phosphor

What it is

The app is the car. The agent is the driver. You hold the key.

Phosphor runs on your Mac and nowhere else. There is no server, no account and no telemetry. Every request it sends to NEAR Intents' 1Click service carries the label phosphor, which 1Click's public explorer shows. Your keys sit in a sealed file on your own disk: sealed to the Mac's Secure Enclave on a Touch ID wallet, with your password on a password wallet. Any MCP agent drives the app (Claude Code, Codex, anything that speaks MCP), or the app runs its own assistant. The agent reads your money, prices a move and proposes it. The agent can never approve. A send, a withdrawal, a rule change and any move above your click threshold wait for your click in the window. Smaller swaps, Hyperliquid deposits and trades run on their own, inside a daily limit, under rules the policy engine checks with no model in the path.

Two venues, and only two. A swap reaches any coin NEAR Intents lists, on any chain it lists. A payout reaches every chain the deposit card lists except Zcash and Aleo, which are refused by name, and only an address the app can decode and check by itself. Perps run on Hyperliquid.

This is alpha software that moves real money. It has had no third-party audit. It is not a wallet service, an exchange, a broker or an adviser, and nothing it or your agent says is financial advice. Read DISCLAIMER.md first.

Related MCP server: seashail

Install

Download the disk image. Apple silicon, macOS 13.5 or later. Drag Phosphor into Applications.

The app holds keys, so check the file first. The release page lists the SHA-256 of the disk image, and this must print the same one:

shasum -a 256 ~/Downloads/Phosphor-macOS-arm64.dmg

To check it was built by this repository's release workflow from the tag of its version, at the commit it prints (0.10.2 and later; use the tag of the version you downloaded):

gh attestation verify ~/Downloads/Phosphor-macOS-arm64.dmg --repo karimbabasf/phosphor \
  --signer-workflow karimbabasf/phosphor/.github/workflows/release.yml \
  --source-ref refs/tags/v0.10.14

The app and the disk image are signed with an Apple Developer ID and notarised by Apple, so macOS opens Phosphor on first launch with no warning.

Two more checks run on their own. Before the app starts its backend, it hashes its own files, and if any changed since the release was built it starts nothing and asks you to install a fresh copy. An update installs only when Apple's Security framework finds Phosphor's Developer ID, identifier and team on it; one that fails is refused and the app stays as it was. To check the files in your copy against this repository's source yourself, follow Check a release yourself.

Invite codes

Someone may send you an invite code, PHOS- and 27 letters and digits, usually as a link to phosphor.money/invite. It holds USDC for a new wallet. Paste it on the first run's Have an invite code? step, or later under the same question in Add money, and the money moves into your wallet once the wallet exists. If your Mac's clock runs more than two minutes behind, nothing moves and the app says so: set date and time to automatic, then add the code again. Never paste a code into the chat: the app holds back a code it recognizes there, but one changed by hand can slip through to your agent. How a claim works: docs/money.md. To hand codes out yourself, see Issuing invite codes: any USDC you send the treasury inside NEAR Intents works, because npm run invite -- convert turns it into NEAR USDC.

Connect an agent

The first run asks which agent you use and registers Phosphor with it. To do it by hand later, Phosphor > Copy MCP Config in the menu bar puts the one line on your clipboard with your real paths filled in. Run it in the directory you want the agent to work from. An agent you start yourself like this asks once in the window, "Allow this agent?", and until you allow it every move it proposes waits for your click. Any agent that reads a web page or a stranger's words through Phosphor (a token name, a memo, a venue's error text Phosphor does not know) waits for your click on every move after that, until its session ends.

Then ask it things.

What do I hold?

Swap 20 USDC into WETH.

Short SOL at 10x if it loses that trend line, and cap me at $200.

Details, and what the agent can never do, are in docs/connect-an-agent.md.

Run from source

Needs Node 24 or later and a Rust toolchain.

npm install
npm run tauri dev

That opens the window. npm run app runs the backend alone on http://127.0.0.1:4177, and npm run app:build writes the app and the disk image under src-tauri/target/release/bundle/. To point Claude Code at the checkout instead of the installed app:

claude mcp add phosphor -- node "$PWD/src/mcp.ts"

Test

npm test         # unit, injection and lockdown suites
npm run typecheck
npm run eval     # scores the agent against the behaviour rubric
npm run sweep    # the secret sweep CI runs over the tree and the history a push publishes
npm run attack   # plays a hostile program on this Mac against the app npm run app:build made

Docs

Read them at phosphor.money/docs, or in docs/.

• Getting started: download, wallet, backup, the lock and the brake.

• Security model: the threat model, the trust boundary, the fail-closed rules, the limits.

• Known limits: what this build does not cover.

• Architecture and Reference: for people changing it.

• SECURITY.md: reporting a vulnerability privately.

• CONTRIBUTING.md: the bar for a change.

License

Functional Source License 1.1 with an MIT future license (FSL-1.1-MIT). Read it, run it, change it, audit it. You may not offer Phosphor, or a product that does what Phosphor does, to other people as a commercial product or service. Each version turns MIT two years after its release. The fonts and token logos carry their own notices in ui/fonts/OFL.txt and ui/logos/ATTRIBUTION.md.