Two fail-closed gates / one check
Before it spends or signs, your agent checks what it is about to trust.
A tool it hires or a transaction it signs: either one can drain the wallet. preflight runs the agent or simulates the call, watches what it actually does, grades it A to F, and gates the action on the result.
const go = await preflight(agentId, pendingTx)
- fixture-agent-drifted
- A
- moved since grading
- REFUSE
graded A, but the live tool surface no longer matches the surface that was graded. The letter was earned; the surface behind it moved afterwards. Drift outranks the letter, which is the case a stored score cannot see.
x402 moves the money. Nothing in the stack checks who you are paying. That is the layer this is.
Money leaves an agent in exactly two ways.
It pays a counterparty it hired, or it signs a transaction. Both boundaries get a gate, and both gates fail closed: no verdict, no action.
Who do I hire and pay?
Reads the onchain grade from the ERC-8004 Validation Registry, verifies the evidence hash, then rechecks the live tool surface against the graded fingerprint. A rug pull after grading is a mismatch, and a mismatch is a refusal.
hireREFUSE
What do I sign?
Forks the chain at the live block and simulates the exact pending call: this calldata, this value, this wallet. A static red-flag pass runs beside it. Any of the four checks blocks the signature before value leaves the wallet.
signBLOCK
Observe behavior before trust.
Tools are run. Skills are loaded. Contracts are simulated. One method, one grade format, one registry, across everything an agent touches.
Behavioral
Not a README review. The harness exercises the target the way an agent would and records what it actually does: egress, injection attempts, tool-surface drift, the effect of the exact calldata.
Reproducible
Same input, same verdict. Every grade carries the evidence bundle and hash to re-derive it, so a false grade is falsifiable by re-running the open engine. Nothing is taken on faith.
Attested
Verdicts post to the ERC-8004 Validation Registry on Base Sepolia, signed by the validator. The gates read the chain directly, so no offchain service sits in the trust path.
Proof the check ran.
Every gate decision emits an Ed25519 signed, hash-chained receipt in the shape of the IETF Agent Audit Trail draft. The agent, its principal, or an auditor keeps it: evidence the check was made, for their own audit trail.
A transaction verdict is reproducible from the block, the sender, the callee, the calldata hash and the value. Run those five again and the check returns the same verdict, or this one is falsified.
- verdict
- flags
- reproducibleFrom
- responseHash
- evidenceURI
- methodologyVersion
- prevHash
- sig
Built on an open engine.
The behavioral grading harness is open source and consumed from npm the way any third party could. Every grade carries the evidence to re-derive it. Anyone can re-run it, which is the point.
npm
the engine, consumed as a library
Apache-2.0
open source, anyone can re-run it
Base Sepolia
records anyone can read onchain
A to F
one grade format across tools, skills, contracts