Most agent stacks have a blue team fantasy and a red team PowerPoint.
We already shipped the blue team: WARDEN inside ARGUS fails closed on poisoned MCP tools before descriptions reach the model. That still left a hole. Who continuously attacks our own house — oracles, settlement gates, manifests — and leaves evidence anyone can verify offline?
MOMUS is that hole, filled on purpose.
It is a tolerated adversary living in the AICOM / AIMarket ecosystem. It runs safe, read-only probes. It emits Ed25519-signed findings. And the property that matters most:
It finds and signs — and it is structurally unable to pay itself.
Live panel (no login theatre): momus.modelmarket.dev · Source: github.com/alexar76/momus (MIT)
The thesis (one sentence)
An agent economy you cannot audit from the inside will eventually audit you from the outside — usually after money moved.
Dashboards that only show “healthy” are cosplay. A red team that can also release its own bounty is a self-deal waiting to happen. MOMUS separates those keys on purpose.
Safe read-only probes against our own components. Scanner finds. Treasury pays. Key boundary in between.
What Momus wanted (and why we named it that)
In the myth, Momus (Μῶμος) faulted Hephaestus’s man for one thing: no window in the chest through which thoughts could be inspected. That is still the oldest argument for auditability.
MOMUS is that window for an economy of agents:
| It does | It refuses |
|---|---|
| Probe allowlisted targets (oracles, hub, settlement, injection surfaces…) | Destructive attacks on strangers |
| Sign every finding (Ed25519) | “Trust me, I saw it” |
Emit FINDING / NO_FINDING / INCONCLUSIVE
|
Fake green when a target is unreachable |
| Learn which probes pay off (UCB1 bandit + threat intel priors) | Pretend every scan is equally smart |
| Feed confirmed third-party patterns to WARDEN | Publish patterns that would DoS our own Hub |
Red team and payer show up as their own nodes on the Alien Monitor — click through to the live panel.
The rule that makes it real: cannot pay itself
A scanner that can also move money is not an auditor. It is a conflict of interest with an API.
So:
- Scanner key — signs findings. Never releases funds.
- Treasury key — separate container, separate key. Only thing that can release a bounty.
- Independent verification — HIGH/critical needs two distinct verifier keys, at least one registered external. The gate refused us the first time we tried with one. That refusal is the feature.
-
Dedup identity — one bug is never paid twice; rediscovery bumps
seen_count.
Crypto stays optional. The shape is the product: find ≠ pay.
Honest outcomes beat wolf cries
Three first-class results:
- FINDING — signed, reproducible probe path
- NO_FINDING — contract held under that probe
- INCONCLUSIVE — target unreachable / probe aborted — neither a pass nor a scare
A red team that turns silence into “all clear” is worthless. We already learned that lesson on the physical side with GAIA (silence → $0) and ATLAS (LIVE needs provenance; SIM stays labeled). MOMUS uses the same honesty grammar on the offensive side.
Red feeds blue: WARDEN knocks up, signed feed goes down
WARDEN already knew how to consume a signed threat feed (authenticity · freshness · RFC 8785 canonical bytes · fail-closed). MOMUS conforms to that contract — ARGUS needed no protocol rewrite.
Two directions, deliberately asymmetric:
| Up (field → MOMUS) | Down (MOMUS → field) | |
|---|---|---|
| Who starts | any ARGUS install reports a suspicion | installs poll the feed |
| Trust | never — intake is a lead queue | document is signed; operator pinned the key |
| Effect | operator may promote a probe | WARDEN may deny a hostile MCP surface |
Blue team still decides locally. Red team only publishes what it confirmed — and never a pattern that would deny our own house.
The self-restraint rule matters as much as the crypto: a signed feed that DoSes your own Hub is worse than no feed. First-party denylist is enforced and tested.
Docs: MOMUS → WARDEN channel
A finding is not a PDF — it is a fix loop
Scanners that stop at “open ticket in Jira” are half a product.
Confirmed findings become A2A remediation tickets. SKOPOS conducts. The Factory writes under a ticket. MOMUS retests the same probe as the deploy gate. Only then does a signed DeployOrder become something a node agent may claim — one command, not a blank check to merge main.
SKOPOS is not only a traffic globe. In the loop it is the conductor.
Watcher’s eye stays on. The hand that moves is remediation.
Agents write under a ticket. Operator authority still owns what lands on main. Dry-run honesty on camera.
What we actually proved on production
On 2026-08-08 a full find → verify → fix → gate cycle ran end-to-end on the live MOMUS deployment.
Honesty clause (read this before the wow):
- The finding was real — ordinary probes, real HTTP, real production scanner key, offline-verifiable signature.
- The target was a canary — a fixture that knows how to break its own contract so the pipe can be seen to fire. Production oracles/hub scanned the same day and passed.
- Settlement was UNI / simulated — no real money moved. The gates still refused a one-verifier payout attempt before a two-verifier run cleared.
That documentation lives in-repo with real IDs: docs/first-cycle.md.
The value of a gate is what it blocks. We are prouder of the refusal than of the happy path.
LOGOS: the brain that asks (and does not rewrite)
Once you have a red team and a fix loop, operators still drown in tabs. LOGOS is the federation analytics brain — natural-language questions over hubs, scanners, treasuries, reputation — read-only by construction.
“How long will the Treasury last?” / “Which hub has critical findings?” — asked, not grepped.
It polls MOMUS and Treasury into one glass. It does not remediate. Fix loops stay with MOMUS + SKOPOS. Separation of concerns is the trust feature, not a missing button.
Live: logos.modelmarket.dev · Source: github.com/alexar76/logos
How the pieces fit (no architecture cosplay)
Field ARGUS ──report suspicion──▶ MOMUS intake
│
confirm + sign
│
┌─────────────────┼─────────────────┐
▼ ▼ ▼
WARDEN feed SKOPOS ticket LOGOS poll
(deny MCP) (Factory patch) (ask / alert)
│
MOMUS retest gate
│
DeployOrder
Crypto-light on the broad cut. The story is keys, gates, and honesty — not a token pitch.
Soft star if this is your missing organ
| If you want… | Soft ⭐ |
|---|---|
| The auditor that cannot self-deal | github.com/alexar76/momus |
| The firewall that consumes the feed | github.com/alexar76/argus |
| The conductor + fleet watch | github.com/alexar76/skopos |
| The read-only federation brain | github.com/alexar76/logos |
Live panels: momus.modelmarket.dev · skopos.modelmarket.dev · logos.modelmarket.dev
MIT. Self-hosted. Run the probes yourself.
Closing
We did not need another dashboard that says the agents are fine.
We needed a window in the chest — an adversary we tolerate on purpose, that signs what it finds, that cannot bribe itself, that feeds the firewall, and that turns a finding into a loop that can refuse to deploy.
That’s MOMUS.
Verify, don’t trust.
Top comments (0)