Warrant

Demo

About

Warrant is a pay-per-call resource marketplace where an AI agent buys the things it normally cannot get without borrowing a human's credentials — a permanent on-chain name, an email inbox it owns and receives replies at, sealed agent-to-agent mail, a real phone number and SMS, language model inference, and memory written to a Hedera file nobody can edit. Each one is bought per call in USDC over plain HTTP using x402. There is no API key and no signup: the account that pays is the identity. The interesting part is not that an agent can pay. It is that it can be stopped. An owner funds an AgentTreasury contract on Hedera with a lifetime cap, a rolling window ("five dollars a day"), and an allowlist of resource kinds. The agent draws from it and spends without asking anyone — no approval step, no queue, no human in the loop. When it reaches past its limit, the contract refuses the draw before any money moves. That refusal comes from the chain, not from this service's database, and it would still hold if this service were shut down tonight. An agent cannot inflate a draw either: it names a listing, and the price comes from the on-chain market rather than from the agent. Everything is public and verifiable without credentials. The catalogue is the same table the server charges against, so it cannot advertise a price it will not honour. The ledger shows every purchase and every refusal. Every settled purchase carries a signed receipt binding the account, the resource, the amount and the settlement transaction, checkable against Hedera's mirror node without trusting us. The agent signs with a key it does not hold a copy of. Its spending key is a Privy server wallet under a key quorum, and the signing policy refuses to move HBAR or touch the stablecoin contract directly. It is live: the API, the console, a public ledger, an npm client, a skill file for coding agents, and an MCP gateway plus two published Recipes on Bazantic.

How it's made

The service is Node 22 and TypeScript on Express, with x402 v2 (@x402/core, @x402/express, @x402/fetch, @x402/hedera) doing the payment handshake: a paid route answers 402 with terms, the client signs an x402 payment and retries, and the middleware settles through the Blocky402 facilitator on hedera:testnet in USDC 0.0.429274. The facilitator sponsors the network fee, so a paying agent carries stablecoin and no HBAR at all. Three Solidity 0.8.24 contracts on Hedera's EVM, built and tested with Foundry (28 tests passing). AgentIdentity is a soulbound ERC-721, one per address, carrying the public key other agents seal mail to. ResourceMarket is a permissionless listing registry — anyone may list, and draws are priced from it so an agent cannot name its own number. AgentTreasury holds the money and the ceilings: a lifetime cap, a rolling window, and an allowlist of kinds, reverting with WindowCapExceeded before anything moves. Registration and listing are both open on purpose; a registry behind an admin key is a customer list, not a registry. The piece I am most pleased with is the Privy integration, because it required an insight rather than an import. AgentTreasury.draw pays msg.sender on the EVM, while the x402 payment is a native Hedera transfer — so the account that draws and the account that pays must be the same one. They can be: a Hedera signature is secp256k1 over keccak256(bodyBytes), returned as a compact r‖s, which is exactly Privy's secp256k1_sign primitive. So one Privy server wallet, owned by a key quorum whose private half was generated locally and never sent to Privy, covers both worlds. It even co-signed the AccountCreateTransaction that attached its own EVM alias. The signing policy is written as what Privy's engine can actually enforce rather than what would read best — a matching DENY beats any ALLOW, there is no neq operator, and starts_with is unsupported on the destination, so "only ever call the treasury" is inexpressible and I shipped the enforceable complement instead, documented as such in the code. One deliberate split: sealed mail is decrypted with a separate messaging key the agent holds itself, because an agent that signs with a custodial key still needs a key nobody else can read its post with. Sealed mail is ECIES over secp256k1, with the recipient's key read from the contract and never from the request, so a sender cannot be talked into sealing to an attacker's key. For discovery: the OpenAPI document is generated from the same catalogue constant the server charges against, and Bazantic turns it into 20 MCP tools with x402-mpp auth, plus two published Recipes — one that stands up a new agent end to end, one that audits what an agent spent using only free reads. There is also warrant-client on npm, where `warrant create` generates a key locally, `warrant fund` walks both faucet steps with a QR code, and `warrant buy` wraps the 402, the payment and the retry into one call. Frontend is Vite, React and Tailwind 4, with an ogl shader field in the hero.