Your agent has your money. This decides how much it may spend — and who may receive it.
An owner opens an on-chain vault and writes the rules; the contract enforces two things on every payment: the owner's ceiling, and the payee's earned track record. And nobody decides that track record — no LLM jury, no validator committee, no trusted verifier anywhere in the scoring path. A score moves only when a real escrowed payment settles between two bonded agents.
⏱ Judges — start here: JUDGES.md — verify everything yourself in 10 minutes
(the first three checks need no wallet, no key, and no install)
Live demo · Dashboard · Docs · Demo video · npm: casper-trust · MCP server · On-chain proof
Built for the Casper Agentic Buildathon 2026 — 6 contracts live on casper-test, SDK on npm, x402 settlement verified on-chain.
The canonical agent-trust standard (ERC-8004) stores reputation as subjective client feedback: anyone can post an arbitrary score with zero proof they ever transacted with the agent, and the on-chain result is a plain mean of those self-reports. That is trivially Sybil- and wash-gameable — and it's what agents are supposed to trust with money.
We invert the source of truth. Here a score only moves when a real CEP-18 payment settles between two bonded agents through escrow — fabricating reputation costs real capital. The ERC-8004 read surface (get_summary) is kept for ecosystem compatibility; the data behind it is objective.
| Canonical ERC-8004 | Casper Trust Layer | |
|---|---|---|
| Score source | Self-reported feedback | Settled escrow payments |
| Cost to fake a score | Zero — post any number | Real capital: 2% fee locked per settlement, bond at risk |
| Sybil / wash resistance | None (plain mean) | isqrt concavity · per-edge caps · trust conservation (math) |
| Acting on trust | Read-only registry | Payment gate — pay({ minScore }) refuses before a cent moves |
1 · Read live trust — no wallet, no key, no gas:
curl https://casper-trust-layer.vercel.app/api/trust/0
# {"agentId":0,"scoreBps":508,"jobsCompleted":7,"exists":true} ← decoded straight from contract storage
# (live values — they grow with every settled job, so yours may read higher)2 · Gate a decision from code:
npm install casper-trustimport { createTrustClient, checkTrust } from "casper-trust";
const { trusted, score } = await checkTrust(createTrustClient(), 0, { minScore: 100n });3 · Open an account and try to break its rules — the dashboard looks for your vault when you connect a wallet; if you don't have one, you write the limits and you sign the transaction that opens it. No wallet? Ours is on screen with test funds — pay a vendor with a track record (settles), one without (refused), then freeze it and watch the same payment revert. Every attempt is a real transaction with a receipt.
4 · Give it to your AI agent — casper-trust-mcp exposes check_trust / get_reputation / get_agent as MCP tools, so Claude or Cursor can ask "should I pay this agent?" against live chain state.
flowchart TD
IR["IdentityRegistry<br/>ERC-8004 identity · CSPR bond · slash"]
ES["Escrow<br/>fund → deliver → approve<br/>2% protocol fee locked"]
RE["ReputationEngine<br/>objective score · anti-gaming math"]
AV["AgentVaults<br/>a vault per customer · owner's rules<br/>per-job · per-day · freeze"]
AT["AgentTreasury<br/>single-tenant envelope · owner's brake<br/>contract-level reputation gate"]
SDK["casper-trust SDK + MCP<br/>wallet-free reads · trust-gated pay"]
ES -- "resolve wallet · slash bond" --> IR
ES -- "record_settlement(provider, client, amount)" --> RE
RE -. "score gates payouts" .-> AV
RE -. "score gates payouts" .-> AT
RE -. "wallet-free RPC read" .-> SDK
The trust loop: register an agent (bonded) → a client agent hires it, locking CEP-18 funds in escrow → the provider delivers → the client approves → funds settle to the provider and reputation accrues to its identity (a transferable u32, not a bare wallet). Settlement, fee lock, and score update happen in a single transaction via cross-contract calls. A deadline default refunds the client and slashes the provider's bond.
We did not rewrite x402. Its bottleneck was never the payment — it is the decision. A public data marketplace logged 1,183 agent probes against 5 settlements; the agents could pay perfectly well, they just could not tell whether a counterparty was worth paying. That judgement is what we added.
On-chain trust is only useful if something acts on it. The casper-trust TypeScript SDK turns the registry into a live payment gate:
- Wallet-free, gas-free reads. Any agent's score is read by decoding contract storage directly over RPC — no wallet, no transaction. One line:
checkTrust(client, agentId). - Trust-gated x402 payments.
pay()reads the provider's on-chain score before spending a cent. Below the bar →TrustGateError, nothing leaves the wallet. Above the bar → a real x402 v2 handshake settles on-chain via the hosted CSPR.cloud facilitator. - Native to AI agents via MCP.
casper-trust-mcpmakes the same reads available as MCP tools for Claude, Cursor, or any MCP client.
import { createTrustClient, pay } from "casper-trust";
import { toClientCasperSigner } from "@make-software/casper-x402";
const client = { ...createTrustClient(), signer: toClientCasperSigner(account) };
await pay(client, {
url: "https://api.example.com/premium",
providerAgentId: 0, // on-chain identity of the seller
minScore: 5000n, // require ≥ 50% earned trust (basis points)
});
// → checks on-chain reputation → 402 → EIP-712 sign → facilitator /verify + /settle → 200The 402-handshake itself (retry loop, PAYMENT-SIGNATURE header, transfer_with_authorization) is delegated to @make-software/casper-x402 + @x402/fetch; casper-trust adds the on-chain trust gate on top. Payment settles in WCSPR (CEP-3009 transfer_with_authorization), with the facilitator paying gas.
Every term is unsigned-integer / basis-point math, O(1) per settlement — no floats, no per-call history iteration. Designed against a red-team sweep (12 adversarial checks); full derivation and threat model in docs/reputation-formula.md.
| Mechanism | Resists |
|---|---|
value = isqrt(amount) (concave) |
whale inflation + micro-job Sybil farming |
counterparty_weight (saturating on the payer's earned score) |
Sybil swarms — zero-rep payers contribute ≈ 0 |
repeat_dampening = max(floor, 10000/(1+k)) (per pair) |
wash trading, without punishing legit repeat business |
| per-edge lifetime cap | bought-edge / star laundering (the attack a naive 3-factor formula fails) |
| trust conservation | a payer can't confer more reputation than it earned |
| bonded-newcomer cold-start floor (gated + capped) | the multiply-by-zero bootstrap deadlock — without letting bonds buy rank |
| escrow protocol fee (2%, permanently locked) + bond slashing | making fake reputation cost > benefit |
The strongest objection to settlement-derived reputation: a payment proves the work was paid for, not that it was good. Fair — and answered by the design. Settlement here is approval-gated: funds only move when the client calls approve, so every score-moving settlement is a counterparty's costly endorsement — it permanently locks the 2% protocol fee — not a provider's self-report. A dissatisfied client simply doesn't approve, and reclaims the funds after the deadline.
- The alternatives reintroduce a trusted writer. LLM-jury verdicts and "trusted verifier" roles let whoever controls the judge mint subjective scores for free. Here, score can only be minted by pushing real value through escrow and giving up the fee.
- A dishonest pair is bounded, not trusted. Even a counterparty that always approves can only fabricate a capped, capital-linear amount of score — per-edge lifetime caps, trust conservation, and
isqrtvalue concavity bound every edge (full math).
Connect a wallet and it looks for your vault. If you don't have one, you open it: you write the limits, you sign, and from that moment the rules live in the contract — your agent can't argue past them and neither can we. Four tabs, because the product is four things: Account (your money and your rules), Vendors (who you're allowed to pay, each row marked payable or below your bar), Activity (every settlement on the network), Contracts (the code all of it runs on).
Reads never need a wallet. Without one you still see the whole registry, every agent's track record — and our own account, funded with test tokens, so you can try to break its rules and watch the contract refuse you:
Every attempt is a real transaction. A refusal costs gas and is written to the chain exactly like a payment is — which is why you can open its receipt instead of taking our word for it.
Everything below is live on casper-test — see DEPLOYMENT.md for every address and transaction proof.
| Contract | Package hash |
|---|---|
| AgentVaults (a vault per customer) | 674cc233… |
| IdentityRegistry | 3a51cc5f… |
| ReputationEngine | d73fb111… |
| Escrow | fe6b0ddb… |
| AgentTreasury (v2, pausable) | 95a5cde8… |
| Cep18 (demo token) | f962076e… |
AgentVaults is where an owner's money actually lives: one contract, a vault per customer, each carrying its own owner, agent, per-job ceiling, per-day ceiling, required track record, balance and freeze switch. Ownership is checked on every state-changing call, so nobody can read or move anyone else's money —
a_stranger_cannot_touch_your_vaultis a test, not a promise. AgentTreasury is the single-tenant envelope that came first, plus an owner-onlypause(). Both enforce the same two rules in the contract, not the SDK: the owner's ceiling and the payee's earned track record.
A live 8-agent trust network runs on casper-test across 14 settlements: reputation flows from multiple counterparties, not a single loop. Agent #0 has earned 508 bps over 7 settled jobs from 4 distinct clients (and counting — the network is live); every row below is independently verifiable.
Each row is judged against your bar: agent #7 reads below your bar because it has never been paid. Everything here is a wallet-free read — no key, no gas, no account.
Seven of the eight agents have earned a score; agent #7 sits at 0 bps because it was registered from a wallet we do not control and has never been paid — the honest state of an unproven agent, and exactly what the trust gate is for.
| What it proves | Transaction |
|---|---|
Cross-edge settle — agent #2 → #0 lifts score 208 → 308 |
6a7d54e8… |
Cross-edge settle — agent #3 → #0 lifts score 308 → 408 |
9e490f62… |
Bootstrap — agent #0 vouches for new agent #2 (0 → 100) |
b5d6c3b9… |
Browser hire flow settlement — agent #2 100 → 200 |
04cea776… |
| x402 handshake settles on-chain | 0c58d79a… |
| Trust-gated x402 — paid only when score clears the bar | b4a4635f… |
The trust-gated demo runs the same provider and endpoint twice: a bar above its earned score is refused before any payment; a bar it meets settles on-chain.
No claim in this README requires trusting us:
| Claim | How to check |
|---|---|
| Agent #0's score is real and current | curl https://casper-trust-layer.vercel.app/api/trust/0 — a live, wallet-free storage read |
| The score came from real settlements, not writes we control | Settlement txs 6a7d54e8… and 9e490f62… route through the deployed Escrow |
| Anyone can move a score with their own wallet | Run the hire flow — or inspect the browser-driven settlement 04cea776… |
| x402 payment is actually trust-gated | b4a4635f… — the same endpoint is refused below the bar, settled above it |
| All 6 contracts are live and wired | Package hashes above; every install + wiring transaction linked in DEPLOYMENT.md |
| The SDK is public and installable today | npm install casper-trust |
| The code does what we say | cargo odra test in contracts/ (62 tests) · npx vitest run in sdk/ (66 tests incl. live read assertions) |
| Criterion | What ships | Evidence |
|---|---|---|
| Technical quality | 6 contracts live and wired on casper-test; 62 OdraVM tests (incl. the adversarial reputation suite, the owner's brake, and per-customer vault isolation) + 66 SDK tests |
DEPLOYMENT.md · contracts/src · sdk/test |
| Innovation | Reputation derived objectively from settled escrow payments — no judge anywhere in the scoring path — hardened with anti-gaming math (per-edge caps, trust conservation, value concavity), and shipped as a package that installs and runs outside this repo | docs/reputation-formula.md · npm |
| AI agent integration | Trust-gated x402 pay() — an agent checks a counterparty's on-chain trust before spending a cent — plus the casper-trust-mcp server so Claude/Cursor query trust natively |
payment layer · gated-settle tx |
| DeFi / RWA applicability | A vault per customer: per-job + daily ceilings and a protocol-level counterparty gate, enforced in the contract; CEP-18 escrow rails | AgentVaults · AgentTreasury · contracts/src |
| UX | Wallet-free, gas-free score reads; an account you open and sign yourself; in-browser wallet-signed registration and a full hire flow with a faucet | live demo · dashboard |
| Working contracts | All 6 deployed, wired, and exercised end-to-end: settlements, slashing, treasury pay, a customer vault opened → funded → paid → refused → frozen | DEPLOYMENT.md |
| Ecosystem impact | A published npm package + MCP server any Casper agent project can adopt; the Odra 2.8.1 → Condor deploy workarounds are documented for other teams | npm · mcp/ · tasks/lessons.md |
cd sdk && npm install
npx vite-node scripts/trust-gated-x402.mts # refuse-below-bar, settle-above-bar
npx vite-node scripts/x402-handshake.mts # raw 402 → on-chain settleCasper contract tooling runs on Linux; on Windows use WSL2 (see tasks/lessons.md).
cd contracts
cargo odra test # 62 passing on the OdraVM (no node needed)
export PATH=~/binaryen-latest/bin:$PATH
cargo odra build # -> Casper-VM-compatible wasm/*.wasm (needs wabt + binaryen v130+)
cargo run --bin contracts_cli -- deploy # see contracts/.env.examplecontracts/
src/identity.rs IdentityRegistry — ERC-8004 identity + bond + slash
src/escrow.rs Escrow — A2A job state machine, CEP-18, 2% protocol fee
src/reputation.rs ReputationEngine — escrow-derived sybil-resistant score
src/treasury.rs AgentTreasury — capped spend envelope + reputation gate + pause
src/vaults.rs AgentVaults — a vault per customer: own rules, own balance, own freeze
bin/cli.rs odra-cli deploy script (6 contracts + wiring)
vendor/ patched odra-casper-rpc-client (Casper 2.0/Condor deploy fix)
sdk/ casper-trust TypeScript SDK (published to npm) + live demo scripts
mcp/ casper-trust-mcp — MCP server for AI agents (Claude, Cursor)
web/ Next.js landing + the dashboard (live on Vercel, hire flow included)
docs/reputation-formula.md formula design + threat model
DEPLOYMENT.md live addresses + tx proofs
- Contracts: Odra 2.8 (Rust →
wasm32-unknown-unknown→ Casper 2.0) - Token: CEP-18 (
odra-modules); payments in WCSPR (CEP-3009transfer_with_authorization) - SDK: TypeScript ·
casper-js-sdk5 ·@make-software/casper-x402·@x402/fetch— published ascasper-trust - Payments: x402 v2 over the hosted CSPR.cloud facilitator (gasless for the payer)
- Testing: OdraVM (62 contract tests incl. adversarial reputation cases and per-customer vault isolation) + Vitest (66 SDK tests)
- Deploy:
cargo-odra+ cspr.cloud (via a small auth proxy), patched for the Condor account model
Already shipped — distribution is live, not hypothetical: casper-trust is installable from npm today; the dashboard lets anyone open their own on-chain account and exposes the registry without a wallet; the in-browser hire flow lets any visitor fund → deliver → approve and watch a score move on-chain; and casper-trust-mcp plugs on-chain trust into Claude/Cursor.
Qualification → final
- Publish
casper-trust-mcpto npm (npx casper-trust-mcp) - AgentTreasury support in the SDK (bounded spend + reservations)
Mainnet path — three blockers, in order:
- Agent-side key management hardening — operational wallets currently hold raw signing keys
- A stable payment token — settlement runs on WCSPR / a demo CEP-18 today; production needs a stable, liquid token so reputation weight isn't coupled to price volatility
- v2 contract hardening — the accepted-risk fixes documented in the threat model (§7): provider consent on job creation, proportional slashing, treasury status gate, reputation decay, dynamic bonds
Community — building in public on X (@l3ekirerdem) and CSPR.fans; the deploy workarounds in tasks/lessons.md are already reusable by other Casper teams.
The contract code is unmodified vanilla Odra. Three workarounds were needed for an Odra 2.8.1 → Casper 2.2.1 (Condor) testnet deploy (a cspr.cloud auth proxy, a patched contract-address resolver, and a resilient SSE watcher) — all documented in tasks/lessons.md and DEPLOYMENT.md.
MIT — see LICENSE.