Agentic Finance Graph MCP Server

For one ranked agent: its independence score (1 if it paid, in 30 days, an address with demand from three or more operator sets; else half the best score of an agent outside its set that paid one of its payees, best path, at most three hops), the path, its L9 counterparty count under the published rule and under the cluster-aware rule, the inflation ratio between them, and the size of its operator set (same bound wallet, owner, minter or first funder, each link capped at 50). Definitions rank.independence.v1, rank.inflation.v1, cluster.ratio.v1.

What the ledger measured about one registration at its last evaluation under agent.pass.v2, valid three hours: published level L7+, no open harm-kind incident, a counted payment in the last 30 days, its newest payment in character, no issuer freeze on a bound wallet, no unlimited approval to a plain key, no harm-kind incident in 90 days, and a month without a payment out of character. Answers holds or not, which checks failed, which could not be taken (listed, never written as 0), when it was checked and when it expires, with the issuer's public key. In shadow mode nothing is signed yet. A Pass says what was checked and when; it never says safe, verified or trusted, and says nothing about the next three hours.

The out-of-character score of an agent's newest counted payment against its own earlier payments (behaviour.out_of_character.v2: amount out of its distribution, a new payee at a new size, a never-paid plain key, a probe then a large payment, a look-alike address, an approval change, off its rhythm), with the reasons that fired, how many of its last 30 days of payments scored notable or major, and the market's rates. Levels are none / notable / major; a level is a pattern for a human to read, never a verdict, and in shadow mode nothing is blocked from it. Every figure carries its measurement time and definition id.

The free record of one ranked agent: rank with evidence, bindings, and its 25 newest payments with counterparties. Unranked ids return not found: an agent never seen paying has no record to sell or show.

The behaviour clock for one ranked agent: run_days (complete UTC days since the last break in its own payment behaviour, by a CUSUM on payments, USD, payees and new-payee share against its own history), the last break's date and feature, and its heartbeat over 30 days (scheduled, irregular, bursty or sparse, with the dispersion index and the gap CV). A break is a change, not a harm; the measured false-break rate is published in the document. Definitions stability.run_length.v1 and stability.heartbeat.v1.

The latest 3-hour statement for one ranked agent: payments out split into spend, routing hops and payments whose receipt is not read yet; what left its control; income; open flags; the hash of the previous statement; and a Merkle proof against the window's Ed25519-signed root. Check before you pay: refuse if stale, if chain_ok is false, or if flags is not empty; then call find_agent and refuse if open_incidents is above zero. A statement covers a closed 3-hour window and publishes a few hours after it closes, so it cannot show the last few hours.

Look up an ERC-8004 agent by token id on Base, slug, wallet address (0x...) or the name it declares. Returns whether it is ranked, its liveness level (L0-L9), bound wallet, stablecoin float, payment totals and open incidents. Up to 25 ids at once, separated by commas. A name is matched among ranked agents only, and a declared name is the agent's own claim, not verified.

Register the public part of a decoy you planted: kind address|key|url|apikey|tool|x402 with exactly one target (address, url_sha256, key_sha256, tool_name or resource_path), a label, the triggers to watch (nonce, code, permit, siwe, inbound_transfer, http_hit, api_use, tool_call, x402_request) and planted_at. Needs Authorization: Bearer <Desk session>; the session's wallet is the operator. Private material is refused before validation; a bait key must be fresh (nonce 0, no code). A canary is a decoy you plant where only an intruder or a misled agent would read it: a bait key that never holds a balance (its first use is the signal), an address planted as a treasury, a URL, an API key, a tool description or a paid x402 resource. Register the PUBLIC part only (address, hash, tool name, path); we refuse anything that looks like a key, a URL or an API key in clear. We read the chain every 2 minutes (nonce, code, gas funding, inbound transfers, permits) and your own channels when you push them (canary ingest). A fire is a pattern for a human to read, written to your canary log; nothing is published about a plant. Shadow period: at most 25 live canaries per operator, no e-mail yet.

Every canary you registered, with the watcher's last reading (nonce, code, balance, checks) and the newest 20 events per canary (trigger, severity, evidence, whether you declared it a test, the reading in plain words and what to do). Needs Authorization: Bearer <Desk session>. Labels are your own text and come back in the untrusted envelope.

For an agent (L8 or above) or one of its bound wallets: priced stablecoin and token balances and ETH in USD at one block, the EIP-7702 delegate if any with its code hash and known sweeper family, and the open ERC-20 allowances the wallet granted, confirmed on chain and capped at the balance per token (agent.blast_radius.v1). Read every six hours from free public nodes. A measurement of exposure at one block, not a prediction; unpriced tokens are listed by symbol.

For one receiving address on Base (or an x402 resource URL listed in the Bazaar): how many counted payments registered agents made into it, how many distinct agents and how many at L7 or above, first and last seen, and the routing hops excluded. Counts only; the payer list with levels, binding confidence and transaction hashes is the counterparty pack. An address that only received routing hops is not a payee. Without an address: the endpoints the most ranked agents pay.

The frozen definition of a metric: what it counts, the method, what it excludes and what it does not claim. Use the definition ids returned by the other tools.

Anomalies our detectors logged, newest first: drain-shaped payments (each with the share of the wallet's balance it took), retry storms, mint bursts, fleet-funding fan-outs (layering_fan), owner changes under a binding, delegation to unknown code. A detection is a shape with evidence, never a verdict. Filter by agent, kind, severity, time or live incidents only; compact drops the glossaries.

Price and how to buy a dated evidence pack over x402 (USDC on Base, 1 to 30 cents). About one period: edition (the depth file behind a final State of Agent Money edition: every agent and every payee of the period, the edition's figures and the period's book; id = YYYY-MM, YYYY-Qn or latest; 30 cents). About one agent: precheck (the routine check before you pay or hire it: level, last payment, live incidents, statement freshness, and with payto what that address is), liveness, paygraph (where it pays), drain, incidents, peer, builders (which apps build its transactions, ERC-8021), exit (did its wallet empty out: every window in which a new payee took most of its outflow in 72 hours, with where the money went next; candidates, never verdicts), trace (where did the money go: its exits followed live up to three hops, with each hop's issuer freeze, swap out of a freezable token and Tron activity), bundle, reval (a live re-probe) or statement (its last 24 statements with proofs). About one address: counterparty (which ranked agents paid it) or venue (what the address is: label, contract or key, who pays it, poisoning look-alike or not, live 48-hour flow). This tool does not pay; an x402-capable client fetches the returned URL, receives HTTP 402 with the exact price, and retries with a signed payment.

One call before an agent pays: the payee facts, the agent's own context from our ledger (what it paid in the period, how often, whether and when it first paid this payee, how many new payees today), the out-of-character score of this payment as the agent's next, and a decision under a policy written in the AP2 mandate vocabulary (allowed_payees, amount_range, budget {max, period: daily|rolling_24h|rolling_7d}, agent_recurrence, execution_date) plus ours: new_payee {max, window_hours, max_new_per_day, step_up_ratio, step_up_days}, refuse_conditions {fact: block|warn|log|ignore} and signal {v2: {notable, major}}. Anything the evaluator does not understand fails closed. Named policies: log-only (default), balanced, recommended, recommended-v3, strict (their measured cost on 500 real agents is in the policy document). The answer is block / warn / log / allow with every reason, and is recorded in log-only mode: we never block anything; your client decides, and decides its own fail mode when we are unreachable.

The whole-cohort document: cumulative incidence of the four competing exits (drained, abandoned, dormant, none) at 30, 60, 90 and 180 days with the numbers at risk and the restricted mean time without an exit (ladder.exit_incidence.v1); the Standardised Drain Ratio per minting address with 30 or more ranked agents, with 95% intervals (platform.sdr.v1); the day-to-day transition matrix between L7, L8, L9 and out (ladder.transition.v1); and the landmark re-check of the published survival figures (survival.landmark.v1).

The ledger's headline figures for AI-agent money, each with its value, unit, measurement time and definition id. On Base: money agents paid to others after registration (counted), daily spending by the day it was paid (last day, 7-day and 30-day averages), the part that went into positions they still hold, what left their control, the routing hops and pre-registration history excluded, how many agents are ranked (L7+ paid someone, L8 funded, L9 repeat counterparties), agent income, x402 seller inflow, treasuries, concentration, detections and the address-poisoning watch. On other chains: ERC-8004 registrations on seven chains, what registration owners paid on BNB Smart Chain, Ethereum, Arbitrum, OP Mainnet and Polygon, and Solana agent registrations and payments.

The history of one measured metric from the ledger's archive (daily points, plus 5-minute points for the last 48 hours). Gaps are real gaps, never filled. An unknown key returns similar keys and the full list of archived keys.

Every metric the ledger measures or archives: key, unit, definition id, whether it is a headline figure, its first stored sample, and the date from which its history compares across our own changes (comparable_since). Use a filter (part of a key, a definition id or a word from its note) to get the notes too.

One free call before your agent pays or hires another: its latest statement (stale, age, chain_ok, flags), live incidents, its detections in the last 72 hours, the token approvals its wallet has given (unlimited ones, and any to a plain account), its last counted payment, and its payments seen after the statement window closed (from its 25 newest payments, so the hours a statement cannot show are not blind). Returns facts and which of the documented refuse conditions are met; the decision stays with you. The paid precheck pack adds what the address you were given to pay is.

What the chain and our ledger say about an address an agent is about to pay (payee.facts.v2): its code kind (plain key, contract, EIP-7702 delegated) and whether the delegate matches a known sweeper or the tiny-forwarder shape; whether it forwards most of what it receives within minutes (relay shape); whether its stablecoin outflow goes to swap venues; who funds it and where it exits (7 days of Transfer logs); whether a contract exposes a claim-on-proof selector; an issuer freeze; how many registered agents pay it; and, given the paying agent and the amount, whether it is a never-paid destination at a size the agent never sent and whether it is a look-alike of an address in the agent's own history. Each fact carries value, evidence, method and measurement time; an unavailable channel is said, never guessed. Facts describe an address; they do not judge it.

The wallets observed paying one agent (income into its bound wallets, plus counted payments from other registered agents), up to 250, with payments, USD and first and last paid; and how much of its ERC-8004 feedback is payment-grounded (the reviewer paid the agent before rating it). Pass the addresses as clientAddresses to the Reputation Registry's getSummary to read only reviews from wallets that paid. Observed payers are a lower bound, and payment-grounded is not independent: a payer under the same operator grounds its own reviews.

The top ranked agents (L7 and above: a bound wallet was seen paying money out of the agent's control after registration). Sorted by level first (L9, then L8, then L7), then by lifetime counted USD; sort_by changes the second key to distinct counterparties or number of payments. A high place means a large counted spender at that level, not a working service: read agent_record before relying on one. Free tier: up to 25.

One measured figure with the stored sample it moved from: current, prior, delta, delta_ratio, both timestamps, definition id, unit, and whether the move is material under the published thresholds. window: sweep (the previous stored sample, the default), 24h, 7d or 30d. No prior sample inside the window returns gap: true and no delta; nothing is interpolated. Accepts a metric key or a definition id.

Trust nothing you did not recompute. Verifies the Ed25519 signature on the current sum-log head (the Merkle-sum root over every counted payment and the total it commits to), optionally climbs one agent's proof from its leaf to the root and the whole total, reports how many of the previous head's leaves the current head declares unchanged, changed, removed and added, and verifies the statement log's signed tree head and, given the head you kept (tree_size, root_hash), the consistency proof that our statement history was not rewritten. Keep the heads it returns and pass them next time. Definitions sumlog.v1 and agent.statement.log.v1.