{
  "markdown": "# Automaton Colony\n\nAn independent verifier for [automatoncolony.xyz](https://automatoncolony.xyz), a contract\nscreening service running on Base.\n\nEvery report bought through the store has its SHA-256 written into a public escrow contract by\nthe transaction that delivers it. The script in this repository reads that hash straight from the\nchain and compares it with the file on your disk. It never contacts automatoncolony.xyz. A buyer\nwho has to ask the seller whether the report was edited has no answer worth having.\n\n## Verify a report\n\nNode 18 or newer. There are no dependencies and nothing to install.\n\n```bash\nnode verify-report.mjs <invoiceId> <path-to-report>\n```\n\nThe invoice id is the `0x` value shown in the purchase confirmation, 64 hexadecimal characters. The\npath is the report file exactly as it was downloaded, with no reformatting: a single added newline\nchanges the hash.\n\n```\nescrow            0x85b98F29C0d52c435a4514A6f4843c3b7B6bc06e (v9)\nstate             RELEASED\nbytes  on-chain   6367\nbytes  local      6367\nsha256 on-chain   0xe7914e36629ba27cec2906d0513bf2b9bc9507d91934ebcfe09b3782c6077edb\nsha256 local      0xe7914e36629ba27cec2906d0513bf2b9bc9507d91934ebcfe09b3782c6077edb\n\nMATCH. This file is byte-for-byte the one committed on-chain when the report was delivered.\n```\n\nThere are four possible endings. `MATCH` means the file has not been altered since it was\ndelivered. `MISMATCH` means the file differs from what the chain recorded, whether by an edit or\nby a truncated download. An invoice id that exists in neither escrow gets its own message, which\nis also what a mistyped id produces. And a purchase that exists with no content committed, which\nis the case after a refund and also while a delivery is still pending, ends with a line saying\nso, because there is nothing to compare the file against.\n\nExit codes are `0` for a match, `2` for a usage error, and `1` for everything else, so the script\ncan be used from another program.\n\nOne limit is worth knowing before relying on the check. The escrow records one delivery per\npurchase, so the reports generated afterwards with Sniper Pass credits are not anchored\nseparately: their fingerprint travels inside the report itself, and this script cannot check\nthem. Verifying a credit report against the pass's invoice id produces a MISMATCH that means\nnothing.\n\nQueries go to `https://mainnet.base.org` by default. That endpoint is shared and rate limited; set\n`BASE_RPC_URL` to use your own.\n\n```bash\nBASE_RPC_URL=https://your-endpoint node verify-report.mjs 0x… report.json\n```\n\n### What the check still assumes\n\nThe script makes one kind of network call, an `eth_call` to the RPC endpoint, and believes the\nanswer. An endpoint that lies can produce a false MATCH. When that assumption matters, point\n`BASE_RPC_URL` at a node under your own control, or repeat the read on BaseScan and compare the\ntwo results. The hashing of the local file happens offline, with Node's own crypto module.\n\n## Contracts\n\nThe script queries the two escrows and nothing else. The other two rows are here because they\nappear inside every purchase: USDC is the token the payment is denominated in, and the policy\nregistry holds the product descriptor, terms and privacy hashes that were in force when the\npurchase was paid.\n\n| Contract | Address | Read by the script |\n|---|---|---|\n| Escrow v9 | [`0x85b98F29C0d52c435a4514A6f4843c3b7B6bc06e`](https://basescan.org/address/0x85b98F29C0d52c435a4514A6f4843c3b7B6bc06e) | yes |\n| Escrow v8 | [`0x6478D01FB344d91b0cffa494091458F1FCfe2232`](https://basescan.org/address/0x6478D01FB344d91b0cffa494091458F1FCfe2232) | yes |\n| Policy registry (v9) | [`0xC9c131BA2D0d4F0feD26763cd7200dce74924d72`](https://basescan.org/address/0xC9c131BA2D0d4F0feD26763cd7200dce74924d72) | no |\n| USDC (payment token) | [`0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913`](https://basescan.org/address/0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913) | no |\n\nBoth escrows are queried, newest first. v9 has been live since 21 August 2026, and reports bought\nbefore that date are committed in v8, whose buyers deserve a verifier that still works.\n\nThe two versions return the same struct with one difference: v9 inserted `paymentToken` in the\nsecond slot, which shifted every field after it by one word. The script reads fields by name from\na per-version list. A hard-coded index is what broke the first client that met v9.\n\nEscrow v9 and the policy registry are verified on BaseScan, so the source behind those addresses\ncan be read there.\n\n## Doing it by hand\n\nNothing here depends on the script. The same check runs on BaseScan with no code at all:\nread `purchases(invoiceId)` on the escrow, take the `contentSha256` field, and compare it with\n`sha256sum` of your file. The walkthrough is in\n[How to verify a security report was not edited afterwards](https://automatoncolony.xyz/app/guides/verify-report-hash.html).\n\n## Guides\n\nWritten for the person about to spend the money, and kept on the site so there is one copy of\neach. The index is in [`guides/`](guides/).\n\n## For agents\n\nThe store is built for machines as much as for people. An agent has four ways in:\n\n- **MCP server**: `https://automatoncolony.xyz/mcp` (Streamable HTTP, JSON-RPC 2.0 by POST). Tools:\n  `check_contract_free`, `flash_audit_terms`, `buy_flash_audit` (paid over x402 inside the tool,\n  following the `@x402/mcp` convention) and `collect_flash_audit`. In Claude Code:\n  `claude mcp add --transport http automaton-colony https://automatoncolony.xyz/mcp`.\n- **Skill**: [`skills/automaton-colony/SKILL.md`](skills/automaton-colony/SKILL.md) teaches an agent\n  when and how to use the free check, the paid report and the verifier.\n- **HTTP with x402**: `POST /api/v1/x402/flash-audit` answers 402 with the terms; described in\n  [`openapi.json`](https://automatoncolony.xyz/openapi.json) and in the RFC 9727 catalogue at\n  [`/.well-known/api-catalog`](https://automatoncolony.xyz/.well-known/api-catalog).\n- **Identity**: ERC-8004 agent 84609 on Base, registration file at\n  [`/.well-known/agent-registration.json`](https://automatoncolony.xyz/.well-known/agent-registration.json).\n\nPlain-text summary for language models: [`llms.txt`](https://automatoncolony.xyz/llms.txt).\n\n## Reporting a problem\n\nSecurity issues go to the address in [SECURITY.md](SECURITY.md). Please do not open a public issue\nfor anything that touches funds in escrow.\n\n## Licence\n\nThe verifier is published under the [MIT licence](LICENSE), so it can be read, run, copied and\nadapted by anyone. A verifier nobody is allowed to reuse would not be much of a verifier.\n\n",
  "bytes": 6595,
  "sha": "ca8c4e81129900befd1c252ef32a1fb6ca803e29a2cb988913303caac66df35d",
  "repo_slug": "automatoncolony/automaton-colony",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_automatoncolony_automaton_colo_883badd4/readme"
}