The whitepaper.
How bitfence scores token risk for autonomous agents — the methodology, the evidence discipline, and the payment model, in full.
Abstract
Autonomous AI agents now hold wallets, pay for services over x402, and execute on-chain transactions without a human in the loop. The risk tooling available to them was built for human readers: dashboards, explorers, and wallet warnings that assume a person will look at a screen and decide. bitfence is a risk oracle designed for the agent itself. It runs one check before every transaction that touches a token, returns a machine-routable verdict — a score, a recommendation, and named safety flags — and is itself paid for per call over x402, so an agent can discover, pay for, and consume the check without an account.
The paper explains the thinking behind the system. Risk is decomposed into six categories, where each category is a distinct mechanism by which a holder’s position is destroyed. Safety-critical facts are treated with an explicit evidence discipline: every fact is known-true, known-false, or unknown, and an unknown is never quietly converted into a known. Hard safety checks are circuit breakers that override the composite score, split into measured threats and heuristic inferences with different authority. When the system cannot settle a safety-critical check, it says so, names the gap, and refuses to recommend proceeding.
The core ideas
Breakers fire on known evidence only.
Every fact feeding a circuit breaker is three-valued — known-true, known-false, unknown. Missing data can neither fire a breaker nor silently suppress one; when a safety-critical check can’t run, the assessment is delivered as degraded and the recommendation can never be PROCEED.
Three recommendations, no prose to interpret.
PROCEED, REQUIRE_HUMAN_APPROVAL, BLOCK — an agent routes on structured fields, not dashboard panels. The middle tier escalates ambiguous tokens to a human instead of guessing.
Priced for agents, not accounts.
Per-call USDC micropayments over x402, settled on Base as part of the HTTP exchange. No accounts, no API keys, no subscriptions.
No verdict outlives its policy.
All scoring lives in a pure, versioned policy engine. Every assessment is stamped with the policy version that produced it, and a cached verdict from an older policy is treated as a miss.