§Backstop

The Turing Test,
inverted.

Everyone built an agent that acts. We built the thing that keeps them from getting rekt.

The old question was whether a machine could pass for human. The one that matters for autonomous money is sharper: can you trust what this agent is about to do?

Backstop is the AI that judges another AI — co-signing every transaction your agent makes, simulating it on live Mantle first, and vetoing the ones that would drain its wallet. Every verdict in the console is a real on-chain event.

0 co-signed0 vetoedConnecting to keeper…
§

Co-signer of record

ERC-8004 agentId 182

A veto-only on-chain co-signer. It simulates first, then signs the safe and blocks the rest — entered into the record.

A guardian agent that reads a transaction the way a notary reads a filing — and refuses to sign the forgeries.

Autonomous agents already move real money. The dangerous failure isn’t a crash — it’s an agent confidently approving a drainer because injected instructions told it to. Backstop sits between the agent and the chain, gives the verdict the weight of a sealed ruling, and makes every decision auditable on-chain.

Three steps, every transaction

STEP 01

Your agent proposes a transaction

Every call the agent's wallet is about to make is intercepted by the co-signer before a single wei can leave — wrapped in three lines via backstop.wrap().

STEP 02

Backstop simulates it on live Mantle

An eth_call with a code-override — zero deployment — traces the real balance and allowance deltas against live chain state, and weighs the agent's stated intent against the actual calldata.

STEP 03

It co-signs the safe ones, vetoes the drainers

Deterministic rules catch known-drainer approvals in under a second. Gray-zone calls escalate to an LLM that writes the opinion. Every veto lands a real on-chain Blocked event.

Two lines, and your agent is guarded.

Point your agent’s key at the hosted guardian and route its calls through propose(). No contracts to write, no infra to run — the keeper is account-agnostic, so it guards a brand-new agent the moment you wrap it.

Trust model

The hosted guardian is a testnet reference — convenient for a demo, trusted for liveness. For production, self-host the keeper with your own GUARDIAN_KEY (npm run keeper) and pass your own { guardian, keeperUrl }. Either way the guardian is veto-only — it can never move your funds.

agent.ts
// SDK ships in this repo at sdk/ (not yet published to npm)
import { wrap } from "@backstop/sdk";
 
// Wrap your agent's key once. Deploys a guarded account + ERC-8004 identity.
const agent = await wrap(AGENT_KEY, {
keeperUrl: "https://backstop-keeper.onrender.com", // hosted guardian
});
 
// Route every action through propose(). Backstop simulates it on live
// Mantle, co-signs the safe ones, and vetoes drainers with an on-chain event.
const { decision, txHash } = await agent.propose(to, value, data, {
statedGoal: "swap 2 WMNT for USDC on Agni",
expectedTargets: [AGNI_ROUTER],
});

Verify every verdict yourself

Both sides hold an ERC-8004 identity on-chain — the guardian and the agent it guards. Every veto lands a real Blocked event on Mantle Sepolia, reason and all. Click any verdict through to the explorer and read it for yourself.

0 co-signed0 vetoedConnecting to keeper…