Arbiter MCP server

Arbiter

The judgment layer for autonomous agents.

An AI agent about to act on the world often needs a judgment it cannot make by itself: is this transaction safe to sign, is this counterparty real, is this photo actually what it claims to be. Arbiter sells those judgments one call at a time, paid over x402 in USDC on Algorand.

Three routes, one response contract:

Every route returns the same verdict envelope, so an agent integrates one shape and can then ask for any kind of judgment without new branching logic:

{
  "decision": "block",        // allow | warn | block | escalate
  "risk": 100,                // 0-100
  "confidence": 1,            // 0-1; low confidence forces "escalate"
  "findings": [ /* itemised, each with severity, detail and source */ ],
  "evidence": { /* the decoded transaction, the counterparty record */ },
  "meta": { "degraded": false, "latencyMs": 378 }
}

New here, or explaining this to someone non-technical?

What Arbiter actually does — no code, no jargon.

Live

https://arbiter-hs23.onrender.com — API, and the reviewer app at /work.

Preflight: 18 passed, 0 blocking failures. Running on Render's free plan, which has no persistent disk and spins down after 15 minutes idle — see DEPLOY.md for what that costs and the upgrade needed before the October leaderboard window.

Status

The transaction firewall

Autonomous agents lose funds in a small number of specific ways. The firewall decodes the actual transaction bytes and reports what signing would really do:

• Rekey — rekeyTo permanently transfers signing authority over the account
• Close-remainder — sweeps the entire ALGO balance regardless of the stated amount
• Asset close-out — sweeps the entire ASA holding regardless of the stated amount
• Clawback — moves assets out of a third party's account
• Fee drain — the balance leaves via an oversized fee rather than a visible transfer
• App delete / update — destroys or silently replaces contract logic
• Asset-level risk: creator-held clawback and freeze authority, non-existent assets
• Account-level risk: signer already rekeyed, unfunded recipient, expired validity window

Run it against real, freshly-encoded transactions:

npm run demo:attacks

Shortened. The full README is on GitHub.