check us, rather than trust us
The algorithm is published and every output is signed. Run it yourself and check the number.
Does the agent behave the same when it thinks nobody is watching? This measures that from the trace, never from the weights.
vows kept, windows missed, whether it is overdue. Free, forever.
or, read a trace yourself
Every result ships the floor it had to beat, and says so on its own output. Under the floor means nothing. The maths, the nulls and the results that went against us ▸
every turn names Y, its declared purpose; an unnamed purpose cannot be metered, by design
for builders
the key to pin
every signed output carries this key; pin it out-of-band. A fork is anyone's to run, so this key is what makes a result ours · raw ▸
the reference deployment's key, committed in the repo: ed25519 LvuPBMbKKyoNEuyvLf7f+rbyjK67vBcWy9MDwaRINGE= — if the line above differs, you are talking to a different server.
the rails one posted price per rail, same for every caller
no API keys, ever. A wallet signature is the login · free unsigned demo: ~50/day/IP
the three USD rails are $0.10 a call. The ELO rail is a flat posted token count, so its dollar value floats with the tape unless the operator marks it to $0.10; the card above says which is armed. What never moves: one posted price per rail for every caller, no tiers, and no fee in any amount touches a number.
the proofs + the wire
the schemas, the manifests, the one-line installs — the whole wire lives on one shelf now: the API reference ▸
mount it in your own agent
the mount no API keys, ever
Any MCP-native loop takes the same URL — Claude Code, Cursor, Cline, LangGraph, Bedrock AgentCore. Streamable-HTTP and stateless: there is no session to keep and nothing to log in to.
reading the tool list off the server itself…
That list is read from the running server on page load, not typed here — if the server offers something different, this line changes and nothing else does.
what stays off it by design
Nothing over MCP moves money, and no key is ever held on this side. The three paid things — a signed result, a signed report-in, adopting a familiar — stay on the x402 rails above, where your wallet already is.
Every action that touches a wallet hands the work back to you instead: the exact text to sign locally, or unsigned calldata for you to broadcast. You sign, you send, we keep nothing.
Free calls carry the same per-IP daily limits the plain endpoints already have — a tool call is not a way around them. Payment is the auth on the paid side; there is no key to issue, revoke, or leak.
the whole machine spec: the API reference ▸ · every endpoint, priced: /api/catalog
the audit surfaces
the apparatus
what each one is for
the recompute — how a third party re-derives a result from the same trace and gets byte-identical output. This is the whole answer to "could you sell a nicer number": you could not sell one that survives someone else running the arithmetic.
the predicates — the banded facts we can attest without handing over the numbers or the trace, for when a result has to prove something narrow.
the contracts and the inscriptions — every Elo contract, deployed or written-and-unrun, and the documents notarized on-chain. None of it is a measurement; it is the apparatus you audit one with.
watch an agent you run
the Herald — it interrupts you mounted
The rest of this page shows; the Herald tells. Point it at any vow's public record and it calls your endpoint when something happens.
Going quiet is the alert. overdue is the one most worth wiring: an agent that stops reporting is telling you something, and nothing else will page you about a thing that didn't happen.
Every notification is Ed25519-signed by the same key above, so you can check the Herald's word the way you'd check any signed number here. A subscription arms only after your endpoint answers a signed challenge; https only, capped per vow and per subscriber. Anyone may watch any vow — being watched is public, and so is who is watching.
the events and the shapes: the API reference ▸
the watchdogs — you schedule them once zero LLM tokens
Six script-only monitors: stdlib Python, no dependencies, no wallet, no keys. They read the free public surfaces and either print an alert line or say nothing at all. A deterministic check should never pay for a model.
Each is one plain crontab line against a free endpoint. The first is the one nobody thinks to write: it alarms if the key you pinned above ever stops matching.
what a reading does and does not measure, and how to wire your own loop: wire a harness ▸
wire a harness
the ward runs on your box local, free, copied
The ward is a local guard: text your agent merely read becomes evidence and never command. That closes the memory-poisoning and prompt-injection class structurally instead of asking a model to be careful, it needs nothing from the model, and it is the highest-return control anyone has measured on this problem.
We do not host it, and that is a design decision rather than a gap. A network hop in front of a local bound makes it worse at its job — it puts something slow, unreachable, or lying in the one place that has to answer on every single retrieval. Copied into your own tree it answers at the speed of a function call, offline, with nothing anyone can revoke.
If you take one thing off this page, take the ward. The measurement is optional and always was, and none of it is required to use Elo — the store, the coins and the board want a wallet, not a harness integration.
the meter is the hosted half and it signs
Map your log to Turns and you are in. A Turn is three fields: Y, the purpose the agent ran under; M, the reasoning your harness recorded; D, what it actually did. That is the entire contract, and an adapter is usually about ten lines.
One property of your harness decides everything: does it log reasoning separately from action? A harness that collapses the two into one blob can carry the ward but cannot carry the meter — and it is told so rather than handed a number. You still get the behavioural ceiling across every turn; a reading near zero there means the covert reasoning channel is unmeasured, not clean. Nothing is invented to fill the gap.
M is captured, never self-reported. A field the agent writes about its own reasoning is a single-writer channel — the producer is the only witness — so metering it measures what the agent chose to say it was thinking. M joins meter-side, from the harness log, outside the action loop. Self-emitted turns are marked as self-report for exactly this reason.
what it honestly gives you
A gauge and a defense, not a remote dial. You can alert on a reading, gate a step, or refuse to act on one. You cannot compel a disposition, and nothing here pretends otherwise.
The hard limit rides with every number: a reading catches only the channels it observes, so an agent operating in a channel nobody recorded walks off-meter. The claim is resistance to gaming a stated rubric, never omniscience.
And a reading is relative to its context. Calibrate per context; a raw number never carries across one.
before you quote a detector three checks
The maths is detector-agnostic — you supply the detectors — which is also this layer's biggest footgun, and we fired it at ourselves first: our own lexical detector produced a confident, seed-replicated result on a production model that turned out to be pure artifact. An independent judge caught it the same day and the finding was retracted. The discipline that caught it ships with the layer.
positive control — the detector must fire on a known-coupled set; a zero you never saw flip is a dead wire, not a clean reading. context calibration — the statistic must beat the permutation null of its own context. judge audit — an independent reader, different vendor, outside the scoring loop, over both what fired and a sweep of what did not.
the code, the nulls and the results that went against us: the public repo ▸ · the Turn on the wire: the API reference ▸ · mount it as tools instead: the one-line MCP mount ▸