agent-receipt-verify

Independent verification of payment- and outcome-proof receipts used by AI agents.

Run it, one line

npx -y agent-receipt-verify https://api.bitrefill.com/x402/gift-cards/search

No account, no key, no payment. It tells you whether that endpoint asks for money the way x402 says, and says NOT MEASURED for the levels that need a real settlement instead of failing them.

What it does NOT do: it judges the SHAPE of a receipt, not the honesty of the party that issued it. See CONFORMANCE.md for what is deliberately left unmeasured.

npx -y agent-receipt-verify attempt-identity   # 62 vectors for x402 spec section 5.5
npx -y agent-receipt-verify link-vectors       # 12 vectors, receipt to settlement
npx -y agent-receipt-verify kanon              # cross-check against iamonuwa/kanon

What this is

An agent economy has two kinds of receipt. One says who was allowed to act (delegation: UCAN, Authproof, Agent Passport). The other says what was paid for and whether the output matches (settlement and outcome: x402 offer-receipt, INAM countersigned receipts, and the proofs ERC-8004 consumers count).

receipt-commons/receipt-interop covers the first kind. This covers the second.

Use it from an agent: the MCP server

Both checks are also a Model Context Protocol server, so an agent can run them itself instead of a person running a command. It speaks MCP over stdio, protocol version 2025-11-25. The framing, initialize, tools/list and tools/call are implemented directly in src/mcp-server.mjs, with no MCP SDK and no required dependency at all.

Two tools, for the two moments where an agent actually needs an answer.

check_x402_endpoint, before paying. Sends one request and reports which levels of the ladder in CONFORMANCE.md the endpoint reaches. Levels that need a real settlement come back as not measured, never as failed.

link_receipt_to_settlement, after paying. Takes the receipt, the authorization salt and the asset that was paid, resolves the salted commitment against live chain state, and answers linked, not linked, or could not check. Those are three different answers and it never collapses them into two.

Add it to a client:

{
  "mcpServers": {
    "agent-receipt-verify": {
      "command": "npx",
      "args": ["-y", "github:holistis/agent-receipt-verify", "mcp"]
    }
  }
}

No account, no API key, nothing published to npm. If you would rather not run Node from a git ref, there is a Dockerfile:

docker build -t agent-receipt-verify . && docker run -i --rm agent-receipt-verify

The server opens no port and writes nothing to disk. Anything that is not a protocol frame goes to stderr, because stdout belongs to the client. npm test drives the server over real frames in 21 cases, including an unknown tool name, a notification that must not get a reply, and a network it does not know, which has to answer could not check rather than not linked.

ethers is an optional dependency, used for one signature check inside check_x402_endpoint. Without it that single check reports not measured instead of passing, and everything else works unchanged.

Why independent implementations matter

A receipt signed by a seller is a statement by an interested party. It only becomes evidence when someone who was not the signer can recompute it and reach the same conclusion. So every verifier here is written against the published specification, never against the reference implementation's source, and is tested against the vector files published by the protocol's own authors.

If two implementations that have not seen each other's code agree on the same vectors, that is interop. One implementation agreeing with itself proves nothing.

Who has independently taken this up

These are other people stating something about this project, not claims made here. Every line is a link you can open.

• INAM names it in their own verifier documentation as an ind

... View full README on GitHub