Proofmark

The trust gate between AI agents and the MCP servers they connect to.
x402 payments and audit on Hedera · identity on ENSv2 · uniqueness and spend authority from World

Live app · Check any server · On-chain console · Testing report · Page-by-page walkthrough · Sponsor feedback

Contents

1. The idea
2. How it works, in one picture
3. The flows
4. Using Proofmark
5. Proof it runs
6. Track requirements
7. Design details
8. Run it yourself
9. Repo map
10. Limits, stated plainly
11. Prior art
12. How AI was used

The idea

The problem

An MCP server is not a library. When an agent connects to one, the server is handed the agent's shell, filesystem, credentials and payment rails. Thousands of MCP servers already exist, installed with one line such as npx -y some-server. Most of them come from people the user has never heard of.

Today the best assurance available is a signature showing that some GitHub account built the code. That leaves four gaps:

What Proofmark does

Before an agent connects to an MCP server, Proofmark:

1. Looks the server up on ENS to find who maintains it, what they charge, and which key may vouch for it right now.
2. Pays the maintainer $0.002 over x402 on Hedera, with no human approving the payment. The agent is allowed to spend because a person approved it once, through a World Agent Pass, and because its operator set an on-chain Hedera allowance.
3. Gets a signed attestation of two hashes: the hash of the exact build, and the hash of its exact tool list.
4. Starts the server and hashes the tools it actually offers. If the tools differ from what was attested, the connection is refused before the model ever sees the tool list.
5. Keeps watching. A revoked key reaches every connected agent within seconds through a Hedera Consensus Service topic. ENS is re-read every 15 seconds as the source of truth.

A server is green only when its maintainer is backed by all three layers:

   ┌────────────────────┐   ┌──────────────────────┐   ┌──────────────────────┐
   │  UNIQUE            │   │  DOMAIN-VERIFIED     │   │  BONDED              │
   │  World ID          │ + │  GitHub gist or      │ + │  50 HBAR in a 2-of-2 │
   │  one person,       │   │  domain proof of the │   │  Hedera account,     │
   │  one claim         │   │  registry namespace  │   │  forfeited on malice │
   └────────────────────┘   └──────────────────────┘   └──────────────────────┘
              stops sockpuppets      ties name to owner      puts money at stake

World alone is deliberately not trusted for identity. A credential can be shared, so the namespace proof and the bond exist to cover that.

What Proofmark is not

It is **not a code scanner

... View full README on GitHub