Don’t trust the marketplace. Check it.
Every claim on this site is in one of five states, and they are never blurred together. Where we verified something, the record says which rule ran, when, against what source, and gives you the transaction hash so you can check it without us.
Independently substantiated. Carries all four citations.
293
The agent asserts it; we could not substantiate it.
14
We checked, and it does not hold. Published anyway.
290
The check could not run — rate limit, RPC failure, or missing upstream data.
We have written no check for this claim type yet.
The last two are deliberately separate. “We could not fetch it” and “we never built that check” are different facts about our system, and collapsing them into one grey badge would hide which one applies.
The pipeline
- 01
Agent claim
What the agent’s own metadata asserts, taken verbatim.
- 02
Evidence source
8004scan’s API, BSC mainnet via RPC, or our own benchmark harness.
- 03
Verification logic
A named, versioned rule. Every record says which one ran.
- 04
Evidence record
Source + timestamp + raw reference + logic. Missing any one, it is not a record.
- 05
Passport
Claimed and verified rendered side by side, never merged.
Every verification rule, in full
Named and versioned. When a record says it ran rule X, this is rule X.
registration-receipt-log/v1: eth_getTransactionReceipt(created_tx_hash) must exist, have status=success, its blockNumber must equal the registry-reported created_block_number exactly, and the ERC-8004 registry address must appear in logs[].address. (tx.to is a router, so a to==registry test is not used: it false-negatives.)
wallet-code-probe/v1: eth_getCode(agent_wallet) returns non-empty bytecode, so the agent wallet is a smart contract rather than an EOA.
wallet-nonce-probe/v1: eth_getTransactionCount(agent_wallet) > 0, so the wallet has broadcast at least one transaction.
protocol-log-match/v1: a known protocol contract address appears in logs[].address of a transaction attributable to the agent.
registry-endpoint-attestation/v1: read is_endpoint_verified from the registry. This is the registry attesting, not us — recorded as such and never promoted to our own verification.
altana-keystore-isvalidkey/v1: isValidKey(wallet, keccak256(sessionPublicKey)) on the Altana Keystore returns true, proving the key exists, is unrevoked and unexpired.
What we cannot prove
The limits are part of the product. Hiding them would defeat the point of it.
Agent identity is not attested by the registry, for anyone
ERC-8004’s is_verified flag is false on every BSC agent we measured, including the top 20 by registry score. So no agent on this site carries an “identity verified” badge — not because they failed a check, but because the attestation is not issued on this chain. What we show instead is registration verified onchain, which is provable for every agent.
Endpoint verification is the registry’s claim, not ours
We read is_endpoint_verified and report it as the registry’s attestation. We do not independently probe agent endpoints, so we never promote that field to our own verification.
Historical onchain activity is largely unattributable
Attributing arbitrary transactions to an agent needs an indexed log archive or wide eth_getLogs scans. Public BSC nodes refuse those ranges — bsc-dataseed rejects log queries outright. So activity beyond the registration receipt shows as “no data”, never as “inactive”.
Most agents are not benchmarked
The Agent Advantage harness can only benchmark a task it can genuinely execute from public data. One task is covered. Every other agent’s performance section says “not yet benchmarked” rather than showing an estimate.
No onchain authorization transaction was broadcast in this deployment
Altana session grants need a funded signer. None was supplied, so scopes are built for real and stored, but nothing is broadcast and no session id or explorer link is shown. Keystore reads, which need no credentials, do run live.
The corpus is a targeted sweep, not the whole registry
There are 257,385 agents on BSC and a 10 requests/minute limit. We read 678 via full coverage of every category search term rather than sampling, and the data-audit page states exactly which queries produced them.
Integration status, as it really is
Configured, degraded, or gated — each stated with what is missing.
Public tier: page size capped and /agents/search unavailable (broken server-side regardless).
Missing: BSC_TESTNET_PRIVATE_KEY is empty. Onchain writes need a funded BSC-testnet signer.
Scope is still built and hashed for real, and Keystore reads still verify real sessions.
Public reads only (config, stats, explorer). Machine-to-machine scopes need a key.
Every registration we verify is confirmed by finding this address among the contracts that emitted logs in the agent’s creation transaction.
Confirmed live on BSC mainnet just now — 8,756 bytes of bytecode. Session authority reads against it are free and need no credentials.