# Prism

> First adversarial AI validator on ERC-8004

- **Type:** MCP server
- **Install:** `agentstack add mcp-fato07-prism`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [Fato07](https://agentstack.voostack.com/s/fato07)
- **Installs:** 0
- **Category:** [Integrations](https://agentstack.voostack.com/c/integrations)
- **Latest version:** 0.1.0
- **License:** Apache-2.0
- **Upstream author:** [Fato07](https://github.com/Fato07)
- **Source:** https://github.com/Fato07/prism
- **Website:** https://prism-dashboard-production-e6e3.up.railway.app

## Install

```sh
agentstack add mcp-fato07-prism
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Prism — The First Adversarial AI Validator on ERC-8004

> Two AI agents debate your trade reasoning on-chain. One generates. One challenges. Both are accountable.

[](https://prism-dashboard-production-e6e3.up.railway.app)
[](https://prism-docs-production.up.railway.app)
[](https://youtu.be/6gjfT9GchYo)
[](https://youtu.be/ZmSStvqNgIo)
[](LICENSE)
[-purple)](https://docs.arc.network/)

**Prism** is an adversarial AI validation system built on [ERC-8004](https://eips.ethereum.org/EIPS/eip-8004). A **Trader** agent (Claude/Mirascope) generates structured reasoning traces for prediction markets. A **Sentinel** agent (GPT/DSPy) adversarially challenges every claim. The result is a Prism Report with an issue ledger, capital gate, IPFS receipts, and Arc/ERC-8004 anchors where present. Both agents are registered on-chain, and the sentinel is exposed as an x402-protected service other agents can call.

> *Prism makes AI agents accountable to other AI agents before capital moves.*

**Creative showcase film:** [YouTube companion asset](https://youtu.be/ZmSStvqNgIo) — a 70-second cinematic cut for sharing alongside the founder-led demo. The official judge demo remains the separate screen-recorded walkthrough.

---

## Try it in 30 seconds

1. Open the live dashboard: 
2. Connect MetaMask and switch to **Base Sepolia**
3. Get free testnet USDC from the [Circle faucet](https://faucet.circle.com) (Base Sepolia + USDC)
4. Paste this known-good IPFS CID: `QmNzqnPEEQUMn3GMbiEZANpKXZRPmTHxVwt5nNevR8iXt8`
5. Click **Validate**, sign the 0.01 USDC payment in MetaMask
6. You land on `/trace/[id]` with the cross-family adversarial verdict

First real self-serve run on 2026-05-15 settled at [`0x63bf7094…`](https://sepolia.basescan.org/tx/0x63bf70941e8890b2b92459addfa18ecb57dd06bba7ea715391f00322faf58d68) on Base Sepolia. Receipt: [`docs/demos/self-serve-submit-20260515T101946Z.md`](docs/demos/self-serve-submit-20260515T101946Z.md).

First live CLI paid validation on 2026-05-16 settled at [`0xd6ab0cbb…`](https://sepolia.basescan.org/tx/0xd6ab0cbba99dfa1162ab24ccf35c9e9544c1bb64a550a0e349e8033ebd4f43e1) on Base Sepolia. Receipt: [`docs/demos/cli-paid-validation-20260516T214837Z.md`](docs/demos/cli-paid-validation-20260516T214837Z.md).

Latest URL-verified MCP validation on 2026-05-17 settled at  and produced a public report with Exa `web_search_exa` + `web_fetch_exa` evidence receipts: . Receipt: [`docs/demos/external-call-20260517T203104+0000.md`](docs/demos/external-call-20260517T203104+0000.md).

---

## Architecture

```
                     Arc Testnet (chain 5042002)
                     USDC native gas · ~$0.01/tx · sub-second finality
                              │
              ┌───────────────┼───────────────┐
              ▼               ▼               ▼
     IdentityRegistry   ValidationRegistry   ReputationRegistry
     0x8004A8…BD9e      0x8004Cb…4272        0x8004B6…8713
              │               │               │
              └───────────────┼───────────────┘
                              │
                    Circle Dev-Controlled Wallets
                    (signs + submits all txs)
                              │
          ┌───────────────────┴───────────────────┐
          ▼                                       ▼
  Trader Agent (Python)                    Sentinel Agent (Python)
  Mirascope · Claude family                DSPy · GPT-4o-mini
  Trading-R1 trace generation              TraceAdversary + MIPROv2
           │                                        │
  Polymarket V2 SDK                                 ▼
  execution attribution                    x402-protected MCP
  (builder code)                           ($0.01 USDC/validation)
           ▵                                        │
  Polymarket CLOB (Polygon)                         │
                                                      │
                              ┌───────────────────────┘
                              ▼
                    Dashboard (Next.js 16)
                    split-screen dialogue + on-chain receipts
                    wallet-connected · self-serve validation
```

---

## Data Flow

1. Fetch Polymarket market → 2. Trader generates Trading-R1 trace → 3. Pin to IPFS → 4. Persist to Postgres → 5. On-chain `validationRequest` → 6. Sentinel challenges trace → 7. Verdict + dialogue → 8. Pin to IPFS → 9. Persist to Postgres → 10. On-chain `validationResponse` → 11. Optional paper/live trade carries builder code → 12. Dashboard execution attribution

---

## What's Live

### Dashboard Routes

| Route | Description |
|-------|-------------|
| `/` | Landing page with the product story, live activity strip, and waitlist |
| `/dashboard` | Split-screen trace + verdict dialogue, on-chain receipts |
| `/trace/[id]` | Trace detail page — server component with structured layout, capital gate, receipts, and dynamic OG image |
| `/history` | Paginated history of all traces and verdicts |
| `/me` | Wallet-connected verdict history (wagmi v2 + Reown AppKit) |
| `/submit` | Self-serve x402 validation — sign EIP-3009 transfers from the browser; shows Circle App Kit Bridge widget when USDC balance . They cover the quickstart, CLI, x402/MCP validation, public APIs, receipts, security model, architecture, and the verification-guarantees page ([/docs/verification-guarantees](https://prism-docs-production.up.railway.app/docs/verification-guarantees) — 8 guarantees, 5 NOT-guarantees, trust assumptions, fail-closed behavior).

The CLI is the developer-facing surface for pulling Prism metrics without opening the dashboard. It supports trace inspection, public stats/history, trace reports, market surfacing, token resolution, wallet funding guidance, and x402 validation orchestration. It never reads private keys: `prism validate` either submits an externally signed `X-PAYMENT` header or asks Circle CLI to sign the EIP-712 authorization with a Circle wallet.

```bash
uvx --from "prism-cli @ git+https://github.com/Fato07/prism.git#subdirectory=apps/cli" prism demo

# or, from a clone:
cd apps/cli
uv run prism --version
uv run prism doctor
uv run prism demo
uv run prism inspect ipfs://QmNzqnPEEQUMn3GMbiEZANpKXZRPmTHxVwt5nNevR8iXt8 --json
uv run prism stats
uv run prism history --limit 5
uv run prism report d6cdd60f-f5e0-43ab-ba2d-7dcab76a8e24
uv run prism markets --limit 5
uv run prism market resolve "" --json
uv run prism quote ipfs://QmNzqnPEEQUMn3GMbiEZANpKXZRPmTHxVwt5nNevR8iXt8 \
  --trace-hash 0x1a750011608a7480e9cb11f1d20587e32efb7a7dd433b85820f0dbfcdee19fdb
uv run prism validate ipfs://Qm... --trace-hash 0x... --x-payment-file ./x-payment.txt
uv run prism demo --pay --circle-address 0xYourCircleWallet --max-amount-usdc 0.01
uv run prism validate ipfs://Qm... --trace-hash 0x... \
  --circle-address 0xYourCircleWallet --max-amount-usdc 0.01
```

---

## Calibration Corpus

The calibration corpus is the sentinel's evaluation ground truth — a local-first, deterministically split, immutably sealed dataset of labeled reasoning traces. It ships as a CLI in `packages/calibration-python/`.

```bash
uv run python -m prism_calibration.cli --help
```

**Key workflows:**

1. **Build** — scaffold a new corpus with schema and split configuration
2. **Harvest** — pull real traces from Prism's activity store → IPFS → normalize → hash-verify → write local rows
3. **Label** — generate synthetic traces, mutations, or AI-prelabel existing rows (3 subcommands: `generate-synthetic`, `generate-mutations`, `prelabel`)
4. **Freeze** — export an immutable snapshot (manifest.json + rows/ + .sealed marker)
5. **Sync** — mirror the frozen export to Braintrust (datasets, review queue)
6. **Eval** — run the sentinel against the corpus and score discrimination
7. **Inspect** — examine corpus metadata, splits, and sealed milestones
8. **Validate** — run regression assertions against sealed milestones (43/43 passed across 5 milestones)

**Architecture — local-first:**

- Local frozen exports are the **authoritative** data source
- Braintrust is a **mirror and experiment surface** (datasets, experiments, review queue, runtime logs)
- Deterministic split assignment via lineage-hash-v1 (no randomness, fully reproducible)
- Holdout lockout: holdout rows are isolated from training/labeling and locked after freeze
- Immutable sealed exports: once a milestone is sealed, its rows cannot be modified
- Clean-replay regression: re-run eval on any sealed milestone and bit-compare to the original result

---

## What's Open / What's Gated

| Open | Gated (not in this repo) |
|------|--------------------------|
| ERC-8004 client & validator SDK scaffolding | Production sentinel prompts (MIPROv2-optimized) |
| Agent harness & trace generation pipeline | HMAC seed material |
| Sample reasoning traces | Circle Entity Secret & wallet private keys |
| Dashboard public routes + wallet connection | |
| Self-serve x402 validation page | |
| Execution attribution page | |
| Contract addresses & ABIs | |
| x402 middleware setup (dual facilitator mode) | |
| DSPy `TraceAdversary` signature | |
| Treasury dry-run scaffold (USYC park/unpark path) | |
| Calibration CLI + schemas (8 commands, 149 tests) | |

---

## Operator Safety Control Plane

Runtime observability and safe control for Prism's autonomous trader — read status, start/stop scheduler with auth, audit trail for all mutations.

### Key Components

| Component | Description |
|-----------|-------------|
| **Trader `GET /status`** | Read-only endpoint returning 8 fields: `scheduler_running`, `interval_minutes`, `auto_pipeline_enabled`, `trade_mode`, `last_tick_timestamp`, `next_tick`, `last_error`, `service_version`. Reading status **never** starts the scheduler. |
| **Dashboard operator-admin auth** | All admin routes gated by `OPERATOR_ADMIN_TOKEN` (Bearer header). Verified via `timingSafeEqual` (separate from `CONNECTOR_ADMIN_TOKEN`). Invalid or missing token → 401 + audit row with `result=unauthorized`. |
| **Dashboard admin API routes** | `GET /api/admin/runtime`, `POST /api/admin/schedule/start`, `POST /api/admin/schedule/stop`, `GET /api/admin/audit` — proxy to the trader with auth enforcement. |
| **Operator page (`/operator`)** | Read-only status card + start/stop mutation buttons with confirmation dialog + live audit events table. Requires admin auth. |
| **`operator_events` audit log** | Append-only Postgres table (`infra/db/migrations/005_operator_events.sql`). Every mutation attempt (success, failure, unauthorized) writes a row. No UPDATE or DELETE issued by application code. |

### Key Safety Invariants

- **Reading status never starts the scheduler.** The `GET /status` endpoint is purely observational.
- **`PRISM_TRADE_MODE` is read-only (env-only).** The API cannot switch between `paper` and `live`. To change trade mode, update the environment variable and redeploy.
- **`AUTO_PIPELINE=false` is the default and cannot be changed via API.** The scheduler must be explicitly started by an authenticated operator action; start only activates the tick scheduler, not auto-pipeline.
- **Start cannot switch paper→live.** If `PRISM_TRADE_MODE=paper`, the start endpoint only starts in paper mode. No runtime escalation.
- **Stop cancels background tasks.** The stop endpoint cancels the scheduler's asyncio background task and sets `scheduler_running=false`.

### Environment Variables

| Variable | Description |
|----------|-------------|
| `OPERATOR_ADMIN_TOKEN` | Bearer token for admin API routes and `/operator` page access. Must be set in both trader and dashboard services. Verified via `timingSafeEqual` — separate from `CONNECTOR_ADMIN_TOKEN`. |
| `TRADER_INTERNAL_URL` | Internal URL where the dashboard reaches the trader service (e.g. `http://prism-trader.railway.internal:3201` for Railway private networking). |

---

## On-Chain State

Both agents are registered on Arc testnet's ERC-8004 IdentityRegistry:

| Agent | agentId | Role |
|-------|---------|------|
| Trader | **4140** | Generates Trading-R1 traces, requests validation, executes paper trades with builder-code attribution |
| Sentinel | **4148** | Adversarially validates traces, submits verdicts on-chain |

**Contract Addresses (Arc Testnet, chain 5042002):**

| Registry | Address |
|----------|---------|
| IdentityRegistry | `0x8004A818BFB912233c491871b3d84c89A494BD9e` |
| ValidationRegistry | `0x8004Cb1BF31DAf7788923b405b754f57acEB4272` |
| ReputationRegistry | `0x8004B663056A597Dffe9eCcC1965A193B7388713` |
| ERC-8183 AgenticCommerce | `0x0747EEf0706327138c69792bF28Cd525089e4583` |

---

## Live Demo

Dashboard deployed on Railway:

**[https://prism-dashboard-production-e6e3.up.railway.app](https://prism-dashboard-production-e6e3.up.railway.app)**

The split-screen view shows the trader's reasoning trace on the left and the sentinel's adversarial challenges on the right, with on-chain validation receipts below. Connect your wallet to view your verdict history (`/me`) or submit a trace for validation (`/submit`).

---

## Call the Sentinel Yourself — External x402 + MCP Demo

Prism's sentinel is a paid public service: any external agent can pay
$0.01 USDC on Base Sepolia and get an adversarial verdict on its
reasoning trace. The flow is x402 (payment protocol) over MCP
(Model Context Protocol).

**Reference client:** [`scripts/call_prism_sentinel.py`](./scripts/call_prism_sentinel.py)

It's ~470 lines of standalone Python with PEP 723 inline dependencies —
fork it, swap the wallet/trace, point it at your own sentinel. No
Circle account, API key, or special tooling required on the caller side.

### Run it in 3 commands

```bash
# 1. First run — generates a fresh keypair, prints the address, exits cleanly
#    (the private key persists to .local/prism-client.key, gitignored)
uv run scripts/call_prism_sentinel.py

# 2. Fund the address it printed with ~0.05 USDC on Base Sepolia
#    (free from https://faucet.circle.com — select Base Sepolia + USDC)

# 3. Re-run — executes the full x402+MCP dance, saves Markdown receipt
uv run scripts/call_prism_sentinel.py
```

Expected output:

```text
Prism — external x402 + MCP demo client
========================================================

  • Loaded client wallet from .local/prism-client.key
  • Client address: 0x993F4D56e1329b6e3b91A13B9ACe1a890a023518
  • USDC balance on base-sepolia: 19.9300 USDC

  > [0/4] MCP handshake — initialize …
  ✓ Session: 468d6db939c94831853f5956…
  > [1/4] Calling sentinel /mcp with session but no payment …
  ✓ 402 received · 0.01 USDC to 0x1453ba8a… on base-sepolia
  > [2/4] Signing EIP-3009 transferWithAuthorization …
  ✓ Payment payload ready (956 char base64)
  > [3/4] Re-calling /mcp with X-PAYMENT header …
  ✓ 200 OK · response 3020 bytes
  > [4/4] Parsing verdict + saving receipt …
  ✓ Receipt: docs/demos/external-call-.md

  Verdict: PASS (score 65/100)
  Settlement: https://sepolia.basescan.org/tx/0x8d5d7a46bd88b2ffba5b6e6c6d70221598ee041d4206377ca5991e90f5c12421
```

### What's verifiable when you run it

- A real **EIP-3009 USDC transferWithAuthorization** signed by your client
  wallet, settled on Base Sepolia by the [x402.org public facilitator](https://www.x402.org/facilitator)
- A real **adversarial verdict** from a different model family than the
  trace's original author, pinned to IPFS
- A **committed Markdown receipt** in `docs/demos/` with all hashes and
  explorer links — shareable, screenshot-able, gitable

### How it works under the hood

See [`docs/architecture.md`](./docs/architecture.md) for the full sequence
diagram. The short version:

1. **MCP handshake** — `initialize` then `notifications/initialized` (free,
   exempt from x402 paywall so clients can establish a session)
2. **First `tools/call validate`** — sentinel returns `HTTP 402` with x402
   payment requirements in a JSON-RPC error envelope
3. **Client signs** an EIP-3009 `TransferWithAuthorization` typed-data
   payload (USDC contract on Base Sepolia, name="USDC", version="2")
4. **Second `tools/call

…

## Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [Fato07](https://github.com/Fato07)
- **Source:** [Fato07/prism](https://github.com/Fato07/prism)
- **License:** Apache-2.0
- **Homepage:** https://prism-dashboard-production-e6e3.up.railway.app

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** yes
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/mcp-fato07-prism
- Seller: https://agentstack.voostack.com/s/fato07
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.