I Built a Local-First AI Auditor That Turns On-Chain Claims Into Receipts

The claim was one sentence: "At least three payouts came from that agent wallet."

Checking it honestly took an afternoon. I had to find the registration transaction, pin a block, read ownerOf and getAgentWallet, fetch the registration file, decode four payout receipts, and compare every sender and amount. The work was repetitive, but it was not optional: the person paying for an audit is paying for evidence, not for my confidence.

So I built the part that repeats.

ClaimProof is a small AI agent that reads a public on-chain claim, routes it to the right check, and returns a block-pinned MATCH / MISMATCH report. The routing model is a two-layer TensorFlow.js classifier that trains in your browser in about a second. There is no API key, no model download, and no claim data leaving the tab. The chain supplies the evidence; the local model only decides where to look.

• Live demo: https://f-seal.github.io/claimproof (GitHub Pages) · https://claimproof-xnrz.onrender.com (Render)
• Source: https://github.com/F-seal/claimproof
• Real example: FlapJax ERC-8004 agent 364913 on BNB Smart Chain — 6 claims, 6 MATCH, pinned to block 128,363,575.

This is my entry for the Hacktoberfest Open-Source AI Challenge, Week 2: Side Hustle — open-source AI that a real person or business would plausibly pay for.

What I Built

I audit on-chain claims for a small paid service. The product is simple: a client sends a claim, I return a report where every line can be re-checked by a stranger. The bottleneck was never finding a block explorer. It was turning a sentence into a verification plan and assembling the evidence without losing the thread.

ClaimProof has three parts:

1. A local router. A bag-of-words neural classifier maps the claim to one of eight intents: OWNER, AGENT_WALLET, URI, REGISTRATION, REGISTRATION_FILE, PAYOUT, TOKEN_FACTS, or UNKNOWN. It runs with TensorFlow.js on the CPU.
2. A tool layer. viem reads the ERC-8004 registry, fetches tokenURI and registration files, decodes registration and payout receipts, and checks token facts. Everything is read-only.
3. A verdict layer. For each claim, the agent compares the expected value with the observed value, records the block and raw evidence, and writes a MATCH / MISMATCH table plus a Markdown report.

The first real audit is public. FlapJax's Q31 task asked a stranger to verify its ERC-8004 identity and payouts. ClaimProof checked:

• the registration transaction and its block,
• ownerOf(364913) and getAgentWallet(364913),
• the stored agent URI and the registration file behind it,
• four FLAPJAX payouts from the treasury in the 10-12 → 10-16 window.

The result: 6 MATCH, 0 MISMATCH, 0 errors at block 128,363,575. The registration receipt mints token 364913 to the treasury; the four payout receipts show a single FLAPJAX transfer each, all from the same wallet, all inside the claimed window. No trust in the claimant was required — only in the chain and the published tool.

A shortened version of the receipt table:

Check	Transaction	Block	Amount
Registration (mint 364913)	0xd6ffcd60…	126,061,874	—
Q21 payout	0xc5cfcac7…	127,323,048	250,000 FLAPJAX
Q23 payout	0x5153b00f…	127,473,873	250,000 FLAPJAX
Q22 payout	0xebb3eddb…	127,793,194	100,000 FLAPJAX
Q25 payout	0xa4a47081…	127,793,563	250,000 FLAPJAX

Every row was read from a receipt, not from a claimant's spreadsheet. The full evidence JSON is embedded in the demo and in the generated Markdown report.

Demo

Open https://f-seal.github.io/claimproof and press Run the FlapJax Q31 audit. The same static build is also deployed on Render at https://claimproof-xnrz.onrender.com. The page trains the local model first (92 labelled examples, 155-token vocabulary, eight intents), then makes the RPC reads and renders the claim-by-claim verdicts. Expect 10–20 seconds.

The demo also has a generic identity check: enter any ERC-8004 registry and agent id, and it will read the owner, agent wallet, and URI at the latest block. With no expected values, the output is an observation — the tool is careful not to call that a verdict.

If the hosted demo is ever asleep, the repo runs locally in two commands: npm install && npm start. The browser does the same work; nothing critical lives on my server.

Code

The repository is F-seal/claimproof (MIT). The important files:

• src/intents.js — the training set, tokenizer, TF.js model, and classifier.
• src/tools.js — registry reads, receipt parsing, registration-file fetching.
• src/agent.js — the agent loop and the claim-by-claim verdict logic.
• src/report.js — Markdown and JSON reports.
• src/client/main.js — the browser demo.
• examples/flapjax-q31.json — the real audit input.

The model is deliberately small:

const model = tf.sequential();
model.add(tf.layers.dense({
  units: 48,
  activation: 'relu',
  inputShape: [vocab.length],
}));
model.add(tf.layers.dense({
  units: INTENTS.length,
  activation: 'softmax',
}));
model.compile({
  optimizer: tf.train.adam(0.01),
  loss: 'categoricalCrossentropy',
  metrics: ['accuracy'],
});

Training takes about a second in a browser tab. The agent loop is just a switch on the predicted intent:

switch (intent) {
  case 'OWNER':        // ownerOf(agentId)
  case 'AGENT_WALLET': // getAgentWallet(agentId)
  case 'URI':          // tokenURI(agentId)
  case 'REGISTRATION': // decode the registration receipt
  case 'PAYOUT':       // verify Transfer logs from the claimed wallet
  // ...
}

There is an end-to-end test (npm test) that asserts the six Q31 claims route to the expected intents, runs the audit against BNB Smart Chain, and fails on any mismatch or tool error. The test currently reports 6/6 and 0 mismatches.

How I Built It

I started from a real audit, not from a model. The Q31 task gave me the complete inventory of questions a client actually asks: who owns the agent, which wallet is bound to it, what URI it advertises, what the file says, and which payouts really came from that wallet. Those questions became the eight intents.

The training data is 92 short claim sentences: variations on each intent, plus UNKNOWN examples like "tell me a joke" so the router has somewhere to put out-of-scope text. The tokenizer lowercases, strips punctuation and stop words, and turns each claim into a normalized bag of words. The model is two dense layers. It is not a language model, and it is not trying to be; it is a router with inspectable behavior, and the report exposes the predicted intent and confidence next to every verdict.

The tools were the harder part. Historical receipts need an archive RPC, and not every public endpoint serves them; I use a CORS-friendly archive RPC so the browser demo can work without a backend. The registration file is a separate trust problem: ERC-8004 stores the URI, not a hash of the file. I report the file's SHA-256 and state the limit explicitly — the audit can prove what the file says at audit time, not that it was byte-identical when the agent registered.

The UI is intentionally boring: train, run, verdict, evidence. The only flourish is the claim card. The value is in the table underneath it.

Why Does Open Innovation Matter?

Verification tooling has a trust problem that closed APIs make worse. If the tool that decides what to check is a black box, the audit has simply moved its trust anchor from the claimant to the vendor. ClaimProof is built the other way around:

• The router is local and inspectable. The training data, the architecture, and the confidence threshold are in the repo. A client can read it, retrain it, or replace it.
• The claim never leaves the machine. The classifier runs in the browser. The only outbound requests are public RPC reads and the public registration file.
• There is no model lock-in. TensorFlow.js is open source, the model is small, and the tool does not depend on a vendor's pricing or uptime.
• The audit is reproducible. The block is named, the calls are visible, and the tests run the whole example end to end.

For this specific job, openness is not ideology. A paid audit is a trust product. The person buying it should be able to inspect the instrument.

My First User

My first real user was the FlapJax Q31 bounty — a funded task, not a favor. I used ClaimProof to produce the audit and submitted it through TaskMarket. The report is public, the block is pinned, and the four payout receipts are one click each on BscScan. Payment is $0.15 plus tokens if the answer is accepted; at the time of writing, it is still in review.

That is the honest state of the side hustle: one real job submitted, one paid-service listing live, zero paying clients so far. The listing is on The Colony as onchain-auditor — 25 USDC per micro-audit, 15 for the first three, escrowed through TaskMarket. The tool is what makes the price possible: without it, a single audit eats the margin.

I would rather tell you that than pretend the business is bigger than it is. The contest is part of the go-to-market: if the work is good enough to be recognized, the next client can see the receipt.

Prize Categories

Best Use of Render. ClaimProof is deployed as a static site on Render: https://claimproof-xnrz.onrender.com. Render serves the demo's front end; the classifier and every chain check run in the visitor's browser, so the deployment needs no server, no API key, and no database.

Limits

ClaimProof is an assistant, not an authority.

• The classifier is an intent router trained on 92 examples. Its reported 100% accuracy is training accuracy on a small, in-distribution set; there is no held-out benchmark yet. Unusual phrasing can misroute, which is why the predicted intent and confidence are always shown.
• The audit is chain state at a named block. It does not cover later state changes.
• ERC-8004 stores the agent URI, not a content hash. Registration-file checks are observations at audit time, not proof of historical immutability.
• Payout checks verify token Transfer logs from the claimed wallet; they do not reconcile an off-chain claim ledger unless those transaction hashes are supplied.
• The tool never asks for private keys and never signs transactions. It is not financial, legal, or security advice.

What's Next

The next version adds more intents (pool state, ownership renounce, bytecode facts), more chains, and a human-in-the-loop review step for low-confidence routing. The point is not to remove the human from an audit; it is to remove the repetitive work so the human can spend their attention on the parts that need judgment.

If you have a public on-chain claim that needs a receipt, the demo and the repo are above. If you want the paid version, the listing is live. And if you just want to check the Q31 audit yourself, start at block 128,363,575 and follow the links.

---

This project and post were built with Claude Code as a pair programmer. I set the goal, made the product decisions, reviewed the code, and ran the audit; the agent helped write and test it with me. I am disclosing it because the contest is about open AI, and trust should come with receipts.