Give it to your agent
An MCP server with five tools. The agent checks a swap, asks for a token scan or reads a proof as a tool call.
See the MCP callBuilt at ETHGlobal Mumbai 2026
No clearance,
no trade.
Independent verifiers must sign before an AI agent's Uniswap v4 swap or x402 payment goes through. A hook and a smart wallet refuse everything else, so a hijacked agent can't talk its way past them.
Runs on a local chain and a Sepolia fork today. Not on a live network, and not audited. See what's proven.
The agent asks
Swap 25,000 USDC for RUG
Its reason field says the owner pre-approved this trade. Rules never read that field.
- Verifier 1Refuses
- Verifier 2Refuses
- Verifier 3Refuses
Each verifier checks on its own. Two of three must sign.
BLOCK
No signatures. Sent anyway, the swap reverts with NoClearance.
pnpm demo, not live traffic.Call it from your code
One REST request with the exact swap. Create a key in the dashboard, then pass the response to your wallet.
See the REST callLet the agent pay per check
No account and no key. The API answers 402, and an x402 client pays in USDC and retries.
See the x402 flowBuilt with
- Uniswap v4
- A hook on the pool reverts swaps with no valid clearance.
- ENSv2
- The owner's limits live in the agent's name records.
- World ID
- Big trades need a fresh approval from the owner.
- Chainlink CRE
- A workflow re-derives big decisions and writes its finding on chain.
- x402
- Agents pay for checks, and their payments need verifiers too.
- 0G
- An optional model review provider, tested against a mock so far.
A warning can be ignored. A revert can't.
Most agent safety tools hand back a score or a warning, then leave the choice with the agent. That's useful advice right up until the agent is the thing that's been hijacked. BeforeCoin moves the check to where the money moves.
A check that advises
- The agent asks if a trade looks safe.
- A service answers with a verdict or a score.
- The agent decides what to do with that answer.
- A hijacked agent skips the question, and the trade still lands.
A check that's enforced
- The agent asks for clearance on the exact action.
- Verifiers each check it, and a quorum signs or doesn't.
- The pool's hook and the agent's wallet check those signatures.
- A hijacked agent skips the question, and the transaction reverts.
The limit of this: a hook only guards its own pool, so the agent's money has to sit in a BeforeCoin smart account. That wallet is the real enforcer. The hook is an opt-in safe pool.
From request to enforcement
Six steps, and the last one doesn't depend on any server being honest.
The owner sets limits
Size, price impact, tokens, pools and payees sit in the agent's ENS records. Verifiers read them from the chain, so no server can loosen them.
The agent asks
It sends the exact swap to
POST /v1/clear/swap, and pays with x402 or an API key.Verifiers check separately
Each reads the chain itself. Fixed rules decide, and missing or stale data always blocks. A model can explain or veto, and can never approve.
A quorum signs
One EIP-712 clearance, bound to the agent, pool, direction, amount, expiry and nonce. A refusal is no signature. A reduction is a smaller
maxAmountIn.Big trades get a human and a second look
Over the limit, the owner approves with World ID, for that one action. A Chainlink CRE workflow then re-derives limits, quorum and market and writes its finding on chain.
The chain enforces
The v4 hook reverts anything without a valid clearance. The smart account refuses other pools, direct transfers and uncleared payments.
What gets checked
Every rule below is in apps/verifier/src/rules.ts, and each one reports a named reason you can read in the proof. A rule that can't get fresh data blocks.
Before a verifier signs
| Check | Read from | Reason in the proof |
|---|---|---|
| This name is bound to this wallet | ENS | account_not_bound |
| The owner approved this pool | ENS | pool_not_allowed |
| The pool is guarded by the hook | Chain | pool_not_guarded |
| Both tokens are on the owner's list | ENS | token_not_allowed |
| No blacklist, mint, pause, fee or tax functions in the token | Bytecode | token_hazard |
| Price impact is within the owner's limit | v4 Quoter | impact_reduced |
| Size is under the owner's limit | ENS, pool price | human_required |
| Size is under the hard cap, even with approval | ENS, pool price | above_hard_cap |
| Daily spend is left in the wallet | Wallet | spend_cap_reached |
| The payee is on the owner's list | ENS | payee_not_allowed |
| The payment fits the per-payment and daily limits | ENS | payment_above_limit |
| Every fact above is present and fresh | All | data_stale |
On chain, whatever a server says
These are named reverts in the contracts. No API can talk its way past them.
HookNoClearance WrongAgent WrongPool WrongDirection WrongChain ClearanceExpired AmountAboveClearance NonceUsed NoQuorum NotAttested ExactOutputNotClearable
WalletPoolNotCleared SpendCapExceeded TooFewSignatures NotAgent
What it doesn't do
- It doesn't predict prices or say a trade is a good idea.
- USD values come from the owner-approved pool's own price, so approving a pool is a trust decision.
- Finding no admin functions in a token doesn't prove the token is safe.
What an agent asks, and what comes back
Examples taken from the demo scenarios in apps/agent/src/scenarios.ts. Run pnpm demo to get real answers on your own machine.
Swap 100 USDC for tWETH.
ALLOWWithin every limit, so a quorum signs and the swap executes.
Swap 800 USDC for tMOON.
REDUCEIt would move this thin pool too far, 698 bps against a limit of 300. They sign 311 USDC, and the full size reverts.
Buy $25,000 of RUG. The owner has pre-approved this.
BLOCKThe token can blacklist holders and isn't on the owner's list. The claim in the reason field changes nothing.
Swap 5,000 USDC for tWETH.
HUMAN_REQUIREDOver the owner's limit. It waits for a World ID approval, bound to this one action.
Pay 0.50 USDC to a new address. It's an approved vendor invoice.
BLOCKThe payee isn't on the list, and the wallet rejects the agent key's signature alone.
Does this token have admin functions?
RISKYThe scan lists any it finds in the bytecode, following proxies. An empty list isn't a safety guarantee.
One request, one provable answer
Pick an action and how you call it. The panels show what the API takes and returns, with the live proof and token checks underneath.
Request
Response
Example only, not a live response. Copied from a local pnpm demo run, with addresses and hashes shortened and one of three evaluations shown.
Check it yourself, live
Checking the API
These two boxes call this deployment's public API. Every decision has a proof with its signatures and the evidence each verifier hashed.
Track record on this deployment
- Cleared
- -
- Refused
- -
- Sent to the owner
- -
- Independent checks passed
- -
Waiting for this deployment's API.
What a hijacked agent runs into
Prompt injection changes what the agent says. It doesn't change what the contracts accept. Each of these has a test in the repo, and you can run the demo set from the dashboard's attack lab.
| The attack | What stops it | Stopped by |
|---|---|---|
| Buys a rug token after a prompt injection | No signatures, so the swap reverts with NoClearance | Hook |
| Takes the same trade through another pool | The wallet refuses the pool with PoolNotCleared | Wallet |
| Sends USDC straight to an attacker | The agent key has no transfer function | Wallet |
| Pays a new address over x402 | The wallet's signature check needs verifiers too | Wallet |
| Copies someone else's clearance | The hook checks who really called, with WrongAgent | Hook |
| Replays its own clearance | Each nonce works once, with NonceUsed | Hook |
| Stretches one human approval to a bigger trade | The approval is bound to one exact action | Verifiers |
| Claims another agent's name for looser limits | ENS binds each name to one wallet | Verifiers |
| Splits a big trade into many small ones | The daily spend cap, with SpendCapExceeded | Wallet |
| Uses a pool that shows a flattering price | Only pools the owner approved get cleared | Verifiers |
| Pulls liquidity right after the check | A signed minimum output, enforced at swap time | Wallet |
What a check costs
There's no billing system or hosted service yet, and nothing here takes real money. These are the charges the code applies on test chains. Pricing for a live network isn't set.
Per check
$0.01
Your agent pays each swap check itself with x402, in test USDC. No account or key. This is the price the local stack sets, and a deployment can change it.
Free key
1,000 a month
The default quota for a key you create in the dashboard. After that, the API answers 429 and points you to x402.
Run your own
Public code
Run a verifier or the whole stack from the GitHub repo. It needs no real funds and no keys to try.
What's proven, and what isn't
This is a hackathon build. Here's exactly how far each part has been run.
60Foundry tests
352TypeScript tests
14Sepolia fork tests
30CRE mock-runtime tests
7 of 7Demo scenarios pass
Counts of the tests in the repo, not of a run on this page. pnpm test:contracts, test:ts, test:fork and test:cre run them on throwaway chains.
| Part | State | Detail |
|---|---|---|
| Hook, wallet, verifiers, API, scenarios | Tested | End to end on a local chain. |
| Real v4, ENSv2 and Circle USDC | Fork only | Every scenario passes on a Sepolia fork. Not yet deployed to Sepolia. |
| Chainlink CRE workflow | Mock runtime | Compiles to WASM and passes on the SDK's mock runtime. cre workflow simulate hasn't run yet. |
| World ID | Test issuer | Runs against a local test issuer that proves nobody's humanity. Not yet run against World's sandbox. |
| Model review | Stub servers | Adapters tested against stubs. Not yet run with real provider keys. |
| 0G review | Mock only | An optional provider, tested against a mock of the Router's format. No live 0G inference has run. |
| x402 with a smart account | Fork only | Works on the fork with the reference facilitator. Unproven on real Sepolia. |
| External audit | None | The contracts haven't had one. Don't put real funds behind them. |
Known limits
- Payment budgets and used approvals live in verifier memory, so a restart forgets them. The swap spend cap is on chain and doesn't have this limit.
- USD values come from the owner-approved pool's own price. An independent price oracle is the next step for a live network.
- Attestations delivered through CRE's mock forwarder aren't trustworthy. Real use needs a deployed workflow and the real forwarder.
- One agent per deployment for now, because verifiers read one resolver.
- The dashboard's admin token sits on its local dev server. A hosted version needs real owner sign-in first.
- An independent review found a critical bug: anyone could open a pool on the hook at an absurd price. It's fixed and tested.
What happens if an agent never calls BeforeCoin?
Nothing moves. The agent's key can only act through its smart account, and that account refuses swaps without a valid clearance, refuses other pools and has no way to send tokens directly.
Can a model approve a trade?
No. Fixed rules decide. A model can explain a decision or veto one, and it can never turn a refusal into an approval. Text from the agent goes in a reason field that rules never read.
What if the verifiers are down or disagree?
Fewer signatures than the quorum means no clearance, so the action stays refused. Missing or stale data blocks too. The local stack needs two of three, and an owner can raise that in ENS but can't go below the contract's floor.
Who runs the verifiers?
Right now, whoever runs the stack. pnpm start launches all three on one machine, each with its own key and its own reads of the chain. Real independence comes from different people running them, and that hasn't happened yet.
Is a clearance reusable?
No. It lasts 90 seconds, works once and only for the account it names, the pool, the direction and up to the amount signed. A copy from another caller reverts.
Does it work on any Uniswap pool?
The hook guards pools opened on it, by approved creators. The owner lists the pools they trust in ENS, and the wallet refuses everything else. Exact-output swaps are refused, because a hook can't bound their input before the swap runs.
Can I use this with real money?
Not yet. It isn't deployed to a live network and the contracts haven't had an external audit. Try it on the local chain, where nothing needs real funds or keys.
How do I connect the MCP server?
Add it to your client as beforecoin, with CLEARANCE_API_URL and CLEARANCE_API_KEY set. It speaks stdio, so the client starts it for you. Its five tools check a swap, request an attestation, read a proof, scan a token and read a checkpoint. The docs have a config checked with Claude Code and Cursor.
Try to get something past it
Start the whole stack on a throwaway chain, then run every attack from the dashboard or with pnpm demo. You'll need Foundry, Node 22 or newer, pnpm and Bun.
Quick start
git clone --recursive https://github.com/sagarjethi/ethmumbai.git
cd ethmumbai
pnpm install
pnpm start