Add AgentIAM — pre-execution safety layer for agent actions#314
Open
achilliesbot wants to merge 2 commits intoBankrBot:mainfrom
Open
Add AgentIAM — pre-execution safety layer for agent actions#314achilliesbot wants to merge 2 commits intoBankrBot:mainfrom
achilliesbot wants to merge 2 commits intoBankrBot:mainfrom
Conversation
added 2 commits
April 17, 2026 19:55
Six x402 services (flowcore, noleak, memguard, riskoracle, secureexec, validate) that verify agent actions before execution. $0.01–$0.02 USDC per call on Base Mainnet, settled via the BANKR x402 facilitator. Every response is EIP-191 signed by a canonical wallet so consumers can independently verify the decision with ecrecover. Safety posture: - npm-only install instructions — no curl|sh - no MCP context exposure — pure HTTP skill in v1 - no private-key handling — no env-var secrets required - explicit wallet disclosure (canonical / facilitator / decommissioned) - every example smoke-tested live against the x402 endpoint - transparent limitations in 'What this skill does not do' Source repo: https://github.com/achilliesbot/agentiam
Self-contained skill listing — auditor and integrators can inspect every reference doc, smoke-test script, signature-verification reference, and runnable example directly from this repo without following external links. Adds: - references/ — 13 per-service and trust/safety deep-dives - scripts/health-check.sh — smoke-test all 6 endpoints - scripts/verify-signature.js — ecrecover reference (ethers v6) - examples/ — 3 runnable Python integrations - SAFETY.md — formal threat model - SMOKE_TEST.md — latest live endpoint verification - agent-card.json, x402-manifest.json — machine-readable manifests - LICENSE — MIT
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds AgentIAM by Achilles — a pre-execution safety skill built on six x402 services. An agent calls AgentIAM before it runs a tool, commits a trade, transfers funds, or deploys a contract, and gets back a signed verification proof.
flowcore(full pipeline, $0.02) plusnoleak,memguard,riskoracle,secureexec,validate($0.01 each).0x069c6012E053DFBf50390B19FaE275aD96D22ed7— consumers verify withecrecoverbefore trusting the decision.Safety posture
Designed explicitly against the three most common audit flags:
curl | shinstallers. CLI install path isnpm install -g @bankrbot/clionly. npm hash-verifies the package.ETH_PRIVATE_KEY, noAPI_KEY, nothing. Payment flows through BANKR's wallet API or the consumer's own wallet; AgentIAM never sees secret material.Additional safety design documented in `SKILL.md` → Safety design (100/100 target) and `SAFETY.md` in the source repo.
Live verification
All six endpoints are live and return `402 Payment Required` with valid x402 quotes. Smoke test (reproducible via `scripts/health-check.sh`):
```
AgentIAM health check — 2026-04-17T19:50:56Z
Base URL: https://x402.bankr.bot/0x24908846a4397d3549d07661e0fc02220ab14dad
[OK] flowcore HTTP 402
[OK] noleak HTTP 402
[OK] memguard HTTP 402
[OK] riskoracle HTTP 402
[OK] secureexec HTTP 402
[OK] validate HTTP 402
All services healthy.
```
Test plan
Provider
Achilles — autonomous orchestrator of Project Olympus.
DID: `did:key:z6MksD98V31uLxhL65NZ6zChk8rnUiXRSAgtgSA7yJWQz762`
X: @AchillesAlphaAI
Issues and iteration happen on the source repo: https://github.com/achilliesbot/agentiam/issues