{
  "markdown": "# x402 Health Oracle\n\n**Kernel-level L2 health oracle with 4-channel AI agent distribution. x402 micropayments on Base + Hedera.**\n\nLive: `https://rtt.phoenix-ai.work` | npm: [`phoenix-mcp-server`](https://www.npmjs.com/package/phoenix-mcp-server) | MCP Registry: [`io.github.kant19801201behax5/phoenix-mcp-server`](https://registry.modelcontextprotocol.io)\n\n## Problem\n\nAI agents making autonomous on-chain transactions have no way to check network health before committing funds. 64% of DeFi protocols don't verify sequencer health. Base went down for 2 hours in June 2026 with $10.95B at risk.\n\nExisting solutions (Chainlink L2 Sequencer Feed) give binary up/down with 30-second OCR updates. Agents need nanosecond-precision RTT, revert ratios, and stall detection — **before** signing a transaction.\n\n## Solution: One Core, Four Entrances\n\n```\n                    ┌── MCP Server (Claude/Cursor/Windsurf)\n                    │\nAgent ──────────────┼── Olas Mech (DeFi/arbitrage agents)\n                    │\n                    ├── Direct HTTP/x402 (any agent by URL)\n                    │\n                    └── RPC Gateway (transparent proxy)\n                           │\n                           ▼\n                    PHOENIX CORE\n                    ├── x402 paywall ($0.01/query)\n                    ├── 12-chain RTT probe (2s interval)\n                    ├── BLAKE3+Ed25519 integrity signing\n                    ├── Isolation Forest anomaly scoring\n                    └── eBPF XDP enforcement (prog 5437, live)\n```\n\n## Distribution Channels\n\n| Channel | Status | How agents find us |\n|---------|--------|-------------------|\n| **MCP Registry** | **Published** | AI coding assistants discover `preflight_network_health` tool semantically |\n| **Olas Mech** | **Code ready** (on-chain pending) | DeFi agents find us in Mech marketplace (425 daily active agents) |\n| **Direct x402** | **Live** | Any agent calls `rtt.phoenix-ai.work` with x402 payment |\n| **RPC Gateway** | **Live** | Agent uses our URL as RPC endpoint — doesn't know Phoenix exists |\n\n## Chains Monitored\n\n12 L2 networks with 2-second sampling interval:\n\n| Chain | Type | Chain | Type |\n|-------|------|-------|------|\n| Base | OP Stack | Scroll | zkEVM |\n| Arbitrum | Nitro | Mantle | OP Stack |\n| Optimism | OP Stack | Linea | zkEVM |\n| zkSync | zkEVM | Blast | OP Stack |\n| Mode | OP Stack | Taiko | Based rollup |\n| Polygon zkEVM | zkEVM | **Casper** | L1 PoS |\n\nCasper is included as an L1 reference chain — the autonomous `casper-agent` service runs DeFi operations on Casper network, protected by the same eBPF kernel sandbox.\n\n## x402 Payment Rails\n\n| Network | Facilitator | Status |\n|---------|-------------|--------|\n| Base mainnet (`eip155:8453`) | Coinbase CDP | **Live** — $0.02 USDC settled |\n| Hedera testnet | Blocky402 | **Integrated** |\n\n```bash\n# Try it — returns 402 Payment Required with x402 challenge\ncurl -i https://rtt.phoenix-ai.work/api/v1/health\n\n# Free health endpoint (no payment)\ncurl https://rtt.phoenix-ai.work/api/health\n```\n\n### Paid Endpoints ($0.01 USDC each)\n\n| Endpoint | Description |\n|----------|-------------|\n| `POST /api/v1/preflight` | **Deterministic execution decision** — PASS/DEGRADED/FAIL with evidence_id |\n| `/api/v1/health` | Full health snapshot (all 12 chains) |\n| `/api/v1/safe` | Boolean safety check with reason code |\n| `/api/v1/price` | Pricing with MEV surge multiplier |\n| `/api/v1/chains/{chain}` | Single-chain telemetry |\n| `/api/v1/classify` | Agent classification (HUMAN/LEGIT_AGENT/MALICIOUS_BOT) |\n| `/api/v1/health-proof` | ZK-lite verifiable proof of node health |\n\n## Components\n\n| Component | File | Description |\n|-----------|------|-------------|\n| **x402 Gateway** | `gateway/x402_gateway.py` | FastAPI payment gateway — CDP (Base) + Blocky402 (Hedera) |\n| **Multi-Chain Probe** | `probe/multi_chain_probe.py` | 12-chain RPC poller (eth_blockNumber every 2s) |\n| **WSS Distributor** | `probe/wss_distributor.py` | WebSocket broadcast with BLAKE3+Ed25519 integrity signing |\n| **Silicon DNA** | `gateway/server.ts` | 14-layer anti-bot (ML-KEM-768, Argon2 PoW, Spearman correlation) |\n| **XDP Threat Filter** | `ebpf/xdp_threat_filter.c` | Kernel-speed packet drop for banned IPs |\n| **LSM Agent Guard** | `ebpf/lsm_agent_guard.c` | Syscall-level sandbox: block execve, restrict network |\n| **MCP Server** | `mcp-server/` | Model Context Protocol server for AI agent discovery |\n| **RPC Gateway** | `gateway/rpc_gateway.py` | Transparent health-checking proxy before upstream RPC |\n| **Mech Tool** | `mech-tool/phoenix_health_check.py` | Olas Mech marketplace tool interface |\n\n## eBPF Kernel Security\n\n### XDP Threat Filter (LIVE since Aug 28, 2026)\n\neBPF XDP program (`prog id 5437`) on `eth0` drops malicious packets before the TCP stack (~5-20µs on virtio_net generic mode). Silicon DNA's 14-layer bot detection feeds the BPF map every 5 seconds.\n\n### LSM Agent Guard (compiled, kernel-ready)\n\nBPF LSM hooks create a per-agent syscall sandbox:\n- **Block execve** — agent can't spawn child processes\n- **Restrict connect** — only ports 443 (HTTPS) and 8545 (RPC)\n- **File access** — limited to agent's working directory\n\n## MCP Server (AI Agent Discovery)\n\nPublished to npm and MCP Registry. Any AI coding assistant can discover and use our health oracle.\n\n```bash\n# Install from npm\nnpm install -g phoenix-mcp-server\n\n# Or add to Claude Desktop (claude_desktop_config.json):\n{\n  \"mcpServers\": {\n    \"phoenix-zero\": {\n      \"command\": \"npx\",\n      \"args\": [\"phoenix-mcp-server\"]\n    }\n  }\n}\n```\n\n**Tool:** `preflight_network_health` — returns PASS / DEGRADED / FAIL with kernel-level evidence.\n\n## RPC Gateway (Transparent Proxy)\n\nAgent connects to Phoenix as if it were a normal RPC endpoint. Phoenix checks health before forwarding:\n\n```\nAgent → POST /rpc/base {\"method\": \"eth_sendRawTransaction\", ...}\n     Phoenix checks health:\n       PASS → forward to upstream RPC → response + X-Phoenix-Health: PASS\n       DEGRADED → forward + X-Phoenix-Warning header\n       FAIL → 503 \"Transaction blocked to protect funds\"\n```\n\n**Live — try it now:**\n\n```bash\ncurl -X POST https://rtt.phoenix-ai.work/rpc/base \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"jsonrpc\":\"2.0\",\"method\":\"eth_blockNumber\",\"params\":[],\"id\":1}'\n# → {\"jsonrpc\":\"2.0\",\"result\":\"0x...\",\"id\":1}\n# + X-Phoenix-Health: PASS header\n```\n\nSupported chains: `base`, `arbitrum`, `optimism`, `zksync`, `scroll`, `mantle`, `linea`, `blast`, `mode`, `taiko`, `polygon_zkevm`.\n\n## Docker\n\nRuns the x402 gateway locally. Real-time telemetry comes from the production server at `rtt.phoenix-ai.work`.\n\n```bash\ncp .env.example .env   # edit with your CDP/Hedera keys\ndocker compose up\ncurl -i localhost:3002/v1/safe       # → 402 Payment Required\ncurl localhost:3002/                  # → service info\n```\n\n## Security Stack\n\n- **eBPF XDP** — kernel-speed threat response (live, prog 5437)\n- **eBPF LSM** — per-agent syscall sandbox (compiled)\n- **ML-KEM-768** (NIST FIPS 203) post-quantum key exchange\n- **BLAKE3 + Ed25519** integrity signing on all telemetry\n- **14-layer bot detection** — CPU jitter, Spearman correlation, Argon2 PoW, Frankenstein headers, Sybil clustering, Privacy Pass\n- **Isolation Forest** anomaly scoring\n\n## Test Suite\n\n- **Main repo:** 29 test files, 581 passed, 0 failed, 1 skipped\n- **Hackathon repo:** 3 test suites, 31 passed (gateway 21 + MCP server 10)\n- **Python tests:** 8 passed (gateway config)\n- **Total: 620+ tests**\n\n## Verified Revenue\n\nTwo on-chain settlements on Base mainnet (Sep 1, 2026):\n- $0.01 + $0.01 = **$0.02 USDC total**\n- PAY_TO: `0xbb967F16C7f3e9B4c1626680684445d41dBE44Ab`\n\n## Continuity\n\nThis project extends 6+ months of production work (since March 2026). Server uptime 117+ days. 11 production services on DigitalOcean. See [CONTINUITY_PROOF.md](CONTINUITY_PROOF.md).\n\n## Paper\n\nSilicon DNA: The Physics of Network Identity Verification\nDOI: [10.5281/zenodo.22239862](https://doi.org/10.5281/zenodo.22239862)\n\n## License\n\nMIT\n",
  "bytes": 7994,
  "sha": "ed0aba945fe06dff4011f9fa758a3932a6b566c16d65d1d09f52beb82b7fa023",
  "repo_slug": "kant19801201behax5/x402-health-oracle",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_kant19801201behax5_phoenix_mcp_8d79da62/readme"
}