Kanoki - TBC

Demo

About

Kanoki (金の木, "money tree") lets a human give an AI agent capital, lets that agent delegate smaller amounts to sub-agents, and enforces narrower permissions all the way down the tree. A human creates and funds a root vault and authorizes a master-agent operator. The master moves part of its capital into a child vault; children can delegate again within a three-level tree. Every node is a real ENSv2 subname (e.g. researcher.capital.agentcapitalusdc.eth) with Enhanced Access Control roles, and every node has its own vault, so an agent's available funds are bounded by custody, not by a promise. On every action our controller checks the ancestor chain: policies, current authority, expiry and revocation. Agents actually spend through three channels. Uniswap v4 for bounded swaps and vault-owned liquidity positions, where swapping, managing liquidity, collecting fees and exiting are distinct, individually grantable capabilities. x402 for service purchases with official Circle Test-USDC: an HTTP 402 becomes a vault-bound EIP-3009 authorization validated via ERC-1271 and an explicit PAY role, and a retry never charges twice. And an MCP server that exposes those operations to Claude Code and Codex as tools, without the model ever holding a wallet key. Curvegrid MultiBaas indexes the controller's capital and strategy events and feeds the dashboard's live tree and activity history. Capital is custody, permissions are a mandate, and the human can narrow or revoke any branch at any time. Built on Ethereum Sepolia by TUM Blockchain Club for ETHGlobal Tokyo.

How it's made

Contracts (Foundry). CapitalController holds the policy logic; CapitalVault is the per-node custody contract; NodeFactory and VaultFactory create subtrees. The controller checks ancestor policies, current authority, expiry and revocation on every call, and each vault verifies the current agent signer, its generation and the amount limit before releasing funds. Tests cover vault, controller, swap, liquidity, owner exit and the managed ENS registry. ENSv2 Enhanced Access Control. Every node is a subname under agentcapitalusdc.eth in a managed registry we operate. EAC roles carry the permissions (delegate, swap, manage liquidity, PAY); our controller resolves the ancestor chain from ENS rather than from its own storage, so the name tree and the authority tree cannot drift apart. Uniswap v4. Vaults own their LP position NFTs directly. Swapping against the fixed USDC/DEMO-USD pool, adding and removing liquidity, collecting fees and exiting are separate capabilities that a parent grants or withholds per child, and each is bounded by the child's vault balance. Revocation stops all future management by that node. x402 with Circle USDC. A real HTTP 402 request leads to a vault-bound EIP-3009 transferWithAuthorization signature, validated through ERC-1271 against the vault's current signer, PAY role, ENS ancestry, amount and expiry. Circle's nonce handling gives replay protection; our runtime keeps a private journal so retries are idempotent. The MCP tools getPaymentServices and purchaseService restrict agents to fixed services, recipients and price ceilings. Curvegrid MultiBaas. We register the controller in MultiBaas and query its events through the Event Query API, enriching each transaction with the ABI-decoded receipt so every activity row is bound to chainId:txHash:logIndex. The dashboard's activity and history views and the tree state come from this index, not from raw RPC; MultiBaas also ran our deployment and configuration scripts. MCP and runtimes. A stdio MCP server ships as a Codex plugin and Claude Code config. It holds no wallet key: it forwards tool calls with a bearer token to the user's local companion runtime, which binds the token to the real root or worker context and checks on-chain authority before executing. Strict tool schemas reject a model-supplied agentId, so node IDs in arguments are targets, never proof of authorization. Each runtime worker has its own key and runs in its own container. Owner-only emergency actions stay wallet actions outside the plugin. Frontend. Next.js on Vercel with overview, tree, applications, activity and setup views; a public MCP guide is served at /mcp. Hacky bits. MultiBaas Event Query rows carry no log index, so we round-trip every hash through the receipt endpoint and merge overlapping pages by txHash:logIndex. The x402 seller in the demo is our own local service that pays the test owner back, so the full loop can run on testnet without a third-party merchant.