Your AI says the job is done. TrustShell checks the evidence.
Your agent says a GitHub Actions run succeeded and cites it. Inspect reads that run and checks the sentence.
1Agent claim
The check workflow succeeded on commit 5d1c5e3f57e1, run 39619591025.
2Actual evidence
GitHub's record of run 39619591025: conclusion success, on commit392797a69b6a. Open the run3TrustShell verdict
Contradictedcommit 5d1c5e3f57e1The claim cites commit 5d1c5e3f57e1; the inspected run is on 392797a69b6a.
9e523645b361f705af4d5f5b0c1223a2378bba12d3db76b0107cff6df16457deFor teams already using ERC-8004 identities, x402 payments or OpenClaw hooks. Each result below comes with a command you can run or a source you can open; two facts come from our own database and say so. Each section also says what is not built yet.
Developer preview on npm: @hyperdag/trustshell@latest (1.8.0). No account and no key unless a section says so. Help us test it.
Run the same check yourself
Three commands in an empty folder, with Node 22.13 or newer. No account and no key. npx fetches the package from npm; after that, the check's only request goes to api.github.com.
RUN=https://github.com/ DealAppSeo/ trustshell/ actions/ runs/ 39619591025printf 'The check workflow succeeded, run 39619591025.\n\nThe check workflow succeeded on commit 5d1c5e3f57e1, run 39619591025.\n' > claims.txtnpx @hyperdag/ trustshell@latest check "$RUN" --claims-file claims.txt; echo "exit $?"
$run = "https://github.com/ DealAppSeo/ trustshell/ actions/ runs/ 39619591025""The check workflow succeeded, run 39619591025.", "", "The check workflow succeeded on commit 5d1c5e3f57e1, run 39619591025." | Set-Content claims.txtnpx @hyperdag/ trustshell@latest check $run --claims-file claims.txt; "exit $LASTEXITCODE"
…### Claims: 3 supported · 1 contradicted · 1 not checked- **CONTRADICTED** `commit 5d1c5e3f57e1` - **Why** The claim cites commit 5d1c5e3f57e1; the inspected run is on 392797a69b6a.- **SUPPORTED** `The check workflow succeeded`- **SUPPORTED** `run 39619591025`…- **This workflow run succeeding: not checked.** `The check workflow succeeded` ……exit 1
@hyperdag/trustshell 1.8.0 from npm, run on 23 October 2026 in an empty folder with no account and no key; … marks lines left out. The first sentence is supported. In the second, the commit is contradicted, and its “succeeded” is not checked, because it names a commit this run is not on. Exit 1 means a claim was contradicted.One check, five verdicts: 3 supported · 1 contradicted · 1 not checked
Sentence 1:
The check workflow succeeded, run 39619591025.
- Supported
The check workflow succeededWhether workflow run 39619591025 (attempt 1, commit 392797a69b6a) concluded success with every job read. Not which tests it ran, not any other workflow or check on the commit, and not whether the change works. - Supported
run 39619591025Run identity only: whether the run this claim cites is the inspected run. Not what the run shows.
- Supported
Sentence 2:
The check workflow succeeded on commit 5d1c5e3f57e1, run 39619591025.
- Not checked
The check workflow succeededNot compared: nothing ties this claim to the inspected run. - Contradicted
commit 5d1c5e3f57e1Commit identity only: whether the commit this claim cites is the one the inspected run ran on. A SHA is matched as a prefix, and a match supports only at 12 or more hex characters. Not what the commit changes or fixes. - Supported
run 39619591025Run identity only: whether the run this claim cites is the inspected run. Not what the run shows.
- Not checked
An agent can have an identity and a reputation. Can you verify what earned it?
If you read ERC-8004 feedback, you can check one of ours on Base Sepolia today. Help us bind feedback to its evidence.
ERC-8004 gives an agent an on-chain identity and a reputation registry. A reputation is only as good as the feedback behind it. A study of the whole ERC-8004 ecosystem found that most reviewers on all three chains showed coordinated Sybil behaviour, and that once their feedback was removed, many rated agents had none left.
| Chain | Reviewers with coordinated Sybil behaviour | Rated agents left with no valid feedback |
|---|---|---|
| Ethereum | 73.5% | 15.8% |
| BSC | 59.2% | 77.9% |
| Base | 90.6% | 86.8% |
Our own agents have the same question to answer. In our own database, none of the 34 trades they settled in the 30 days to 21 October 2026 is yet proven to be between different owners. That figure is not one you can check yourself yet.
Our agents' 34 settled trades, 30 days to 21 October 2026
- 0 Different owners, proven
- 3 Different owners in our records, unsigned
- 23 Same owner
- 8 Unknown
What we want to show you: one piece of feedback bound to its receipt, its payment, the delivered work and an independent check of that work.
- MeasuredOur engine writes RepID feedback to the ERC-8004 reputation registry on Base Sepolia. The write shown here was read back from chain.
- Not checkedFeedback bound to its evidence: not built yet. One live agent's proof currently points at another agent's attestation (issue #589). See everything not built yet.
Feedback written on chain
0xcdb4f83f5843…2eb8f481ff1c8cagent 5863 · value 2276 · tag2 hyperdag_repidblock 48364821 · 2026-10-20 12:05 UTC
Measuredread back from Base Sepolia
Missing: signed evidence of the work this feedback rates. Nothing binds the two yet (issue #589).
The work it rates
Not linked, so not checked.
An agent can pay per request. Does anything stop it paying more than it should?
If your agent pays with x402, run this script with a throwaway key and watch TrustShell refuse a payment with no policy and one over its cap, before anything is signed.
x402 lets an agent pay for a request with a signed USDC authorization. TrustShell's default way to pay, guardedX402Payment, refuses before anything is signed when the call carries no policy or no cap, an origin that may not pay, or an amount over the cap it states. The policy, cap and origin are supplied by the calling code, so this stops a mistaken or unconfigured agent, not one that writes its own policy. They are caller-supplied, not owner-authenticated: nothing yet proves the owner chose them. The lower-level signer it wraps still enforces the cap.
This script runs on your machine against the npm package. Its key is random and holds nothing, and it moves nothing. Our hosted payment flow settles on Base Sepolia testnet only and needs an API key and a funded testnet wallet. The SDK signer defaults to Base Sepolia and will sign for another chain if you tell it to.
- MeasuredBoth refusals, before signing, run from the npm developer preview on 21 October 2026.
- Not checkedPaying only for work that checked out: not available through TrustShell yet. This is the part we want to build with you: starter task 10. See everything not built yet.
// spend.mjs: npm i @hyperdag/trustshell@latest, then node spend.mjsimport { randomBytes } from 'node:crypto';import { guardedX402Payment } from '@hyperdag/trustshell'; const base = { privateKey: '0x' + randomBytes(32).toString('hex'), to: '0x000000000000000000000000000000000000dEaD', agentId: 'demo' };for (const [label, p] of [ ['no policy', { origin: 'Cli', amount: 50000n, cap: 100000n }], ['over the cap', { origin: 'Cli', amount: 150000n, cap: 100000n, policy: { allow: true } }],]) { try { await guardedX402Payment({ ...base, ...p }); console.log('ALLOWED', label); } catch (e) { console.log('REFUSED', label, '-', e.message); }} $ node spend.mjsREFUSED no policy - policy_required: spend intent has no policy (fail-closed — missing policy refuses)REFUSED over the cap - cap_exceeded: amount 150000 > cap 100000
Your agent worked overnight. What did it do, what was allowed, what should you trust?
If you already use before_tool_call and after_tool_call, that is exactly where a policy check and a receipt would attach. Build the plugin with us.
before_tool_call can rewrite a tool call's parameters, block it or require approval, and after_tool_call sees each result, error and duration (OpenClaw hook reference). A TrustShell plugin would use them to check each call against the owner's policy and keep a receipt of what ran.
What works today: Inspect checks three kinds of plain sentence about a GitHub Actions run (that it succeeded, which run it was, which commit it ran on), as in the challenge at the top of this page. Anything else comes back not checked.
- Not checkedA TrustShell plugin that uses these hooks to check each call and keep a receipt: not built yet. Its specification is starter task 7. An OpenClaw skill that runs the CLI does exist. See everything not built yet.
# OpenClaw plugin hooksbefore_tool_call rewrite params · block · require approvalafter_tool_call observe result · error · duration # what a TrustShell plugin would addpolicy check per call not built yetreceipt per call not built yet
Use it from the tools you already have
None of these needs an account, an API key or a model, and each says what was run and what was not. We ran them on 22 October 2026, on Windows 11, with 1.8.0-rc.0, and re-checked the MCP launch on 1.8.0 on 23 October (20 tools).
- LangChain / LangGraph
- Verified: 20 TrustShell tools load over MCP, and ground_quote returns VERIFIED for a real quote and VETO for a misquote. A LangGraph agent on top is not verified (it needs a model).
- Hugging Face smolagents
- Verified, with one real gotcha: it needs "mcp[ws]>=1.30,<2". The newest mcp 2.x breaks mcpadapt, and mcp 1.x needs the websockets extra. A CodeAgent on top is not verified.
- GitHub Actions
- Command verified, workflow not yet run in Actions. The step was run locally against a finished public run: exit 0 when the claim names the workflow exactly, exit 3 (not checked) when it does not. Run it once on a fork and tell us what happens.
- Claude Code, Claude Desktop, Cursor
- Launch verified, apps not. The same launch was exercised by the two recipes above; the three apps were not opened.
- Inspect, the check of a claim against a GitHub Actions run, is a command-line command, not an MCP tool. The MCP server's
check_claimis a different check: model-based and hosted. Putting Inspect on MCP is starter task 9. - An MCP server runs code on your machine. Ours is outside the owner policy (Guard, merged into main but not in a release), so do not treat it as a sandbox.
Bring your own agent. Show us where we're wrong.
The finding we want most: a claim we wrongly supported. The card said SUPPORTED and the record does not back it. That is the worst bug this tool can have.
- A permission we failed to enforce
- The owner did not allow something, and it happened anyway.
- A record another machine cannot verify
- We wrote a record, and checking it somewhere else fails, or passes when it should not.
A bug we accept and fix gets a regression test in the repository's own test suite, so the next release has to survive it. Report it on the wrong-verdict form, or start with the contributing guide or the starter tasks.
$ npx @hyperdag/trustshell@latest check "$RUN" --claims-file claims.txt --out card…wrote record.json, card.md and card.html to card
RUN to the run you checked, as in the challenge at the top. Attach card.md and record.json with the run URL, your claims file as you ran it and the exit code. Public runs only; never paste a secret.What runs today, and what does not yet
- Inspect
- Check an agent's plain sentences about a GitHub Actions run against the run itself.
- In the npm developer preview
- Guard
- An owner policy that trustshell run and the CLI enforce. The MCP server is outside it, and anyone who can run the CLI can change it.
- Prototype: merged into main, not in a release yet
- Carry
- Your profile, a policy and the notes you select, moved as one signed file; the notes arrive quarantined.
- Prototype: merged into main, not in a release yet
- Earn
- Verified work raising what an agent is allowed to do.
- Roadmap
- ERC-8004 feedback bound to its evidence
- Feedback tied to its receipt, payment, delivered work and an independent check.
- Not built yet
- Paying only for verified work
- An x402 payment released only when the delivered work checks out.
- Not available through TrustShell yet
- OpenClaw plugin
- Uses the hooks for a policy check before each tool call and a receipt after it.
- Not built yet