Deployed
NEAR AI-agent auditor

What was registered for this agent, and what can change it.

Free, open-source (MIT) public auditor for AI-agent contracts on NEAR. Read-only audit of a NEAR agent account, or of a pasted registration, app compose, or deployment JSON. The ladder is PROVEN, NOT PROVEN, or RISKY. It describes the registered configuration. It does not judge payments.

Paste a live account id, or JSON text. This page does not read a local file.

Live examples

Account chips are live reads. Saved sample is the offline votron capture, not a live account. JSON in the box is pasted text, not a CLI local file. ironshield.near has no contract code deployed, so the shade interface is not proven. The saved seven-account snapshot still labels that row shade-v2.

01Report

One report. Every finding on the ladder.

Each line is plain English and, where a chain fact exists, links to it. The tool does not send transactions. It can sign a report file on your computer. That key stays on that computer.

No report yet.

Paste an account or JSON above and select Audit. The ladder appears here.

Go to the form
02The ladder

What the ladder means

The report also names the highest rung already on the ladder. That line is not a separate check. The counts stay the table of contents.

PROVEN

A direct check succeeded: a signature verified, two hashes were equal, or a view returned the value named in the sentence.

NOT PROVEN

The evidence was missing, the index may be incomplete, or the question is outside what a registration can show. This is not a pass.

RISKY

The registered configuration, or the account's keys, matched a concrete risk named in the sentence.

Threat model · printed in every report

TEE.fail showed that physical access to DDR5 memory can forge TDX quotes, including quotes that carry a dstack context. See https://tee.fail/.

A valid Intel TDX quote proves a TDX-attested registered configuration. It does not prove an honest operator.
03Pipeline

How Glassbox works

Glassbox answers one question: what was registered for this agent, and what can change it. It does not watch the guest, and it does not send a transaction.

account or file→network from the suffix→register_agent evidence→quote check (dcap-qvl + PCCS allowlist)→compose hygiene→access keys and contract checks→ladder report→optional --sign / verify

  1. Paste an account or a file.

    A live account id is read from NEAR. JSON pasted on this page is the text in the form. A CLI local file is read on your computer when you pass a path to glassbox. This page does not read local files.

  2. Network from the suffix.

    .testnet is testnet. .near is mainnet. Anything else is tried on mainnet, then testnet.

  3. Fetch the registration evidence.

    Glassbox looks up register_agent (or register_worker) and reads the arguments. It does not write to the chain.

  4. Verify the quote.

    @phala/dcap-qvl checks the signature. Fresh collateral comes only from the PCCS allowlist. A caller cannot choose that host.

  5. Compose hygiene.

    Image pins, public logs, secret-looking names, sockets, and the dstack image comparison. Values of secrets are not printed.

  6. Access keys and contract checks.

    Who holds a full-access key, who can call approve_codehash or approve_measurements, whether remove_codehash or remove_measurements shows up, and whether the contract code hash matches a known Shade template. Missing evidence stays NOT PROVEN.

  7. Ladder report.

    Each finding is PROVEN, NOT PROVEN, or RISKY. The report includes a threat-model paragraph: a valid quote is a TDX-attested registered configuration, not proof of an honest operator. It also states the registration time, how old that attestation is, and valid_until_ms when a Shade v2 view sent one. Those checks are proven at registration only. A registration is not a live process. By default Glassbox does not call a guest agent. Phala blocks those routes, so live observation stays NOT PROVEN.

  8. Optional --sign / verify.

    --sign writes a hash and a local signature. verify checks those and re-reads the registration. --anchor only records that you asked to publish the hash later. It does not send a transaction.

04Surfaces

You can ask in three places.

The command line is glassbox. An agent tool is MCP check_agent. This page is the web form, and it is deployed.

Terminal
# install and test (Node 20+)
$ pnpm install
$ pnpm test

# audit the captured votron registration on testnet
$ pnpm --filter cli start ac-sandbox.votron.testnet

# the same report as JSON
$ pnpm --filter cli start ac-sandbox.votron.testnet --json

# audit a file offline
$ node packages/cli/bin/glassbox.js packages/core/test/fixtures/votron-registration.json

The first live read spends about half a minute. History comes from NearBlocks, and Glassbox waits between those calls so it stays inside the free personal-use limit (about 6 per minute).

05Beyond one report

Sign it. Diff it. Gate it in CI.

None of these send a transaction.

Signed reports

--sign writes a hash and a local signature. verify checks those and re-reads the registration. --offline checks the hash and signature only.

node packages/cli/bin/glassbox.js packages/core/test/fixtures/votron-registration.json --sign --out report.json node packages/cli/bin/glassbox.js verify report.json --offline

Diff

glassbox diff compares two accounts or two JSON files and says what changed in the compose, the measurements, the codehash, and the findings.

node packages/cli/bin/glassbox.js diff fixtures/compose/pinned.json fixtures/compose/loose.json

Compose check

The Action runs glassbox check fixtures/compose/pinned.json --fail-on risky. The job fails when the audit has a risky finding.

node packages/cli/bin/glassbox.js check fixtures/compose/pinned.json --fail-on risky