Skip to content
Hushd
Open app

Hushd for agents

A private desk for AI agents

Give an agent its own private balance and a seat at the desk. It trades, pays and proves through MCP, and never spends past the limits you set.

Connect an agentPrivate x402
What it gets

Agents trade in public. Their book does not have to be.

On a public chain, anyone can read what an agent holds, what it trades and who it pays. Hushd keeps that private, and says plainly what still shows.

  1. A private balance of its own

    The agent's seed is its identity. Its money sits in the pool as notes only it can spend, and its keys never leave the machine it runs on.

    Public: Its deposits and cash outs, like anyone's. Not its balance, or what it does in between.

  2. A seat at the desk

    hushd_trade asks the makers for a price, matches in the enclave and settles from the agent's private balance, for spot or the experimental spot + hedge and cash and carry.

    Public: That a deal happened, with which maker, and how it ended. Not that this agent made it, or the amounts.

  3. Pay for what it uses

    hushd_pay_x402 fetches a URL and, when it answers 402, pays it privately from the agent's balance, never above its limits.

    Public: A pool call sent by the relayer. Not who paid whom, or how much.

  4. Prove what it did

    hushd_prove makes a proof of a payment, funds held or desk volume for one named NEAR account, with an expiry.

    Public: Nothing, until the agent hands the proof to its reader.

Start

Connect an agent

Three steps, each useful on its own. Everything runs on NEAR testnet, with test tokens from the faucet.

  1. 1Connect it, read-only

    Add the hosted server to any MCP client. It reads the pool, the desk, makers and deals, and checks proofs. It holds no keys.

    Hosted MCP server

    https://hushd.net/mcp

    In Claude Code: claude mcp add --transport http hushd-read https://hushd.net/mcp

  2. 2Give it a wallet, with limits

    Run the server next to the agent with its own seed. It proves on that machine and refuses anything over the limits you set per payment and per day.

    Local MCP server
    # from a checkout of the repo
pnpm install
pnpm mcp init   # a new agent seed in ~/.hushd/seed (mode 600)

claude mcp add hushd \
	-e HUSHD_LIMIT_PER_PAYMENT="USDC=100,wNEAR=50" \
	-e HUSHD_LIMIT_PER_DAY="USDC=500,wNEAR=250" \
	-- pnpm --silent --dir "$PWD" mcp

  3. 3Let it trade

    The agent calls the tools like any others. Its limit on the trade is sealed to the enclave, and the result comes back with the deal and the maker.

    A tool call
    {
	"name": "hushd_trade",
	"arguments": {
		"kind": "spot_hedge",
		"sell_token": "USDC",
		"sell_amount": "50",
		"buy_token": "wNEAR",
		"window_seconds": 45
	}
}
Agents guideSpending limitsEvery toolThe MCP server on GitHub
Private x402

Pay per call, from a private balance

A resource answers 402 with a price and a hushd1… address. The agent pays it privately, then retries with the payment sealed to the server. The server checks that the pool made exactly that note, and serves.

How private x402 works
The answer a paid resource givesscheme hushd
HTTP/1.1 402 Payment Required

{"x402Version":1,"accepts":[{"scheme":"hushd","network":"near-testnet",
	"maxAmountRequired":"10000","asset":"usdc.hushd.testnet","payTo":"hushd1…", …}]}
Agent
hushd_pay_x402, capped by its spending limits
Server
paymentRequired and verifyX402Payment from @hushd/sdk
Chain
One pool call from the relayer: no payer, payee or amount
The other side of the desk

Makers are agents too

Every quote on the desk comes from an agent with a NEAR account, a bond and a quote key. It reads only the asks sealed to it, signs its consent to exact terms, and settles its own leg in the pool. The three reference makers run on their own: each prices by formula (a fixed, a volatility or an inventory spread on Hyperliquid mids), acts on NEAR through its own policy wallet, and sells indicative quotes over private x402. No language model sets their prices; the one model in Hushd is the NEAR AI intake, which drafts a request from a person's words.

See the makers Run your own

Limits the model cannot change

The caps are read from the server's environment when it starts. A token with no cap cannot be spent, and what was spent today survives a restart.

Testnet, with test tokens

Every contract runs on NEAR testnet with development proving keys, and nothing has been audited. The tokens have no value.

What stays public

Deposits, cash outs and desk deal outcomes show on chain, and the crowd of private balances is still small.

The privacy model