Skip to main content
Glama

NullClear (nullclear.dev / nullclear.com)

Autonomous Non-Custodial Clearing & Reputation Protocol for x402 AI Agents

NullClear Arbiter MCP server – quality and maintenance score on Glama NullClear Arbiter MCP server – quality and maintenance score on Glama

NullClear eliminates payment risk in Agent-to-Agent (A2A) commerce. In standard HTTP 402 Payment Required flows, buyers are forced to pay before seeing whether an upstream agent hallucinates, crashes, or returns malformed data. NullClear introduces deferred non-custodial schema escrow: the buyer signs an EIP-3009 TransferWithAuthorization, the arbiter cryptographically validates the upstream agent's output against the buyer's schema contract, and only settles payment upon 100% verification. If the seller hallucinates or crashes, the authorization is voided and $0 is spent.


Architecture Overview

                      ┌──────────────────────────────────────────┐
                      │              BUYER AGENT                 │
                      │  (@nullclear/x402-arbiter client/fetch)   │
                      └─────────────────────┬────────────────────┘
                                            │
                          1. Target request │ (Intercepted 402)
                          2. EIP-3009 signed│ & Schema defined
                                            ▼
                      ┌──────────────────────────────────────────┐
                      │          NULLCLEAR ARBITER               │
                      │     (Cloudflare Worker + Hono)           │
                      │  - Sybil & Wash-Trade Engine             │
                      │  - Deterministic JSON Schema Validator   │
                      │  - EIP-712 Receipt Attestation           │
                      └─────────────┬──────────────┬─────────────┘
                                    │              │
                   3. Proxy Request │              │ 4. If Valid: Settle
                      with Escrow   │              │    If Invalid: VOID ($0)
                                    ▼              ▼
                     ┌──────────────────┐    ┌───────────────────┐
                     │   SELLER AGENT   │    │  EIP-3009 SETTLE  │
                     │  (HTTP 402 API)  │    │  (USDC on Base)   │
                     └──────────────────┘    └───────────────────┘

Related MCP server: revettr

Monorepo Packages

Package

Path

Description

@nullclear/shared

packages/shared

Core constants (Base Mainnet 8453, Sepolia 84532), ERC-8004 ABIs, x402 V2 types, EIP-3009 & KYA EIP-712 schemas.

@nullclear/worker-arbiter

packages/worker-arbiter

Cloudflare Worker Hono app handling deferred escrow clearing (/v1/clear), Sybil-resistant trust scores (/v1/score), KYA mandates (/v1/kya), and machine discovery honeypots (/llms.txt, /.well-known/*, /openapi.json).

@nullclear/x402-arbiter

packages/x402-arbiter

Agent SDK providing createNullClearFetch with automatic HTTP 402 interception, EIP-3009 authorization signing, and Zod/JSON schema protection.

@nullclear/mcp

packages/mcp-server

Model Context Protocol server exposing nullclear_check_reputation, nullclear_escrow_x402_call, and nullclear_verify_kya_mandate tools to autonomous agents.

@nullclear/e2e-simulator

packages/e2e-simulator

Self-contained local simulator validating honest sellers, hallucination voids, 500 crash voids, and Sybil wash-trade detection.


Protocol Guarantees

  1. Non-Custodial Deferred Settlement: Buyer authorizations are held in escrow by the arbiter and only executed via EIP-3009 if the seller fulfills the schema contract. If the seller returns invalid schema or error codes, settlement is discarded.

  2. Sybil & Wash-Trade Detection: Analyzes counterparty concentration graph. If $>60%$ of transaction volume comes from a single buyer address across $\ge 3$ transactions, a wash-trading penalty is applied and the HIGH_COUNTERPARTY_CONCENTRATION_WASH_RISK flag is raised.

  3. KYA (Know Your Agent) Corporate Liability Mandates: Cryptographically ties an on-chain agent wallet to a legally registered corporate entity with defined liability coverage and per-transaction limits.

  4. Machine Discovery & Self-Describing Agents: Complete llms.txt, /.well-known/agent.json, /.well-known/x402.json, /.well-known/mcp.json, and OpenAPI 3.1.0 specifications.


What's New in v1.1.0

  • 🛡️ Deep Deterministic Value Invariants: Extend basic JSON schema validation with field-level semantic invariants (gt, gte, lt, lte, eq, neq, minLength, maxLength, pattern, notContains, and maxStalenessSeconds). Stale data or numeric drift triggers instant authorization voiding ($0 charged).

  • 🛑 Canonical LLM Refusal Guard: Automatically inspects text and JSON responses for common LLM refusal boilerplate ("as an ai language model", "i cannot fulfill this request", "i am unable to assist", rate limits, and server error strings), treating refusal as non-delivery.

  • 🔀 Autonomous Multi-Seller Failover Routing: Callers can provide ordered fallback candidates (fallbacks: [{ targetUrl, sellerAgentId, paymentSignatureHeader }]). If the primary seller crashes or fails validation, the Arbiter voids the primary authorization and automatically routes to the secondary candidate without roundtripping back to the client agent.

  • 🔒 Outbound Spend Firewall & Anti-Abuse Guards: Protect buyer agent wallets with per-call caps (maxPerCallAtomic) and daily rolling spend policies (maxDailyWalletAtomic). Rejects self-clearing wash-loops (buyer address === seller address) and enforces minimum on-chain settlement floors.


Quickstart

Prerequisites

  • Node.js $\ge 20$

  • pnpm $\ge 9$

Install Dependencies

pnpm install

Build All Packages

pnpm build

Typecheck

pnpm typecheck

Run Tests

pnpm test

Run Live Autonomous E2E Simulator

pnpm demo

Available Tools

3 tools
nullclear_check_reputationB

Inspect an AI agent's trust score (0-100), clearing reliability, Sybil wash-trade penalty flags, and corporate KYA backing on Base

ParametersJSON Schema
NameRequiredDescriptionDefault
agentIdYesThe ERC-8004 agent token ID or registered identifier
chainIdNoBase chain ID (8453 for Mainnet, 84532 for Sepolia)

TDQS

B3.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. 'Inspect' implies a non-mutating read and the enumerated fields partially compensate for the missing output schema, but it says nothing about authentication requirements, rate limits, whether results are cached/live, or what happens on an unknown agentId.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence with no filler; every clause names a distinct returned signal. It is slightly run-on as a comma list, which mildly hurts scannability but wastes no words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 2-parameter read tool with no output schema and no annotations, the description usefully enumerates the returned signals and their 0-100 scale. However it leaves the behavioral contract (safety, auth, error cases) unstated, which is a real gap given zero annotation coverage.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so both agentId (ERC-8004 token ID) and chainId (Base mainnet/Sepolia) are already fully documented in the schema. The description adds only the vague phrase 'on Base', which the schema states more precisely, so baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ('Inspect') and enumerates exactly what is read: trust score with its 0-100 range, clearing reliability, Sybil wash-trade penalty flags, and KYA backing. It is clear on its own, but it does not differentiate from the sibling nullclear_verify_kya_mandate, which overlaps on the 'KYA backing' element.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives no when-to-use guidance, no prerequisites, and never mentions the sibling tools (escrow_x402_call, verify_kya_mandate) or when one should be preferred over another. The only implied usage is that this is a read/lookup call.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

nullclear_escrow_x402_callB

Execute an x402-gated HTTP API call through NullClear deferred schema escrow. The arbiter guarantees payment is only settled if upstream returns valid data matching your schema contract. If the seller hallucinates or crashes, $0 is spent.

ParametersJSON Schema
NameRequiredDescriptionDefault
methodNoGET
targetUrlYesUpstream API endpoint demanding x402 payment
jsonSchemaNoJSON Schema draft-07 contract that response must strictly satisfy
minTrustScoreNoMinimum acceptable trust score for seller (0-100, default 50)
sellerAgentIdNoSeller's agent ID for reputation check and Sybil wash-trade gating
requiredFieldsNoDot-notation field paths that must exist in response (e.g. ['data.price'])
buyerPrivateKeyNoOptional buyer private key (defaults to BUYER_PRIVATE_KEY environment variable)

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It does disclose the central economic behavior well ('payment is only settled if upstream returns valid data', '$0 is spent' on hallucination or crash), but omits operational traits such as the private-key auth requirement, settlement latency, and what happens on schema mismatch beyond the refund guarantee.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three tight sentences, front-loaded with what the tool does and followed by the escrow guarantee. No filler, though the closing benefit sentence is partly rhetorical rather than informational.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 7-parameter, no-output-schema tool with no annotations, the description covers the value proposition but not the mechanics: how the response contract is enforced, what the caller receives on success vs. failure, or how the trust-score and seller-ID gates interact.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 86%, so the schema already documents nearly every parameter. The description's mention of 'your schema contract' loosely ties to jsonSchema/requiredFields but adds no format, defaults, or interaction detail (e.g. how minTrustScore relates to sellerAgentId) beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific verb and resource ('Execute an x402-gated HTTP API call') and frames it within a named mechanism (NullClear deferred schema escrow). It is clearly distinct from the reputation-check and KYA-verification siblings, though it never explicitly contrasts itself with them.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is only implied: the agent can infer this is the tool for making a paid upstream call with escrow protection, but there is no explicit when-to-use, no prerequisites, and no mention of the sibling tools or when to run reputation/KYA checks first.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

nullclear_verify_kya_mandateB

Verify an agent's Know Your Agent (KYA) corporate liability mandate, active validity, and whether a proposed transaction amount is within corporate limits

ParametersJSON Schema
NameRequiredDescriptionDefault
agentIdYesThe ERC-8004 agent token ID
chainIdNoBase chain ID (default 8453)
transactionAmountUsdYesAmount in USD intended to spend in the transaction

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It usefully discloses the three things verified (mandate existence, active validity, limit compliance), which implies a read-only check, but does not state the read-only nature outright, nor any auth, rate limit, or failure behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single dense sentence that front-loads the resource (KYA mandate) before the verification aspects. No filler, though the three enumerated checks make it slightly run-on.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema, so the description should clarify what the verification returns (pass/fail booleans, reasons, limits). It does not, and with zero annotations the agent also lacks auth and error-handling context, leaving a meaningful gap for a verification tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so both required params (agentId, transactionAmountUsd) and chainId are already documented. The description ties transactionAmountUsd to corporate-limit checking, adding slight meaning, but does not go beyond the schema's own parameter docs — baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ('Verify') and a well-scoped resource: the agent's KYA corporate liability mandate, its active validity, and whether a transaction amount fits corporate limits. This is clearly distinguishable from a reputation check or escrow call, though it never names the siblings explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The intent (verifying a mandate before transacting) is implied but never stated as explicit when-to-use guidance. There are no exclusions or pointers to the sibling tools (check_reputation, escrow_x402_call), so the agent must infer the sequencing itself.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 3 tool updates
    • First observednullclear_check_reputation
    • First observednullclear_escrow_x402_call
    • First observednullclear_verify_kya_mandate

TDQS

A3.7/5.0

Scored across 3 tools

Disambiguation4/5

check_reputation and verify_kya_mandate both touch on KYA/corporate backing, so there is minor overlap. However, one is a broad trust inspection while the other validates a specific mandate and transaction limit, and escrow_x402_call is clearly the only execution tool.

Naming Consistency5/5

All three tools use the nullclear_ prefix and snake_case, with verb-first action names (check, escrow, verify). The x402 protocol token in the middle is slightly unusual but still readable and consistent with the rest.

Tool Count5/5

Three tools align tightly with the stated arbiter purpose: reputation check, escrow execution, and KYA verification. This is well-scoped rather than thin, since each covers a core gatekeeping function.

Completeness4/5

Core pre-transaction and execution paths are covered, but there is no tool to inspect escrow status/receipts or handle dispute resolution after an escrow call. Those are minor gaps an agent can mostly work around.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers