Why we built this
Scam messages used to be pretty easy to recognize. Bad grammar, weird links, some random prince asking for money. That isn't really true anymore.
AI agents can have pretty convincing conversations, copy the way a company talks, use names we recognize, and run constantly without getting tired. That makes scams a lot harder to spot, especially for people who aren't actively looking for one.
We started thinking about what happens when AI agents aren't just answering messages, but actually start doing things for us.
Right now, there's usually still a person who has to click "send." But eventually, agents are going to be paying bills and buying things automatically. If an agent decides to pay the wrong person, there might not be a human around to catch it first.
That led us to a pretty simple question: how does an agent know that the person it's about to pay is actually the right person?
The problem is that when an agent looks someone up, it can basically get back a name and some information. But a name isn't proof of anything. Someone can pretend to be a company, use a stolen identity, or change an invoice after it was approved.
And if one agent sends money to another agent, there's no hacker necessarily breaking into anything. The payment was approved. It just went to the wrong person.
GoDaddy's challenge had a line that stuck with us:
"Never let discovery alone authorize an action."
That pretty much became the idea behind AgentVouch. Finding someone and trusting them shouldn't be the same step.
What AgentVouch does
AgentVouch is basically a payment agent with a healthy amount of paranoia.
Before it sends any money, it checks six things:
Are you actually who you say you are? We check the agent's identity against GoDaddy's public registry instead of just trusting what it tells us.
Are you still active? Registrations can be revoked, so we check the status every time instead of assuming an old verification is still valid.
Are we even allowed to pay you? We keep an approved payee list and spending limits. If someone isn't approved or asks for too much, the payment stops.
Can you prove it right now? We send a one-time challenge that the agent has to sign with its private key. Having a copy of someone's ID isn't enough — you need the actual key.
Did the invoice change? The price, buyer, and expiration date are all signed. If someone changes even one digit, the signature no longer matches.
Is the bank account the same one that's publicly listed? Even if the invoice and company are real, we don't want a payment going to an account that someone quietly swapped in.
We also wanted the demo to show that this actually works rather than just telling people that it does.
Every time the dashboard loads, it runs ten scenarios. One is a legitimate payment and nine are attacks that should get blocked.
We test things like someone pretending to be the supplier, a stolen ID, a replayed request, an edited invoice, a reused invoice, an invoice meant for another buyer, an amount over the spending limit, an unapproved company, and an invoice where the bank account was changed.
There's also a tamper test that's probably the easiest way to understand the whole project. You can get a real signed quote, change one digit in the amount, and hit "Verify." AgentVouch catches the change and rejects it.
You can also enter an agent's name and have AgentVouch check it, and there's an AI assistant on the dashboard that explains what happened.
One thing we were very deliberate about: the AI assistant cannot approve payments. It doesn't have access to anything that can actually move money.
How we built it
The backend is written in Go and runs on a Vultr server.
We registered three agents through GoDaddy's production registry — a buyer, a supplier, and AgentVouch itself. Each one has its own identity and private key.
GoDaddy ANS handles the identity side. A DNS lookup points to a public record containing the agent's certificate, name, and status. If we can't verify that information, we don't pay. We'd rather block a legitimate payment than let a fake one through.
Capital One's Nessie API handles the simulated money movement. We split payments into two steps using the same invoice ID, and if the second step fails, the first one gets refunded automatically.
MongoDB Atlas stores our audit log, including every decision we make and the history of what we've seen from each agent's registry record.
We then periodically put a fingerprint of that log onto Solana. The important part isn't really the blockchain itself — it's that the network isn't controlled by us, so we can't quietly go back and rewrite our history.
Gemini powers the AI assistant on the dashboard. It answers questions using the evidence we have and, importantly, it refuses when someone tries to convince it to approve a payment.
Everything communicates using the standard agent protocols, so other agents can request quotes, talk to our agents, or ask AgentVouch to verify someone.
We were also pretty intentional about how we sign our public profile. We use the same key that's recorded in GoDaddy's registry, so someone checking our signature can actually trace it back to the official record rather than just trusting a key we posted ourselves.
Things that went wrong
We definitely didn't build this perfectly on the first try.
We deleted our own keys
About an hour after registering our agents, we ran the setup again from a second laptop and accidentally overwrote the keys.
Suddenly our live identity didn't match what we had.
We had to re-issue the keys, which meant the change was permanently recorded in the public log. After that, we locked the keys so it couldn't happen again.
Honestly, it was a pretty good demonstration of why we built the audit trail in the first place. Our own system caught our own mistake.
Browsers and agents don't trust the same certificates
The certificate GoDaddy gives the agents isn't one that Chrome recognizes, so using it directly would give judges a pretty intimidating security warning.
We ended up keeping the browser-friendly certificate instead. That does mean GoDaddy's trust score takes 10 points off, though, so we decided to show the penalty rather than hide it.
The bank API didn't behave like the documentation
The API's transfer behavior didn't quite match what we expected. Transfers didn't have a recipient field and balances weren't updating properly.
It took us a while to figure out what was actually happening.
Instead of trying to make the dashboard show a balance that wasn't reliable, we moved the money in two steps and showed the actual transaction IDs.
We almost blamed GoDaddy for our own bug
At one point, our checker said three of GoDaddy's agents had invalid signatures.
We initially thought something was wrong with their agents.
It wasn't.
They were using a signing method that we hadn't implemented yet.
If we'd shipped our original checker, we could have ended up telling a GoDaddy engineer that their production system was broken when the problem was completely on our side.
We fixed it by supporting all three signing methods. Now, when we can't verify something, we show exactly which methods we checked instead of making "couldn't verify" sound like "this agent is broken."
Our own supplier was doing something weird
During one of our audits, we found that our supplier agent was advertising a service it couldn't actually provide while also exposing some of the buyer's tools.
Not exactly ideal for a project about verification.
We separated the agents properly and fixed the setup.
What we're proud of
One of the biggest things we're proud of is that zero dollars have reached the attacker account.
Across our testing, 103 payments and $5.15 million have gone through the bank API, while one of our scenarios repeatedly tries to redirect a legitimate invoice to the attacker's account.
None of it got through.
Another thing we learned from the GoDaddy demo fleet is that being verified doesn't mean someone is trustworthy.
All ten demo agents pass identity verification, including the two that are specifically there to attack people. Those two actually have higher GoDaddy trust scores — 51 compared with 48 for the honest supplier and auditor.
That was a pretty interesting result for us.
A verified ID can tell you who someone is. It doesn't tell you what they're going to do with your money.
We also caught one of the agents changing its ID during the hackathon. Our historical record noticed the certificate change, and the public record confirms that it happened.
GoDaddy's registry can tell you what's true right now.
Our system is trying to remember what was true yesterday.
We currently have 1,220 entries in our log, all still verifying, with 70 fingerprints backed up to Solana.
And the important part is that someone else can check all of this themselves. They don't have to just take our word for it.
What we learned
The biggest thing we took away from this project is that knowing who someone is and knowing whether you should pay them are two completely different questions.
A verified identity answers the first one. It doesn't really answer the second.
That's why the approved payee list is ultimately what controls the payment, rather than the identity check by itself.
We also learned that sometimes giving too much information is a security problem.
If you tell a potential attacker exactly why their payment was rejected, you're basically giving them a checklist of things to fix. So the other side gets a simple rejection, while the detailed reasoning stays in our logs.
We also found that one safeguard isn't enough.
The audit log, cloud backup, and blockchain fingerprint each protect against different things. If we could change all three ourselves, none of them would mean very much.
And probably the biggest lesson was how invisible all of this is to a normal person.
Someone shouldn't have to understand certificates, private keys, DNS, or cryptographic signatures just to safely pay a hospital, landlord, or school.
Where we'd like to take AgentVouch
One thing we'd like to do is help other agents catch configuration problems in their own setups.
If we notice that another agent has something publicly misconfigured, we'd like to be able to let them know, while being careful not to expose information that could actually help an attacker.
We'd also like to add stronger DNS protections so that our identity verification can move from "observed" to fully verified.
But the bigger goal is much simpler.
None of this should require a normal person to understand certificates.
Ideally, all of these checks happen behind one button that someone can press before sending money to a hospital, landlord, school, or anyone else.
And as AI agents start making these payments for us, the agent should be doing the same checks automatically.
If an agent is going to handle money for someone who doesn't have time to double-check every payment, there needs to be another agent whose job is to say no when something doesn't look right.
Try it yourself
Built with
Go · GoDaddy ANS · A2A · MCP · DNS-AID · Capital One Nessie · MongoDB Atlas · Solana · Gemini · Vultr · Caddy · Let's Encrypt
Log in or sign up for Devpost to join the conversation.