AI agents are starting to spend money. They call tools, pay for answers and rate what they got. Almost nothing checks any of it. A tool can describe itself however it likes, a seller can say it delivered, and a rating can point at nothing.
We built the checks. Then we ran them on one real deal: look at the tool, pay, and prove the payment afterwards. The video is the whole run. Below it is every command and every transaction, so you can repeat it and disagree with us on the facts.
- Check, before the agent pays muraqib-agent-watch starts an MCP server, reads the tools it lists and flags every tool that touches money, files or credentials without stating a safeguard. In the run it looked at our own capacity-attest server and found three tools, each stating its own safeguard. That is a first look at what a tool says about itself. It does not prove the safeguard holds, and it starts the server you point it at, so run it on your own machine.
npx muraqib-agent-watch npx -y capacity-attest
Pay, with a real transaction
A buyer agent sent 0.05 USDC to a seller through x402 on Base mainnet: transaction 0x7160db5e...e7eb, block 52,989,993. The seller is registered as ERC-8004 agent 1085288 from the address that got paid, so the payment address and the agent are the same party. The whole deal cost about three cents in gas.Prove it from the chain
Three blocks later the buyer wrote its own rating of the seller into the ERC-8004 reputation registry: transaction 0xa661b2ff...3936, block 52,989,996. The rating carries the payment's transaction hash as its reference. The same hash sits in two places, so the rating is tied to a payment that really happened.
Eight checks read it back from the chain. The video shows four: the rater is the payer, the paid address is the agent's bound wallet, the rater is not the agent's owner, and the payment came before the rating. All eight passed. We wrote those checks ourselves, so we also asked someone else to look. AgenticFinanceGraph re-checked the run through a public node, Base's public endpoint, which they do not run, and confirmed the four facts listed above.
What we have shipped so far
Six numbers, each one with the place where you can check it.
33 to 20 to 4
Secrets still leaking in 68 test cases of an open-source AI coding tool with more than 10,000 stars: before, after the maintainers' own fixes, and with our fix (pull request open).
Our pull request
0 of 600
Live x402 services that signed a receipt in our sample of an index of 20,462 resources, when we measured on 15 October.
The measurement
8 of 8
Checks passed on a real payment on Base mainnet. A third party re-checked four of them through Base's public endpoint.
The re-check
A, 4.2 of 5
Glama's rating for how well agent-receipt-verify describes its tools to an AI agent.
The listing
3 tools
Open source and on npm: muraqib-agent-watch, agent-receipt-verify and capacity-attest.
The repositories
3830
Our pull request on the x402 offer-and-receipt extension is named in the draft x402 specification text (draft pull request 3776, still open).
The draft
What we do not claim
Buyer and seller in this run were both ours. It tests the mechanism. It is not evidence of adoption.
There is no paying customer yet. This is the first public run, and we are looking for the first engineers who repeat it on their own servers and endpoints.
muraqib-agent-watch reads what a tool says about itself. It does not prove the safeguard holds.
Passing checks say the shape of a payment and its receipt is right. They do not say the seller is honest.
None of this is an audit, an approval or a certification.
Run it yourself
No account and no API key. Each command is the tool as published on npm.
npx muraqib-agent-watch
npx -y agent-receipt-verify
npx -y agent-receipt-verify attempt-identity
The first looks at your tools before an agent trusts them. The second checks an x402 endpoint before an agent pays it. The third runs 19 test vectors for the x402 attempt-identity rule. If one of them says something wrong about your server or your endpoint, open an issue. We fix it in public, and we say so.
Why we are doing this
Money is starting to move between machines. The people who build those machines should not have to take anyone's word for it, ours included.
For more information visit our blog: https://tokenizen.nl/notes/check-pay-prove
Top comments (0)