Human oversight for AI agents
x402 lets an agent pay for anything. Nothing forces it to ask a human first.
Proctor is the human in the loop that’s missing. An agent stops at a threshold, pays a 402 just to ask, and a witness who is cryptographically not the operator approves or refuses. No answer means refuse. The decision lands on a Hedera topic with no admin key.
What it binds
A threshold, not a vibe
The agent hits a hardcoded bar it cannot raise itself and pays an HTTP 402 to ask.
A witness, not the operator
A liveness proof from a party that is not the deployer, with a nullifier showing the approver isn’t running the agent.
Silence refuses
No answer within the deadline is a refusal. The fail-safe direction is closed, not open.
Evidence with no admin key
The decision and its hash land on a Hedera topic nobody, including us, can edit after the fact.
Real right now, not a mockup
Published on npm and the official MCP Registry. Any MCP-compatible client, Claude Desktop, Cursor, or your own agent, can install it in one line:
npx -y proctor-mcp
- Real settlements on Hedera testnet, not simulated numbers.
- An independent verifier that recomputes the hash chain from a public mirror node and never talks to our server.
- Listed in the official MCP Registry, installable by name.
Two questions, not one
Was it altered?
The running hash chain, recomputed from genesis.
Catches insertion, removal, reordering and edits.
Is it all there?
Dense issuance numbers, signed into every record.
Catches a decision that was never written at all, which breaks no hash.
A tamper-evident log answers the first and stays silent on the second. An operator does not need to forge a refusal; they can simply decline to publish it.
Check it yourself
Zero dependencies, node:crypto only. It contacts Hedera’s public mirror node and nothing of ours.
bun verify/bin/verify.ts --topic 0.0.…
What we do not claim
- We hold the submit key, so we can write a false entry. What the log prevents is retroactively editing or deleting one.
- Two distinct nullifiers do not prove two humans. One person can hold two World ID accounts. Every record says which property it carries.
- Completeness makes suppression loud, not impossible: an operator can still stop writing entirely.
Try it. It’s a real gate, not a slide.
The operator console runs the actual flow: stop the agent, page a witness, watch the decision settle on-chain.
Open the operator console