Chancela

Live on Monad Testnet + mainnet · ERC-8004

Give AI agents an identity.
And a limit.

For anyone who lets an AI agent trade or move treasury funds on Monad. The agent's limits live in a policy the model cannot argue with, every decision is proved on-chain, and the venue itself reverts any order the policy did not sign.

Run the live demo See Monad revert a $25k orderNo login, no wallet — two minutes, against the real system.

Same agent, same venue, on Monad testnet

Allowed · executed

$200 order, filled

Inside the policy. The attestor signed a grant for exactly this call, and the venue accepted it.

Transaction on Monad

Refused · reverted

$25,000 order, reverted

The policy said no. The agent sent it anyway with a grant it forged, and the gate reverted it on-chain.

Refused(BAD_SIGNATURE)

Unedited transcript

Claude Code tried it

Told a forwarded email had approved an exception, Claude placed the $25,000 order. The exchange tool asked Chancela first. Not filled.

Read the transcript

Also on Monad mainnet, with real MON

The agent is ERC-8004 #10277 in the official registry and its funds sit in a ChancelaAccount, which makes a call only with a grant for exactly that call. It trades on Uniswap V3, a protocol that has never heard of Chancela. The amounts are a cent; the chain and the DEX are real.

Who it is for

Teams running trading or treasury agents that want a hard per-order and per-day limit a prompt injection cannot move.
Venues and protocols that want to accept orders from agents without trusting the agent: one modifier, and a refused order reverts.
Platforms hosting agents for other people, who need to show each owner what their agent was allowed to do, and what it tried.

Why Monad

One transaction per decision, refusals included. Measured on testnet: 92,478 gas, about 0.009 MON each. Elsewhere this gets batched into daily roots, and the per-action proof is gone.
Sub-second blocks, so the proof lands while the agent is still waiting for its answer, not in tomorrow's batch.
P-256 verified in the EVM: an owner's passkey approval is checked by the chain itself, not by us.

7
Agents registered: 500
Decisions recorded: 500
Actions refused: 0
Anchored on-chain

Every one of them is public — open the live ledger

prompt injection, attempted

The model read the injection. The policy engine never did.

AI Agent

proposes

Intent

structured + validated

Policy

deterministic

Allow / Deny

with a reason

Monad proof

immutable

The LLM interprets. The policy engine authorizes. Monad remembers.

The model never decides

An LLM proposes an action. A deterministic policy engine authorizes it. Swap the model and the decision is unchanged.

Deny by default

An action not explicitly granted is refused. Unknown actions are refused. A crash is refused. There is no permissive fallback.

Denials are proof too

Every decision is anchored on Monad, including the blocked ones. A registry that only proves the allows proves nothing.

A human decides, and the chain checks

Some actions need their owner. They approve with a passkey over the exact decision, and Monad verifies that signature itself, with its native P-256 precompile.

Verify, do not trust

The SDK and the MCP server check every permission against the attestor the owner registered on-chain. This service can refuse to answer. It cannot forge a yes.

One passkey, many keys

An owner holds one passkey. It derives a separate key for every agent — no seed phrase, nothing stored — and each key is registered on-chain.

Do not take our word for it

One command, from an empty folder. It checks a live decision against the attestor the owner registered on Monad, runs the policy engine again on your machine, then forges a grant and sends the order anyway: Monad reverts it three ways. The on-chain part works with this site switched off.

chancela-check on npm

$ npx chancela-check
✓ forged grant, $200 order sent anyway
  Monad: Refused(BAD_SIGNATURE)

$ npx chancela-check replay <id>
✓ same inputs, same verdict as on Monad

Put it in front of your agent

No account and no API key. Pick the one that matches how your agent is built.

Any language — one HTTP call

curl -X POST \
  https://chancela.xyz/api/agents/TA-001/authorize \
  -H 'content-type: application/json' \
  -d '{"action":"CREATE_CUSTOMER",
       "parameters":{"name":"Maria"}}'

TypeScript — runs your code only if it verifies

npm install chancela-sdk viem

await chancela.guard(agentId, action,
  params, () => wallet.send(...))

Claude, Cursor, any MCP client — no code

{ "mcpServers": { "chancela": {
    "command": "npx",
    "args": ["-y", "chancela-mcp"] } } }

See it refuse something

Ask the agent to move money. Watch the policy engine say no, on-chain.

Run the demo

Give AI agents an identity.And a limit.