Build on the trust layer.

Introduction

The agent economy is being built faster than anyone can secure it. Agents deploy, trade, and pay on their own, often on broken endpoints, unaudited repositories, and unverified code. VAUTH closes that gap with a fleet of autonomous AI security agents that pentest, audit, and monitor every agent before value moves on-chain.

VAUTH is not a dashboard you operate. You point an agent at a target and it does the work end to end: reconnaissance, exploit testing, provenance checks, and continuous monitoring, then it writes its findings on-chain so any agent can verify another before they transact.

Who it is for

• Builders shipping agents on-chain who want proof their code and endpoints are safe before launch.
• Investors who want a verifiable trust score before putting capital behind an agent.
• Agents that need to check a counterparty automatically before paying it.

Core concepts

The fleet

Four specialised agents, each in its own isolated sandbox, handing work to one another so recon becomes exploit testing and exploit testing becomes a signed attestation.

What VAUTHRON tests for

• Authentication and authorization flaws, including broken access control and IDOR
• Injection: SQL, NoSQL, and command injection
• Cross-site scripting: reflected, stored, and DOM-based
• Server-side request forgery and open redirects
• Exposed secrets, vulnerable dependencies, and business-logic bugs
• x402 payment abuse: replay, unsigned callbacks, and refund draining

How it works

Every verification follows the same four steps, whether triggered by you or by another agent.

1. Target. Point an agent at a domain, repository, or endpoint. For active pentests, VAUTHRON first confirms you control the target via a DNS record or a token at a well-known path.
2. Autonomous work. The agent spins up an isolated sandbox and does its job. Nothing runs against production without consent, and destructive actions are gated.
3. Proof, not guesswork. A finding only appears if it can be reproduced. You get the exact request, reproduction steps, severity, and a suggested fix. Unproven findings are discarded.
4. Signed on-chain. The result and score are written as an attestation on-chain, readable by any agent.

Architecture

VAUTH sits between a target and the rest of the economy. A request enters a sandbox, an agent works, and the result lands on-chain. For the full architecture, isolation model, and diagrams, see the whitepaper.

• Isolation. Each job runs in an ephemeral container scoped to the verified target, then destroyed. No persistence between runs.
• Off-chain heavy, on-chain light. The full report is content-addressed by hash; only the compact proof is written on-chain.
• Composable. Agents hand findings to one another and to a shared directory the whole fleet queries.

x402 & automatic refunds

VAUTH is built around the x402 pay-per-call protocol. VAUTHEON escrows each payment and watches the response.

• Uptime, latency, and error rate are tracked continuously from multiple regions.
• When a paid call fails or times out, the payment is refunded in USDC automatically, no ticket and no waiting.
• Every verified endpoint feeds a public registry agents query before they pay.

On-chain attestations

Each verification is written as a compact signed record on-chain. It contains the target, verdict, score, timestamp, and a hash of the full report, so heavy data stays off-chain while the proof stays public.

This turns "trust me" into a public record. Before an agent transacts with another, it reads the counterparty's latest attestation. Investors and integrators can verify a project's score independently, without asking permission.

Trust score

The 0-100 trust score is a weighted blend of independent signals, not a single opinion. Each factor is measured directly and contributes a bounded amount.

Security model

• Consent and scope. Active pentests only run against a target you verify you own, with depth and destructive actions chosen up front.
• Containment. Every job runs in an ephemeral, network-restricted container with disposable credentials and testnet funds, then is destroyed.
• No false positives. Unproven findings are discarded, so results cannot be gamed into noise.
• Tamper-evidence. Reports are hashed and signed on-chain; an attestation cannot be altered after the fact.
• Data minimisation. Nothing leaves the sandbox except the final report and its hash.

$VAUTH token

$VAUTH launches on TRON, through SunPump, the memecoin launchpad on TRON. The contract address is published on this site the moment it exists, and nowhere else first. Until it appears there, treat every "$VAUTH" address you see anywhere as fake.

Distribution

The launch gives the creator no supply at all, so there is nothing to vest and nothing to unlock. The team is funded by its share of the pool’s trading fees, and the allocation that goes to holders of the old token is bought on the open market like any other buyer. Any further commitment will be published only once it can be checked on-chain.

What the token is for

Because there is no cheap founder supply to unload, incentives point one way: grow real usage of the fleet. See the whitepaper for the full model and diagrams.

Integration

Agents interact with VAUTH the same way you do: point an agent at a target, then read the attestation before you act. A typical flow before paying a counterparty:

The same pattern applies to repositories with VAUTHOR and to endpoints with VAUTHEON. Every result is a public attestation, so integration never requires trusting VAUTH itself, only reading the chain.

Get started

1. Get access

Two ways in. Connect Wallet supports any TRON wallet, TronLink, OKX, Bitget, TokenPocket and more, detected automatically. TRON has a single mainnet, so there is no network to add and nothing to switch: the wallet panel shows your address and your TRX balance, read straight from TronGrid.

Want updates instead? Sign up opens the VAUTH signal, where we send product updates, new agent drops, and launch news. Two channels, pick either: Telegram, one tap through @Vauthlinkbot, or email, just your address.

No password and no verification code, ever. A Telegram bot cannot message anyone who has not pressed Start, which is why we link to the bot rather than ask for your Telegram id. For email we hold nothing but the address you type, we never touch your inbox, and you can leave anytime with /stop or by asking us to remove you.

2. Run your first scan

Open the console on the homepage, choose an agent, and give it a target. For a pentest, verify ownership of your domain first.

3. Read the attestation

When the scan finishes, the trust score and report hash are written on-chain. Share the attestation link so others can verify your agent without trusting you.

FAQ

Is it safe to run against my production agent?

Scans run against a target you verify you own, inside an isolated sandbox using disposable accounts and testnet funds. You choose the depth before it starts, and destructive actions are gated.

Do I need $VAUTH to try it?

You can explore the console and read public attestations freely. Paid scans, audits, and monitoring settle in the VAUTH economy; staking $VAUTH reduces those fees.

How is a finding proven?

By reproduction. The agent replays the exact input that caused the issue and includes it in the report. If it cannot be reproduced, it is discarded.

Where does the token launch?

On TRON, through SunPump, with no pre-sale, no pre-mine and no team allocation. The creator receives no supply, so there is nothing to vest and nothing to unlock. The contract address appears on this site at launch.

Glossary