Quickstart

Two demo agents are live on testnet. bound-agent2-mwfnc6q8.testnet holds cert 1, left Verified until 2026-11-30. bound-agent-mwfnc6q8.testnet holds cert 0, which was settled against in the demo and reads Invalid. Every read below needs no NEAR account and no key.

1. In the browser

Open the app and paste an agent account into the verify box. The page shows the verdict, coverage, the agent's key and code confinement, claims and, for a settled certificate, the settlement waterfall.

2. From a terminal

Node.js 20 or later. Nothing to install first:

npx @bound/near verify bound-agent2-mwfnc6q8.testnet

It prints the certificate, coverage (reserve plus auditor allocation), confinement and a decision, and exits 0 for deal. Try the settled agent to see a refusal (exit 2):

npx @bound/near verify bound-agent-mwfnc6q8.testnet

Add --json for machine-readable output. See CLI.

3. Over HTTP

curl https://near.boundprotocol.dev/api/near/verify/bound-agent2-mwfnc6q8.testnet

The answer is JSON with deal, reason, the raw certificate view and the confinement check, read fresh from testnet and sent with cache-control: no-store (check cert.now for freshness). See HTTP API.

4. From an LLM agent (MCP)

Add the server to any MCP client that launches stdio servers (Claude Desktop, Cursor and similar):

{
  "mcpServers": {
    "bound-near": {
      "command": "npx",
      "args": ["-y", "@bound/near", "mcp"]
    }
  }
}

Then ask the model to verify bound-agent2-mwfnc6q8.testnet. It calls near_verify_agent and near_check_agent_keys. See MCP server.

5. In code

npm install @bound/near

import { fmtUsdc, verifyAgent } from "@bound/near";

const r = await verifyAgent("bound-agent2-mwfnc6q8.testnet");
if (r.deal && r.confinement?.confined) {
  console.log(`deal: coverage ${fmtUsdc(r.coverage)} USDC`);
} else {
  console.log(`refuse: ${r.reason}`);
}

Run it from the repository

Prerequisites: Rust through rustup (the pinned 1.95.0 toolchain installs itself), cargo-near 0.23, Node.js 22 and pnpm 10. Clone the near-hackathon branch and run everything from the repository root.

pnpm install --frozen-lockfile

Offline: the full lifecycle in tests

cd near && cargo test

Expect 132 passed (unit), then 2 passed (near-sandbox: full_lifecycle_settles_victim, withdraw_failure_recredits_and_guards_hold), then 4 passed (mock token). The first run downloads the sandbox binary.

Every check at once

near/scripts/verify.sh

Builds both wasm files, runs fmt, clippy, all tests, the TypeScript typecheck and vitest, checks that the built wasm sha256 equals the deployed one, then runs near:status and near:evidence. It ends with == all checks passed.

Zero-secret testnet reads

pnpm --silent near:status        # contract ids, on-chain code_hash == recorded, get_config, cert count
pnpm --silent near:verify bound-agent2-mwfnc6q8.testnet
pnpm --silent near:verify bound-agent-mwfnc6q8.testnet   # exit 2 on purpose: refuse
pnpm --silent near:evidence      # re-checks every recorded tx hash on an archival node
pnpm --silent near:mcp-smoke     # MCP client calls every read tool (8 checks)

Use --silent so pnpm does not add its own lines. Without it, the settled agent's exit code 2 shows up as ELIFECYCLE, which only reports the exit code.

Replay the demo on testnet

pnpm near:demo --fresh

• pnpm near:demo on the canonical deployment needs the arbiter key, which only the author has.
• --fresh creates a new deployer account and deploys a private copy. Its arbiter is arbiter.<deployer>, with the key saved in your own ~/.near-credentials/testnet, so you decide its claims.
• When the public faucet rate-limits, the script creates actors through the testnet registrar funded by --funder <account>. Pass your own account with a key in ~/.near-credentials/testnet (about 10 testnet NEAR for --fresh).

The demo runs eight acts and asserts every balance change:

1. Actors are created, mock USDC is minted, storage is registered.
2. The auditor stakes; the operator publishes, the agent accepts, reserve and float are funded, the auditor attests.
3. The agent swaps its full-access key for a pay-only key, then pays a service through the gate.
4. A scripted attack: over-float and off-allowlist payments fail on chain, other actions are refused by NEAR, then the operator halts.
5. A false BoundExceeded claim is rejected in the same transaction.
6. The service files a Harm claim; the arbiter upholds it.
7. Anyone closes the window; the victim is paid from the reserve, then the slash.
8. A second certificate is left Verified for judging.