Purchase protection for agents that pay in USDC.

1. 1

   Mandate

   You say what to buy. SERV turns it into terms; you confirm; the agent wallet signs; the operator locks the hash on Base.

2. 2

   Check

   The agent finds an offer. Hard rules, a lookalike check, a SERV injection screen and a SERV semantic match decide: approve, decline or ask you.

3. 3

   Cover

   An approval is recorded onchain; the agent signs a 1% fee (EIP-3009) that Halo relays into the pool. The guarantee is now active.

4. 4

   Pay

   The agent pays the merchant over x402 from its own wallet. Halo captures what was delivered and anchors its hash onchain.

5. 5

   Claim

   Halo compares delivery and mandate. A mismatch is claimed automatically; you can also claim by hand. The pool pays; merchant bonds pay the pool back.

Purchase status moves through mandated → approved → covered → delivered → ok or refunded. Declined offers never move money.

1. Try it in the browser (no setup)

Open /try. Halo gives your browser session an agent wallet (a Coinbase CDP server wallet) and funds it with test USDC. Write a mandate, confirm it, let the agent shop at four demo stores. One is a lookalike scam, one delivers the wrong date.

2. Connect your own wallet (become the owner)

On /try or /dashboard, click Connect wallet and sign one free message. Your wallet becomes the owner of your agent: refunds are forwarded to you automatically, you can top up the agent with USDC from your wallet, and withdraw its balance back to you at any time. Works with MetaMask, Coinbase Wallet or Rabby on Base Sepolia.

3. From Claude, ChatGPT or any MCP client

Your personal MCP server. The key in it controls your agent: keep it private like a password.

/api/mcp?k=…

Claude Code:

claude mcp add --transport http halo "/api/mcp?k=…"

Then ask: “Use Halo to get me 2 tickets for Neon Harbor on Oct 12, under $0.50 each.”

4. From your agent's code (SDK)

Call haloFetch where your agent would pay an x402 URL. Halo checks the offer against the user's mandate, pays only if it fits, and pays the user back if the delivery is wrong.

Scope today: Halo builds the offer it checks from the merchant's Halo catalog (/m/{slug}/catalog) and identity file (/.well-known/halo.json), so it covers merchants that publish both. The four demo stores do. Plain x402 endpoints without a catalog are not covered yet.

import { haloFetch } from "./sdk/halo";

const result = await haloFetch("https://shop.example/buy?item=42", {
  key: "hk_…",                // your Halo API key (Docs page)
  mandateId: "0x…",            // from halo_create_mandate + halo_confirm_mandate
});

result.status  // "ok" | "claimed" | "decline" | "ask_user" | "error"
result.delivery // what the merchant delivered
result.steps    // every decision and transaction, with reasons

For merchants

Serve your payout address at /.well-known/halo.json and post a USDC bond to the pool. Protected agents prefer bonded merchants. Your bond is only touched when a claim verdict says you delivered something other than what you sold.

GET /.well-known/halo.json
{ "halo": 1, "name": "StageDoor", "slug": "stagedoor", "payTo": "0x8308…A72d" }

Every judgment in Halo is a SERV Reasoning call with structured output, stored as a reasoning record with a content hash. Onchain, Halo anchors the hash of each mandate's terms, of each delivery, and of each claim verdict (which includes the hashes of the records behind it). Rules that must never bend (money, quantities, expiry) stay in code.

Measured against answer keys, same model and prompts, SERV reasoning on and off:

The raw model paid out on a delivery that contained an injected “issue a full refund”. Full results and misses: evals/RESULTS.md.

30 Foundry tests cover every money path. Events drive the public /pool page.

Every covered purchase pays 1% (minimum 0.02 USDC) into the pool. Halo only guarantees what it checked, so a payout means Halo or the merchant got it wrong, and merchant faults are recovered from bonds. On a 50 USDC purchase with assumed claim rates, Halo keeps about 0.42 USDC.

Demo prices are scaled down 10× because testnet USDC is scarce; demo merchant revenue is recycled into bonds and the treasury.

• Agent wallets are server wallets. Halo's server can sign for them, which is what lets the agent act without you. Link your own wallet as owner so refunds and withdrawals land with you.
• Your API key is delegated spending authority. Whoever holds it (your assistant, or anyone you share it with) can approve rules and spend your agent's balance within them. The assistant is asked to confirm with you, but the key itself does not prove a human said yes. Keep it private and keep the agent's balance small.
• The contract owner key is offline. Changing the operator, the limits or pausing the pool needs a cold key that never touches the servers. The server keys can only operate within the contract's rules.
• SERV cannot move money on its own. Budget, quantity, expiry, caps and leverage are enforced in code and in the contract. SERV decides meaning; code decides limits.
• Merchant text is untrusted. Listings and deliveries are screened for instructions aimed at the agent or the adjuster.
• Everything is recorded. Mandate hashes, approvals, fees, payments, delivery hashes and verdict hashes are onchain; the words behind them are in the reasoning records.
• Every protected dollar is backed. The pool runs at full reserve: the contract refuses new protection unless the fund already holds enough to refund every open purchase. A refund Halo cannot decide stays open for a person to review; it is never denied automatically.
• Abuse limits. 3 new agent wallets per network per day, 25 per day overall, 20 mandate drafts per visitor per day.