A surety bond for AI agents on NEAR. Know an agent's worst case before you deal with it, with a number anyone can read in one view call.
Services are asked to sell to agents, and to extend them credit, on “trust me, my agent is safe.” Nobody can check that sentence, size it, or recover against it.
A prompt-injected agent spends whatever its key allows, and when harm happens there is no money set aside and no rule for who is paid first.
Coverage = reserve + auditor stake. The bound is a meter, not a guarantee.
| Who | Does |
|---|---|
| Operator | publishes the certificate (bound, reserve, float cap, allowlist, expiry) and funds it |
| Agent | accepts once, then keeps only a function-call key that can call pay |
| Auditor | attests by locking stake, earns the premium (less a 10% protocol fee) |
| Victim | files a harm claim, which opens a claim window and freezes payments; the arbiter rules; when the window ends anyone closes it |
Settlement waterfall, run mwfnc6q8: 120 = 100 reserve + 20 slash. The auditor's other 180 was not touched.
| Claim | Result |
|---|---|
| Recorded transactions, each re-checked on an archival node by the run page | 37 / 37 |
| Assertions on balances, statuses and keys | 36 pass |
| Hijacked-key attempts: overspend, off-allowlist, ft_transfer, mint, withdraw, send NEAR | all refused |
| False fraud claim rejected in the same transaction, bond forfeited | rejected |
| Contract code hash against the wasm built from the tagged commit | matches |
| What | State |
|---|---|
| Bound contract in Rust on near-sdk, with an open-mint test token | bound-v3 live |
| Two rounds of review fixes, each redeployed; earlier versions kept and labelled superseded | v1 · v2 · v3 |
| @bound/near: client, CLI, MCP server; plus a 402-style demo service gate in the repo | package |
| End-to-end demo, eight acts, committed as evidence | 4 runs |
| This site: verify, certificates, run pages, docs | read-only |
| A claim we could have made | What is actually true |
|---|---|
| It moves real money | testnet only, with an open-mint test token |
| Claims are decided trustlessly | arithmetic proofs are; a harm claim is decided by one arbiter account, held by the author |
| The contract is immutable | its deployer key is still on it; the code-hash check is how you see it has not changed |
| An independent auditor | the demo auditor and treasury are ours, and disclosed |
Deploy to mainnet with the deployer key removed. Hand the arbiter role to a Sputnik DAO. Let operators fund reserves through NEAR Intents. The ask: a first service willing to gate its agents on a certificate.