VAIP

Building trust infrastructure for AI agents through verifiable, on-chain reputation

Comment

Inspiration

"Some of your best ideas come in the shower," and that's exactly where this one came from. Having spent all of last summer working on Agentic systems for Electronic Health Records, I have had Agentic AI safety on my mind for a bit. How do we ensure that malicious agents don't exploit agentic systems with access to our sensitive data? Agent-to-agent (A2A) protocols make interoperability easier, but they mostly tell you what an agent claims it can do, not whether you should believe or trust it. After watching 3Blue1Brown's video on Bitcoin, I was inspired by the possibilities that blockchain technology could have on agentic systems.

This led us to a rough sketch that became VAIP (Verifiable Agent Identity Protocol). VAIP dictates that agents should accumulate trust through verifiable interactions, for example, successfully completing tasks, following agreed rules, and receiving attestations that anyone can audit on-chain. Trust should be earned and updated over time, not treated like a static badge, so agents from different ecosystems can evaluate each other using transparent evidence of past behavior.

We liked this direction because it pushes agent-to-agent interoperability without making a central authority the source of truth, and it raises the bar for identity spoofing and reputation inflation: claims have to reconcile with a shared, inspectable history, not just marketing copy on an Agent Card.

What it does

VAIP (Verifiable Agent Identity Protocol) adds a decentralized trust layer for AI agents using blockchain attestations. When work needs to be delegated, a client can query trust from our middleware, which reads verifiable attestation history from EAS on Base Sepolia (Ethereum L2). The system:

  • Ranks agents from accumulated, successful task outcomes—not a single lucky run
  • Filters unreliable agents using a 0.50 minimum trust threshold before delegation
  • Records evaluations on-chain with quality (1–10), success, and protocol fields that feed a 0–1 trust score on each refresh
  • Surfaces history in a live dashboard: network view, per-agent detail, attestation feed, and optional demo attestations for judges

Users (and client agents) can compare agents on real history instead of manually testing every candidate from scratch.

How we built it

  • On-chain: EAS on Base Sepolia (84532); attestations keyed by recipient = agent under review
  • Trust middleware: Node.js + TypeScript + Express, ethers v6, @ethereum-attestation-service/eas-sdk — GET /trust/:address, GET /agents, GET /attestations/:address, POST /attest
  • Scoring: Cold start + success-weighted logic (with attester-aware weighting when configured) in trust-middleware
  • Frontend: React 18 + Vite + Tailwind + Recharts — trust over time, multi-agent comparison, live feed
  • Agents: Python 3.11+ with A2A-style agent cards and addresses as agent identity hooks
  • Evaluation (demo path): OpenAI (gpt-4o-mini) for translation + quality scoring where enabled

Challenges we ran into

  • Testnet reality: RPC rate limits, nonce ordering, and flaky confirmations—so we added defensive retries, clear logging, and graceful degradation when the chain or indexer hiccups
  • End-to-end glue: wiring A2A discovery → trust API → delegation → post-task attestation across Python, Node, and a browser UI in a short window
  • Honest UX for “no history”: making cold start and below-threshold states obvious in the dashboard so the story reads instantly for judges

Accomplishments that we're proud of

  • A full loop you can explain in one sentence: discover → score → delegate → attest → re-score
  • On-chain attestations that are actually used to drive eligibility and comparison in the UI
  • A dashboard that supports both network-level and per-agent views, including multi-agent trust-over-time and a comparison table
  • Clean separation of concerns: agents stay agent-shaped; trust logic lives in middleware; chain stays the audit log

What we learned

  • Reputation wants a schema: small, strict attestation payloads beat vague “reviews” for composability
  • Trust is a product decision: picking a threshold (0.50) forces crisp behavior with users immediately understanding pass/fail
  • Hackathon demos reward observability: explorers, tx hashes, and a feed of events make abstract crypto feel real

What's next for VAIP

  • Resolver / anti-spam rules on-chain (e.g., who can attest, rate limits, or trust-gated attestation)
  • Capability-specific reputation (separate schemas or tags per skill domain)
  • Stronger identity (DID resolution paths, richer agent cards, multi-attester credibility)
  • Bitcoin narrative (stretch): anchor batched attestation roots (e.g. Merkle root) for long-horizon verifiability beyond a single L2

Built With

Share this project:

Updates