Every transaction an agent proposes is measured before it is signed.
An agent signs whatever it decides to, and one unlimited approval empties the wallet. SafeHands reads the intent and the exact bytes first, then answers: allow, warn, or block, with named reasons.
- Reads the intent, then the exact calldata
- Holds no key, signs nothing
- One score on a published scale, reasons named
Measured, not marketed.
Every figure here is verifiable in the source.
Real-world value carries obligations a memecoin never did.
Pharos settles tokenized assets and real-world payments. A tokenized T-bill or invoice is not a memecoin, and an agent can repeat one mistake a thousand times. SafeHands is the pre-signature check for the obligations those assets carry, live on mainnet today.
SafeHands is not an issuer, a KYC provider, or a transfer agent, and it does not make a flow compliant on its own. It is one deterministic layer: the pre-signature checkpoint and audit trail those flows sit on.
The signatures an agent should never send.
Six real checks, each read from the intent and then the exact bytes. The verdict is the one the inspector above would return, on the same scale.
approve(spender, UNLIMITED)
An unbounded grant hands a spender the whole balance, indefinitely.
transfer → 0xa1…f30c no history
A brand-new recipient could be a typo, or an address-poisoning lookalike.
spender 0x4d…c1b2 not in registry
An unverified counterparty never clears on its own. Recognition needs proof.
price feed STALE
A stale or missing Chainlink feed is reported, never quoted.
codehash ≠ recorded
A verified address whose live bytecode changed under you. Caught by code hash.
RWA leg wallet not eligible
A permissioned transfer that would revert. Caught before you sign, not after.
Four steps, and only one is ours.
The agent plans
Your model builds the transaction and holds the intent, never a key.
The engine reads
SafeHands checks the intent, then the exact calldata, against on-chain evidence.
A verdict, not a vibe
One score on a published scale, reasons named. Same bytes in, same verdict out.
Your wallet acts
Only what cleared reaches a signature. SafeHands never touches a key.
A firewall that cannot move funds is one nobody has to trust with funds. That is the whole design.
Five properties, each one checkable.
Deterministic
Computed by code, traceable to a named check. Same bytes in, same answer out.
Registry-backed trust
Recognition comes only from first-party on-chain evidence. Being listed somewhere is not trust.
Fail-closed
Missing evidence reads as unknown and raises the verdict. Aggregation can only escalate.
Zero-custody
No keys, no signing on the hosted surface. Write paths are off by default, for self-hosting only.
Live on mainnet
Running on Pharos Pacific, chain 1672, with live Chainlink prices and on-chain risk records.
And what it never does.
Never holds a key, and never signs or broadcasts on the hosted surface.
Never quotes a price it did not read live. A stale feed is reported, not guessed.
Never grants trust from anywhere but the registry's first-party evidence.
Never downgrades a block. Severity only ever goes up.
A verdict binds to the exact bytes it inspected. Act on different bytes, or after it expires, and it no longer applies.
One engine, three ways in.
Self-host the engine
Import the SDK, run the MCP server, or call the CLI. The read-only checks cost nothing.
Wire it up→Ask the hosted agent
The safehands agent on Anvita Flow needs no install. Ask in plain words, get the same verdict.
Get recognized
Put your contracts in the registry with first-party evidence, so agents recognize them by code hash.
See the registry→One command before you sign.
Install SafeHands as an agent skill, then ask it to run a preflight before any signature. It runs as a standard MCP server, so it drops into any MCP client.
Put a firewall in front of your agent.
Self-host it free, or ask the hosted agent on Anvita Flow. Same question, same verdict, either way.