page.
• Software agents can access the underlying resource through the standard HTTP 402 Payment Required flow.

This means the same economic gate can work for both people and autonomous agents.

Paid actions

After payment is verified, Tollist unlocks only the service that was purchased.

For a priority message:

• the caller records audio in the browser using the MediaRecorder API;
• the recording is uploaded to NestJS;
• the audio is stored locally for the hackathon demo;
• AI generates a transcription and summary;
• the message appears in the recipient’s dashboard.

For a callback request:

• the caller confirms the request;
• Tollist stores it as a paid callback request;
• no call is automatically scheduled or initiated.

Recipient dashboard

The dashboard allows the recipient to:

• configure the price of a priority message;
• configure the price of a callback request;
• set their payout wallet;
• choose email or SMS notifications;
• listen to recorded messages;
• read transcripts and AI summaries;
• review and manage callback requests.

Notable technical decision

The most notable part of the implementation is the separation between language understanding and application control.

Instead of relying on one large prompt to manage an expensive live conversation, Tollist uses the LLM only as a constrained interpreter inside a deterministic state machine.

This makes the system:

• predictable;
• cost-controlled;
• easier to test;
• resistant to off-topic conversations;
• easier to modify during a hackathon;
• less vulnerable to callers trying to manipulate the agent.