Proposal: verifiable pre-broadcast policy hook for price-dependent contract writes

[imokokok]

Context

This server gives AI agents a unified path to sign and broadcast state-changing operations across 60+ EVM networks through tools such as write_contract, transfer_native, transfer_erc20, and approve_token_spending.

For price-dependent contract writes, there is a useful missing control between “the agent produced valid calldata” and “the wallet signed it”: a provider-neutral policy hook that can verify fresh external evidence and return a machine-enforceable allow/warn/block decision before broadcast.

This should not be described as a universal price check. A plain transfer, an approval, and arbitrary calldata often have no safely inferable asset pair or economic intent.

Proposal

Add optional beforeWrite and afterWrite middleware around the common signing/broadcast path.

interface WritePolicy {
  beforeWrite(intent: CanonicalWriteIntent): Promise<PolicyDecision>;
  afterWrite?(result: {
    intentHash: `0x${string}`;
    txHash: `0x${string}`;
    evidence?: PolicyEvidence[];
  }): Promise<void>;
}

interface CanonicalWriteIntent {
  chainId: number;
  from: `0x${string}`;
  to: `0x${string}`;
  value: string;
  data: `0x${string}`;
  functionSelector?: `0x${string}`;
  decodedFunction?: string;
  decodedArgs?: unknown[];
  intentHash: `0x${string}`;
}

interface PolicyDecision {
  decision: 'allow' | 'warn' | 'block';
  code: string;
  evidence?: PolicyEvidence[];
}

Suggested configuration:

writePolicy: {
  mode: 'off' | 'warn' | 'enforce'; // default: off
  targets: [
    {
      chainId: 8453,
      contract: '0x...',
      selectors: ['0x...'],
      policy: 'price-safety'
    }
  ]
}

Enforcement semantics

• off: current behavior.
• warn: attach evidence/warnings to the tool result without blocking.
• enforce: a blocked, invalid, expired, or unavailable required check must fail before signing/broadcast.
• Enforcement applies only to configured targets/selectors with a trusted decoder.
• Direct transfers and approvals remain outside a price-safety policy unless a separate policy explicitly governs them.
• Unknown arbitrary calldata must be reported as not-evaluated, never “safe.”
• The canonical intent hash must be recomputed immediately before signing. Any mutation to chainId, to, value, or data after preflight invalidates the decision and blocks the write.
• Risk-reducing exits should remain available, but because generic calldata cannot prove an unwind, that classification should come from a trusted decoder/configuration rather than a caller-supplied flag.

A caller-supplied safetyContext can be useful in warn mode, but should not be enough for enforce mode; otherwise an agent can omit or misstate the economic intent it wants checked.

Concrete price-evidence adapter: Insight

Insight is a cross-oracle safety layer for AI agents and trading bots. For supported asset pairs it provides:

• 10 oracle-provider integrations across 40+ networks.
• PASS / CAUTION / DANGER / BLOCK pre-trade verdicts.
• EIP-712 signed OracleSafetyCheck receipts with a default 600-second validity window.
• An opt-in v3 schema that signs its quorum and independence policy constants: at least 3 participating providers and at least 2 distinct non-derived operator groups.
• Local, zero-network verification through verify-insight-receipt; verification needs no Insight API key.
• Execution receipts that can bind a pre-trade receipt UID to the resulting transaction hash.

The Insight receipt should remain what it actually is: signed price-integrity evidence, not transaction permission. The EVM MCP layer would separately hash the canonical executable intent and retain both digests. After broadcast it can bind that intent and the Insight receipt UID to the actual tx hash.

Smallest useful prototype

I would be happy to contribute a focused PR for:

1. Provider-neutral beforeWrite / afterWrite hooks, disabled by default.
2. Canonical write-intent hashing immediately before signing.
3. An allowlisted router/function decoder for one price-dependent swap path.
4. An Insight adapter with a bounded timeout and local receipt verification.
5. Structured policy metadata in successful and rejected MCP results.
6. Tests proving that DANGER/BLOCK, invalid signature, expiry, timeout, and post-check calldata mutation cannot reach the broadcaster in enforce mode.
7. Tests proving ordinary transfers, approvals, and out-of-scope contract writes keep their existing behavior.
8. A test fixture showing a PASS execution and a deliberately stale/divergent check blocking the same route.

Would a generic pre-broadcast policy hook fit the project’s direction? If so, I can start with the interface, intent hashing, and tests before adding a vendor adapter.

Disclosure: I am YuTao Peng, founder of Insight.