From open to exclusive.
Express any access policy onchain.§
A weather API has nothing to protect. More callers means more revenue, and x402 collects on every request. Other tools are different: a proprietary trading signal loses its edge the moment a thousand agents are calling it. Cap it at 5 seats, mint them as NFTs, and access becomes a tradeable asset that finds the right buyers on the open market. ERC-8257 expresses the full spectrum (open, subscription, allowlist, capped) with predicates anyone can write.
Trust and payment
got separated.§
Tool calling for agents has three layers: discovery, access, and payment. MCP solves discovery and invocation but has no native trust or payment layer. x402 solves payment but says nothing about who is allowed to call. Ad-hoc API keys solve neither discoverably and tie identity to a single operator. ERC-8257 is the missing piece: a permissionless directory with onchain identity and pluggable access control. Use it next to MCP and x402, not in place of them.
From publisher to agent,
verifiably.§
Publishers commit a manifest hash onchain and serve the manifest at a well-known path. The registry enforces origin binding. Agents discover, verify, and, if the predicate allows, invoke.
ToolConfig: creator, metadataURI, manifestHash, accessPredicate.Three tiers.
One manifest field.§
Tools declare a verifiability tier in their manifest. Each tier is a different trust model, from operator self-attestation up to fully reproducible end-to-end verifiable execution.
Why three? Progressive verifiability. Most operators ship at self-attested on day one and can graduate to TEE or reproducible builds without changing the registry, the manifest schema, or their consumers’ verification code.
Operator's word.
The operator declares data retention and source visibility policies, committed onchain by manifest hash. Cannot be silently changed, but enforcement is reputational.
- dataRetention
- sourceVisibility
- hash-committed
TEE attestation.
The tool runs in a hardware enclave (SGX, Nitro, SEV-SNP). Agents fetch a fresh attestation report and verify the cryptographic chain of trust. Transparency logs prevent split-view attacks.
- TEE attestation
- maxAge freshness
- transparency logs
No trust required.
Source code is published with reproducible build instructions. Anyone can rebuild the enclave binary, compare the measurement against the attestation report, and verify end to end.
- reproducible build
- source -> binary -> enclave
- full chain verification
It’s a draft. Best time to push back.§
The spec is unfinished on purpose. The questions where outside input changes the outcome the most right now:
- 01Predicate ideas we haven’t drafted yet (reputation, attestation, oracle).
- 02Manifest schema gaps: fields you’d need that aren’t there.
- 03Failure modes we should spec around (predicate rugs, manifest drift, indexer lag).