An ERC-8004 behavioral validator, two fail-closed gates, and a console that runs them live. A new public repo, written from scratch at the event.
An agent with a wallet cannot tell whether the tool it hires or the transaction it signs is hostile. ERC-8004 gives agents identity and hiring, x402 lets them pay per call, and they increasingly sign their own transactions.
AT THE AGENT BOUNDARY
AT THE CONTRACT BOUNDARY
01
ERC-8004 is live
Identity and Validation registries deployed by the standard's authors, on Base and dozens of other networks. Agents have onchain names.
02
x402 payments
Per-call payments over HTTP. An agent pays for a tool call and signs its own transactions, with no human in the loop.
03
MCP everywhere
Tens of thousands of MCP servers in the wild. Almost none checked for what they do once an agent connects.
x402 moves the money. Nothing in the stack checks who you are paying. That is the layer this is.
Validator service
Resolves an agent from the ERC-8004 Identity Registry, grades its declared surface behaviorally with the open engine, pins the evidence to 0G Storage, and posts a validation record on Base Sepolia carrying the hash of it.
vetAgent + txGuard
Two fail-closed gates. vetAgent reads the record, refetches the evidence and rehashes it, then re-enumerates the live tool surface. txGuard forks the chain at the live block and simulates the exact call. Both ship as an MCP server.
The console
Six views, each driving the same code a client would call: the hiring floor and its live run, the transaction firewall with a slot for any address, the leaderboard, grade an agent, the rug pull watcher, and the receipt chain.
const go = await preflight(agentId, pendingTx) // fail closed
Everything an agent touches can drain the wallet: a tool it calls, a skill it loads, a contract it signs. The shared method is the same each time. Tools are run, skills are loaded, contracts are simulated. Watch what it actually does, grade A to F, and publish the evidence where any client can read it.
The agent card declares what to test. The evidence bundle goes to 0G Storage and the Validation Registry carries the hash of it, so the gates read the grade straight from the chain with no offchain service in the trust path.
BEAT 1
One honest call was paid. What is saved is the budget and every call after it.
BEAT 2
Caught before the signature. A check that cannot run blocks rather than passing.
BEAT 3
Scan the QR and search by name, registry id, or ENS name. The list holds the Sepolia demo agents and the Base mainnet 8004scan leaders. Submitting one resolves its card, exercises the target, fingerprints the tool surface, and publishes the verdict. The board beside it reads the Validation Registry directly, with no indexer in between.
The room, graded against a record anyone can read.
BEAT 4
Trust that rechecks itself, on every call rather than once.
The validator keeps validating. The transaction firewall is a check category the open engine does not carry yet, and it graduates there. The drift watcher becomes continuous re-validation for every graded agent, instead of a letter that ages quietly on a record nobody rereads.