An AI agent decides it needs market intelligence, discovers the price itself, checks that price against rules it enforces on itself, pays in USDC from its own Circle Agent Wallet, and reads the answer.
No account. No API key. No human in the loop — which is the point:
"The payment must be genuinely agent-driven — a human manually completing checkout does not qualify."
Built for the Agentic Economy Prize (Circle × Build with Gemini XPRIZE).
agent Predge API (Base mainnet)
│ GET /v1/whales/latest │
│ ─────────────────────────────────► │
│ │
│ 402 Payment Required │ the 402 is the price tag,
│ ◄───────────────────────────────── │ not an error
│ { amount: 5000, asset: USDC, │
│ network: eip155:8453, payTo } │
│ │
│ ── check against own policy ── │ ceiling · asset pin · budget
│ │
│ pay 0.005 USDC from the agent's │ settle and collect are one
│ Circle wallet, and collect ──────►│ operation, not two
│ 200 { signed whale intelligence } │
Every step is machine-to-machine. The only human decision was made once, in code: how much this agent is allowed to spend, on what, and to whom.
Paying is the easy half. The moment money changes hands is exactly when the seller's incentives stop being aligned with the buyer's — and a machine cannot squint at a suspicious number the way a person can. So after every purchase the agent checks:
| Check | What it catches |
|---|---|
| ed25519 signature over the signed bytes | data altered in transit or after the fact |
| the signing key is published by the issuer | a valid signature under a key nobody published — signed by somebody, not by the issuer |
| the key is not revoked | a compromised key still producing valid signatures |
| the readable payload is the signed bytes | the trap most verifiers miss: honest signed bytes shipped alongside a payload object saying something else. The agent reads the payload. |
If any check fails the agent still paid — pretending otherwise would be a lie — but it
refuses to act on the data and says which guarantee broke. Unsigned routes report
signed: false, deliberately distinct from a failed check: collapsing the two would teach
an agent to treat unchecked data as verified.
Live example: bought a signed outcome attestation for 0.02 USDC
(tx),
all four checks passed, trusted: true.
Predge sells verifiable market intelligence. Every answer is ed25519-signed, and for resolved outcomes the settlement is committed on-chain before the outcome is knowable and cannot be rewritten afterwards — so an agent can verify what it bought instead of trusting the seller. That matters more for a machine than a human: an agent has no intuition to smell a doctored number.
- Signed-record verifier (needs no Predge code and no Predge server): https://predge-verify.vercel.app
- Resolution oracle on Circle Arc:
0xF160AbE664C34CF4C117101b4308bb16325a1ABc
So the payment rail and the product are the same idea from two directions: pay a machine price for a machine-checkable fact.
The judging criterion is whether the agent "genuinely executes transactions on its own
within set rules". Rules that live in a config file nobody checks are decoration, so
these are enforced in src/x402.mjs before anything is signed:
| Rule | Why it exists |
|---|---|
| Per-call ceiling | A seller controls the quote. Without a ceiling, a hostile or broken 402 could ask for the whole balance and a naive buyer would sign it. |
| Asset allowlist (Base USDC, pinned) | Stops a 402 redirecting payment into some other token the wallet happens to hold. |
| Payee allowlist (optional) | Pins who may be paid, for deployments that only ever buy from known sellers. |
| Session budget | A per-call limit does not stop a loop from bleeding out one small payment at a time. |
| Deliberate offer selection | Our API quotes both Base and Solana. Taking accepts[0] means paying on whichever chain the seller listed first — which is how an agent funds a chain it does not hold. |
An agent that pays whatever it is quoted is not autonomous. It is credulous.
src/x402.mjs the buyer half of x402: read the price, check it, never sign
src/agent.mjs the autonomous loop — decide, pay, read, stop on budget
src/wallet.mjs Circle Agent Wallet adapter (the only component that holds credentials)
src/x402.test.mjs guardrail tests, run against a real captured 402 challenge
server.mjs HTTP entrypoint: GET / and POST /run
The wallet is injected, not imported by the agent. The agent should not know how keys are custodied, and it lets the same loop run against a Circle wallet in production and a local signer in a test without the payment path changing shape.
npm install
npm test # 10/10, no credentials needed — the guardrails are pure logic
npm start # http://localhost:8080
curl -X POST localhost:8080/runWithout wallet credentials /run returns 503 with the reason. That is deliberate: a demo
that silently ran without a wallet would "succeed" while proving nothing.
| Variable | Meaning |
|---|---|
PREDGE_API |
API base (default: the live Predge x402 API) |
AGENT_ROUTES |
Comma-separated routes the agent may buy. Explicit on purpose — an agent with an open-ended shopping list is a liability. |
| Circle credentials | See Circle Agent Wallet below |
The agent pays from a Circle Agent Wallet — a user-controlled 2-of-2 MPC wallet whose key shares are never exposed. So the payer on the block explorer is the agent's Circle wallet, not a private key pasted into an env file.
Being honest about what "autonomous" covers: Circle Agent Wallets have no API key and no SDK, only a CLI authenticated by an emailed OTP. A human reads one code at setup, and again when a spend policy changes. After that the agent transacts entirely on its own — it discovers prices, decides, and pays with nobody present. That boundary is the custody model working as intended: a wallet an agent could bootstrap alone is a wallet anyone who compromised the agent could drain.
Status: working. Agent wallet
0x442fab3ab4927889ec6bf840d97cb77de05b727eon Base mainnet has paid for live API calls autonomously — see SETUP.md for the human-only steps.
Hosting: Compute Engine, not Cloud Run. The competition requires Google Cloud, and the obvious choice is wrong here: the CLI keeps its session in the OS keychain, and a stateless container has none — a Cloud Run revision would lose authentication on every cold start. A GCE VM satisfies the same rule and keeps the session where the agent runs. See SETUP.md.
Each /run returns, for every payment:
{
"payer": "0x… the agent's Circle wallet",
"txHash": "0x…",
"explorerUrl": "https://basescan.org/tx/0x…"
}Plus a timestamped event log of what the agent decided and why — quote received, policy passed, payment sent, resource delivered — so the autonomy is auditable rather than asserted.
- The Predge API is live on Base mainnet; payments are real USDC, in cents.
- The resolution oracle and the market that settles against it are on Arc testnet — Arc public mainnet launches 16 Sept 2026.
- One publishing key signs Predge's records today. That is a real centralisation, disclosed rather than hidden; the design compensates by making the record un-rewritable and independently verifiable, not by claiming decentralisation it does not have.