Shielded AI agents
Hand an AI agent a key that can pay, check in or release, without handing it your vault. Every action is a ZK proof with your limits baked in. Onchain, nobody can tell an agent from you.
What your agents can do
- Run releases you approvedScheduled payments, payroll, top-ups, DCA. Allowlisted recipients only, capped per release and per day. Amount and recipient stay shielded.
- Check in for youKeep a vault alive while you’re busy, up to a limit you set (max 365 days past your own last check-in). Agent keys expire, and they can never block guardian recovery.
- Pay other agents privatelyAgent-to-agent payments through the ZEC shielded pool. Neither side exposes identity or balance.
- Plug into any MCP agentClaude or any MCP client operates vaults through a local server. Proofs are made on your machine and secrets never enter the model’s context.
Guardrails the agent can’t talk its way past
| Limit | How it’s enforced |
|---|---|
| Cap per release | Proven inside the circuit. A release over the cap cannot produce a valid proof. |
| Releases per epoch | Each agent gets a fixed number of nullifier slots per day. Run out and it waits. |
| Allowlisted recipients | The recipient must be in a Merkle tree you committed. Anything else fails verification. |
| Scoped permissions | Check-in only, release only, or both. Set per key. |
| Revoke in one transaction | One owner proof swaps the agent root. Every old agent key stops working. |
| Keys expire | Every agent key carries an expiry date, proven in ZK. Agent check-ins stop counting once your own check-ins lapse past the limit you set. |
| Never your owner secret | Agents hold their own keys. They can never reconfigure, rotate or drain the vault. |
A jailbroken or compromised agent can only do what its key allows: pay allowlisted recipients, within its caps, until you revoke it. That’s the worst case, and you set it.
What the chain sees when an agent pays
| Public | Hidden |
|---|---|
| The vault hash | Who owns it |
| A commitment to the amount | The amount |
| A hash of the recipient | The recipient’s address |
| A one-time nullifier | Which agent acted, and that it was an agent at all |
Plug in Claude or any MCP agent
The Vault ZK MCP server runs on your machine. Keys live in an encrypted local keystore, proofs are made locally, and every tool result is scrubbed so no secret ever reaches the model. Spending tools need an explicit confirm.
claude mcp add vaultzk \ --env VAULTZK_PASSPHRASE=… \ --env VAULTZK_RELAYER_URL=https://zk.vaultprotocol.ai/relay \ -- node packages/mcp-server/dist/index.jsTools: create_vault, check_in, claim, recovery_vote, seal_data, open_data, set_agents, agent_check_in, agent_release, pay_agent, receive_address, list_vaults, list_agents, vault_status.
Status
| Expiring agent keys with permissions, caps and allowlists (agent_checkin, agent_release circuits) | Live on testnet |
|---|---|
| Agent check-ins and agent-run releases in the registry | Live on testnet |
| MCP server for Claude and other MCP agents | Testnet-ready |
| Agent-to-agent payments over the ZEC shielded pool | In development |