NullClear Arbiter
OfficialNullClear Arbiter is an MCP server that lets AI agents check counterparty trust, safely execute x402 payments via deferred schema escrow, and verify KYA corporate liability mandates.
Check reputation: Inspect an agent's 0–100 trust score, clearing reliability, Sybil wash-trade penalty flags, and corporate KYA backing on Base (default chain 8453; Sepolia 84532).
Escrow x402 calls: Execute x402-gated HTTP requests (GET/POST/PUT/DELETE) through non-custodial deferred schema escrow, settling only if the upstream response satisfies your JSON Schema/required fields and seller trust threshold; hallucinated, invalid, or crashed responses void payment ($0 spent).
Verify KYA mandates: Confirm an agent's Know Your Agent corporate liability mandate is active and whether a proposed USD transaction amount is within corporate limits.
NullClear (nullclear.dev / nullclear.com)
Autonomous Non-Custodial Clearing & Reputation Protocol for x402 AI Agents
NullClear eliminates payment risk in Agent-to-Agent (A2A) commerce. In standard HTTP 402 Payment Required flows, buyers are forced to pay before seeing whether an upstream agent hallucinates, crashes, or returns malformed data. NullClear introduces deferred non-custodial schema escrow: the buyer signs an EIP-3009 TransferWithAuthorization, the arbiter cryptographically validates the upstream agent's output against the buyer's schema contract, and only settles payment upon 100% verification. If the seller hallucinates or crashes, the authorization is voided and $0 is spent.
Architecture Overview
┌──────────────────────────────────────────┐
│ BUYER AGENT │
│ (@nullclear/x402-arbiter client/fetch) │
└─────────────────────┬────────────────────┘
│
1. Target request │ (Intercepted 402)
2. EIP-3009 signed│ & Schema defined
▼
┌──────────────────────────────────────────┐
│ NULLCLEAR ARBITER │
│ (Cloudflare Worker + Hono) │
│ - Sybil & Wash-Trade Engine │
│ - Deterministic JSON Schema Validator │
│ - EIP-712 Receipt Attestation │
└─────────────┬──────────────┬─────────────┘
│ │
3. Proxy Request │ │ 4. If Valid: Settle
with Escrow │ │ If Invalid: VOID ($0)
▼ ▼
┌──────────────────┐ ┌───────────────────┐
│ SELLER AGENT │ │ EIP-3009 SETTLE │
│ (HTTP 402 API) │ │ (USDC on Base) │
└──────────────────┘ └───────────────────┘Related MCP server: revettr
Monorepo Packages
Package | Path | Description |
| Core constants (Base Mainnet 8453, Sepolia 84532), ERC-8004 ABIs, x402 V2 types, EIP-3009 & KYA EIP-712 schemas. | |
| Cloudflare Worker Hono app handling deferred escrow clearing ( | |
| Agent SDK providing | |
| Model Context Protocol server exposing | |
| Self-contained local simulator validating honest sellers, hallucination voids, 500 crash voids, and Sybil wash-trade detection. |
Protocol Guarantees
Non-Custodial Deferred Settlement: Buyer authorizations are held in escrow by the arbiter and only executed via EIP-3009 if the seller fulfills the schema contract. If the seller returns invalid schema or error codes, settlement is discarded.
Sybil & Wash-Trade Detection: Analyzes counterparty concentration graph. If $>60%$ of transaction volume comes from a single buyer address across $\ge 3$ transactions, a wash-trading penalty is applied and the
HIGH_COUNTERPARTY_CONCENTRATION_WASH_RISKflag is raised.KYA (Know Your Agent) Corporate Liability Mandates: Cryptographically ties an on-chain agent wallet to a legally registered corporate entity with defined liability coverage and per-transaction limits.
Machine Discovery & Self-Describing Agents: Complete
llms.txt,/.well-known/agent.json,/.well-known/x402.json,/.well-known/mcp.json, and OpenAPI 3.1.0 specifications.
What's New in v1.1.0
🛡️ Deep Deterministic Value Invariants: Extend basic JSON schema validation with field-level semantic invariants (
gt,gte,lt,lte,eq,neq,minLength,maxLength,pattern,notContains, andmaxStalenessSeconds). Stale data or numeric drift triggers instant authorization voiding ($0 charged).🛑 Canonical LLM Refusal Guard: Automatically inspects text and JSON responses for common LLM refusal boilerplate (
"as an ai language model","i cannot fulfill this request","i am unable to assist", rate limits, and server error strings), treating refusal as non-delivery.🔀 Autonomous Multi-Seller Failover Routing: Callers can provide ordered fallback candidates (
fallbacks: [{ targetUrl, sellerAgentId, paymentSignatureHeader }]). If the primary seller crashes or fails validation, the Arbiter voids the primary authorization and automatically routes to the secondary candidate without roundtripping back to the client agent.🔒 Outbound Spend Firewall & Anti-Abuse Guards: Protect buyer agent wallets with per-call caps (
maxPerCallAtomic) and daily rolling spend policies (maxDailyWalletAtomic). Rejects self-clearing wash-loops (buyer address === seller address) and enforces minimum on-chain settlement floors.
Quickstart
Prerequisites
Node.js $\ge 20$
pnpm $\ge 9$
Install Dependencies
pnpm installBuild All Packages
pnpm buildTypecheck
pnpm typecheckRun Tests
pnpm testRun Live Autonomous E2E Simulator
pnpm demoAvailable Tools
3 toolsnullclear_check_reputationB
Inspect an AI agent's trust score (0-100), clearing reliability, Sybil wash-trade penalty flags, and corporate KYA backing on Base
| Name | Required | Description | Default |
|---|---|---|---|
| agentId | Yes | The ERC-8004 agent token ID or registered identifier | |
| chainId | No | Base chain ID (8453 for Mainnet, 84532 for Sepolia) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. 'Inspect' implies a non-mutating read and the enumerated fields partially compensate for the missing output schema, but it says nothing about authentication requirements, rate limits, whether results are cached/live, or what happens on an unknown agentId.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler; every clause names a distinct returned signal. It is slightly run-on as a comma list, which mildly hurts scannability but wastes no words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 2-parameter read tool with no output schema and no annotations, the description usefully enumerates the returned signals and their 0-100 scale. However it leaves the behavioral contract (safety, auth, error cases) unstated, which is a real gap given zero annotation coverage.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so both agentId (ERC-8004 token ID) and chainId (Base mainnet/Sepolia) are already fully documented in the schema. The description adds only the vague phrase 'on Base', which the schema states more precisely, so baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('Inspect') and enumerates exactly what is read: trust score with its 0-100 range, clearing reliability, Sybil wash-trade penalty flags, and KYA backing. It is clear on its own, but it does not differentiate from the sibling nullclear_verify_kya_mandate, which overlaps on the 'KYA backing' element.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no when-to-use guidance, no prerequisites, and never mentions the sibling tools (escrow_x402_call, verify_kya_mandate) or when one should be preferred over another. The only implied usage is that this is a read/lookup call.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
nullclear_escrow_x402_callB
Execute an x402-gated HTTP API call through NullClear deferred schema escrow. The arbiter guarantees payment is only settled if upstream returns valid data matching your schema contract. If the seller hallucinates or crashes, $0 is spent.
| Name | Required | Description | Default |
|---|---|---|---|
| method | No | GET | |
| targetUrl | Yes | Upstream API endpoint demanding x402 payment | |
| jsonSchema | No | JSON Schema draft-07 contract that response must strictly satisfy | |
| minTrustScore | No | Minimum acceptable trust score for seller (0-100, default 50) | |
| sellerAgentId | No | Seller's agent ID for reputation check and Sybil wash-trade gating | |
| requiredFields | No | Dot-notation field paths that must exist in response (e.g. ['data.price']) | |
| buyerPrivateKey | No | Optional buyer private key (defaults to BUYER_PRIVATE_KEY environment variable) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It does disclose the central economic behavior well ('payment is only settled if upstream returns valid data', '$0 is spent' on hallucination or crash), but omits operational traits such as the private-key auth requirement, settlement latency, and what happens on schema mismatch beyond the refund guarantee.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three tight sentences, front-loaded with what the tool does and followed by the escrow guarantee. No filler, though the closing benefit sentence is partly rhetorical rather than informational.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 7-parameter, no-output-schema tool with no annotations, the description covers the value proposition but not the mechanics: how the response contract is enforced, what the caller receives on success vs. failure, or how the trust-score and seller-ID gates interact.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 86%, so the schema already documents nearly every parameter. The description's mention of 'your schema contract' loosely ties to jsonSchema/requiredFields but adds no format, defaults, or interaction detail (e.g. how minTrustScore relates to sellerAgentId) beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb and resource ('Execute an x402-gated HTTP API call') and frames it within a named mechanism (NullClear deferred schema escrow). It is clearly distinct from the reputation-check and KYA-verification siblings, though it never explicitly contrasts itself with them.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is only implied: the agent can infer this is the tool for making a paid upstream call with escrow protection, but there is no explicit when-to-use, no prerequisites, and no mention of the sibling tools or when to run reputation/KYA checks first.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
nullclear_verify_kya_mandateB
Verify an agent's Know Your Agent (KYA) corporate liability mandate, active validity, and whether a proposed transaction amount is within corporate limits
| Name | Required | Description | Default |
|---|---|---|---|
| agentId | Yes | The ERC-8004 agent token ID | |
| chainId | No | Base chain ID (default 8453) | |
| transactionAmountUsd | Yes | Amount in USD intended to spend in the transaction |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It usefully discloses the three things verified (mandate existence, active validity, limit compliance), which implies a read-only check, but does not state the read-only nature outright, nor any auth, rate limit, or failure behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single dense sentence that front-loads the resource (KYA mandate) before the verification aspects. No filler, though the three enumerated checks make it slightly run-on.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is no output schema, so the description should clarify what the verification returns (pass/fail booleans, reasons, limits). It does not, and with zero annotations the agent also lacks auth and error-handling context, leaving a meaningful gap for a verification tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so both required params (agentId, transactionAmountUsd) and chainId are already documented. The description ties transactionAmountUsd to corporate-limit checking, adding slight meaning, but does not go beyond the schema's own parameter docs — baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('Verify') and a well-scoped resource: the agent's KYA corporate liability mandate, its active validity, and whether a transaction amount fits corporate limits. This is clearly distinguishable from a reputation check or escrow call, though it never names the siblings explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The intent (verifying a mandate before transacting) is implied but never stated as explicit when-to-use guidance. There are no exclusions or pointers to the sibling tools (check_reputation, escrow_x402_call), so the agent must infer the sequencing itself.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
3 tool updates
- First observed
nullclear_check_reputation - First observed
nullclear_escrow_x402_call - First observed
nullclear_verify_kya_mandate
This server cannot be deployed
TDQS
Scored across 3 tools
check_reputation and verify_kya_mandate both touch on KYA/corporate backing, so there is minor overlap. However, one is a broad trust inspection while the other validates a specific mandate and transaction limit, and escrow_x402_call is clearly the only execution tool.
All three tools use the nullclear_ prefix and snake_case, with verb-first action names (check, escrow, verify). The x402 protocol token in the middle is slightly unusual but still readable and consistent with the rest.
Three tools align tightly with the stated arbiter purpose: reputation check, escrow execution, and KYA verification. This is well-scoped rather than thin, since each covers a core gatekeeping function.
Core pre-transaction and execution paths are covered, but there is no tool to inspect escrow status/receipts or handle dispute resolution after an escrow call. Those are minor gaps an agent can mostly work around.
Maintenance
Related MCP Connectors
Sovereign AI agent economy: oracle-verified tools, escrow, arenas; paid in USDC on Base via x402.
Payment-backed trust scores for AI agents on Base (ERC-8004). $0.01 per check via x402.
Agent-to-agent escrow on Base. Post quests with ETH/USDC bounties and settle on-chain.
AI agent-to-agent SLA agreements on Base with insurance, reputation, and x402 payments.
Related MCP Servers
- AlicenseNot gradedqualityFmaintenanceOnchain agent-to-agent commerce protocol using x402 and ERC-8004. Enables AI agents to buy/sell services, manage vendor catalogs, and process payments on Base.MIT
- AlicenseAqualityDmaintenanceCounterparty risk scoring for agentic commerce. Scores wallets, domains, IPs, and companies 0-100 before AI agents transact via x402 micropayments on Base13MIT
- FlicenseAqualityNot gradedmaintenanceTrust infrastructure for AI agents on Base. DEX Spread Oracle (live Uniswap V3 prices), on-chain escrow, insurance pool, and collective knowledge base. 7 smart contracts. Pay-per-query via x402 micropayments in USDC.6-
- AlicenseAqualityFmaintenanceTrust scoring, scam detection, and EAS attestations for ERC-8004 + x402 agents on Base.1860 npm1MIT