The owner
Sets the agent identity, recipient allowlist, limits, expiry, and revocation authority.
RULES BEFORE REQUESTS
A / OWNER
B / AGENT
51° / THE BOUNDARY / 2026
TRUST, BUT VERIFY
Power to act.
Authority to stop.
Your AI agent can be fooled. AgentShield is a NEAR Testnet vault that limits what it can pay, and you don't have to take our word for any of it: replay a real settled payment and three attacks the contract refused, then recheck every claim against public RPC yourself.
THE OWNER DEFINES IT.THE CONTRACT ENFORCES IT.THE AGENT REQUESTS IT.
THE PRINCIPLE / 001
The machine can request. Only the mandate can release.
DEPLOYED / NEAR TESTNETFour characters. One rule.
The owner writes the limits, the agent asks, the guardian enforces, and the attacker tries to talk its way past. Judge mode tells the whole story in six short scenes, using real Testnet records.
The ownerWrites the mandate and can revoke it. The agentAsks for payments. Never holds the money. The guardianThe vault contract. It checks every request itself. The attackerTries to talk the agent past the line.
THE BUILD / THE RULE
Security is a structure.
AgentShield is built around a contract-controlled vault, deployed on NEAR Testnet. Each boundary has a distinct role, a precise action, and an auditable outcome.
The mandate
The deployed NEAR contract checks exact amounts and nonces before constructing a payment.
CONTRACT AS BOUNDARYThe agent
Proposes an action. It cannot reach the owner's unrestricted wallet or bypass the vault.
REQUEST, NEVER CUSTODY
THE MANDATE / VISUAL STUDY
THE PRODUCT PROMISEPower held
Power held
behind a line.
Spending rules belong at the execution boundary. The first native NEAR Testnet payment passed through the contract-held vault; authorization, transfer, and settlement are recorded separately.
The vault is deployed on NEAR Testnet. One restricted-agent payment has settled and can be checked in the Evidence view.
CURRENT STATE / HONEST BY DESIGN
A bounded mandate.
A real Testnet mandate limits one agent, one recipient, and a total budget. The Evidence view rechecks the first payment against public RPC.
01 / AGENTRESTRICTED KEY
A function-call key is scoped to the vault payment method.
02 / MANDATESET / TESTNET
Version 2 of the onchain mandate allows up to 0.01 NEAR per payment, until 2026-11-30 00:00 UTC.
03 / EVIDENCEONE SETTLED
A 0.005 test NEAR transfer has a finalized receipt.
Verify it yourself.
No wallet needed. Each link opens the raw evidence or the code behind it.
- Live payment proofJSON rechecked against public Testnet RPC. Expect PASS and SETTLED.↗
- Live rejection proofsThree refused attacks, each with zero vault transfer receipts.↗
- The payment on NearBlocksThe settled 0.005 test NEAR transaction on the Testnet explorer.↗
- Claims tableEvery rule the vault enforces, with its line of code, its tests and its transaction.↗
- Source code on GitHubThe contract, tests and verifiers. Run npm test and cargo test.↗
Judge mode · six scenes · about 70 seconds · no wallet
One agent. One guardian. One boundary that cannot be crossed.
Meet the owner, the agent and the guardian. Then watch replays of a real Testnet payment that settled and real attacks the contract refused. Every fact on screen says where it comes from.
One agent. One guardian. One boundary that cannot be crossed.
How to read the labels
SIMULATION Local model in your browser. No chain.
HISTORICAL ONCHAIN REPLAY A finalized Testnet transaction, replayed. Nothing is executing now.
LIVE RPC VERIFIED Appears only after a live recheck against public Testnet RPC passes during your visit.
LIVE MODEL REPLY A real reply from the model on NEAR AI Cloud during your visit, signed inside its TEE and checked. Nothing is signed or sent.
Explore at your own pace.
Open any scene in its finished state. The film stays paused until you press play. Keyboard: space plays or pauses, the arrow keys change scenes.
07 / Attack the vault · no wallet needed
Attack the vault.
Pick an attack and watch the boundary answer. All ten were really sent to NEAR Testnet (two payments and eight attacks), and you can recheck each one live. Revocation ran on a separate lab vault, because revoking the main one would stop it for good.
Attack
Write your own attack.
This runs in the local simulator, seeded with the mandate's rules: one agent, one allowed recipient, 0.01 NEAR per payment, 0.02 per UTC day, 0.05 in total, plus the one 0.005 payment that already settled. It takes the mandate's current expiry from the live check when that answers. Every result here is labelled SIMULATION.
SIMULATION
Challenge · prompt injection
Words can bend a model. Not a contract.
A supplier note hides an instruction to send the money elsewhere. See what the agent's offchain preflight does with the proposal, and what the vault contract does on its own. The model step here is simulated so you can try both outcomes. Below it is what the real NEAR AI model did with the same note, and a box where you can write your own note and send it to the live model.
- 1 · Legitimate instruction
- 2 · Injected instructionHidden inside a supplier note the agent was asked to read.
02 / THE MANDATE
Write the boundary.
Draft a mandate to see the fields the vault checks. Saving keeps it in this browser only; it does not change the deployed Testnet mandate.
OWNER / HOLDS AUTHORITYLOCAL DRAFT
These fields draft a mandate locally. This draft remains local; it does not edit the live Testnet mandate.
NO TRANSACTION SIGNED03 / THE RECORD
Proof, not a promise.
The first restricted-agent payment is settled. This view rechecks its transaction, transfer receipt, and contract accounting.
DECISION / EVIDENCEFINALIZED TESTNET PROOF
Both payments are checked against public Testnet RPC each time you open this view.
LIVE VERIFICATIONPermission given.
The exact request passed policy checks. Funds may still be in transit.
Payment proven.
Chain result and recipient balance are checked before the interface claims settlement.
Boundary held.
A rejected request must have its own genuine contract result and show that no payout was initiated. Eight live rejection proofs are listed below, including a request refused after the owner revoked the mandate on a separate lab vault.
VERIFYING LIVE PROOF
Checking the chain.
The public Testnet transaction and contract state are checked before settlement is displayed.
04 / OWNER AUTHORITYThe final word
The final word
is human.
The owner must be able to stop future requests. Pending transfers remain a separate, visible state.
OWNER / REVOCATIONTESTNET MANDATE SET
The deployed vault holds an owner-signed mandate. Pause and revoke are owner-signed transactions sent from the owner's own machine; this site never signs.
CONTROLS UNAVAILABLEPause requests.
A pause would block new authorizations after the chain records it. Already submitted transfers may still settle.
Revoke authority.
Revocation blocks new requests. It cannot retroactively cancel a transfer already submitted.
05 / INSTANT DEMO
Challenge the mandate.
Try a real set of policy rules in a local simulation. Every result here is simulated; no wallet, vault, or blockchain transaction is involved.
SIMULATION / NO CHAINSIMULATION — NO ONCHAIN TRANSACTIONS
These decisions explain the intended rules. They do not prove that a deployed contract enforces them.
LOCAL / RESETTABLETHE POLICY PLAYGROUNDSet the rules.
Set the rules.
Then attack them.
Use example testnet identities. Changing a field resets the next scenario to a fresh local state, so each result can be read on its own.
MODE A / INSTANT DEMOLocal deterministic model. No keys, wallet approvals, transfers, RPC receipts, or explorer links.
AGENTSHIELD SECURITY TEST RUNNER
Five ways to challenge it.
Choose a test. The policy engine will show its decision and the state it changed.
MODE B / LIVE NEAR TESTNET
Two authorized requests have settled on the deployed Testnet vault, one sent by an agent through the MCP server. Eight contract rejections, including one after revocation, are independently verified in Evidence.
06 / LIVE TEST ENVIRONMENT
The test lab.
Check the public Testnet state of the four accounts behind the vault. Everything here is read-only, and nothing is signed.
TESTNET / LIVE STATELIVE RPC / TESTNET
Account results come from finalized NEAR Testnet state. Open Evidence to inspect the independently verified payment.
ONE SETTLED PAYMENTPUBLIC DEMO ACCOUNTS
Check the four roles.
The demo account IDs are public and prefilled. Checking them is read-only, so no wallet or account is needed.
OWNER ACTIONS / OFF THIS SITESigned on the owner's own machine.Mandate changes, pause and revoke are owner-signed transactions sent from the owner's computer, never from this browser. The 3 Nov renewal was signed that way: EuUUbL…vJXw ↗.
Where do the IDs come from?
- Owner — the account that signed the mandate; prefilled below.
- Agent — create a second account for the agent. It must differ from the owner.
- Recipient — use another testnet account you control, so a later payment can be checked.
- Vault — the deployed vault account is prefilled below.
Only paste public account IDs here. Never paste a recovery phrase or private key into any website.
NETWORK / NOT CHECKED
Enter your testnet account IDs, then run the live check. Blank roles are reported as unconfigured.
COUNTERPARTY CHECK / LIVE
Check a receiver before paying.
Before the agent signs, its guard reads the receiver from finalized Testnet state and compares it with the live mandate: the allowlist, look-alike names, a blocklist with evidence, and whether the account's code changed since the owner approved it. The guard warns and refuses. The vault contract still enforces every rule.
The same check runs in the AgentShield MCP server, so Claude, Codex or any MCP client calls it before it can request a payment. How to connect ↗
TRY A REDIRECT FROM THE RECORDED ATTACKS
Pick an example or enter any receiver, then check it against live Testnet state.
WHAT THIS CHECK CANNOT PROVE
This account check cannot prove a payment or rejection by itself. Open Evidence for the two finalized payments and the eight rejection proofs, revocation included.