root@proofgate:~$_

Developer Docs

Build secure AI agents with ProofGate's transaction validation infrastructure.// Prevent exploits before they happen

Quick Start

Get started with ProofGate validation in 3 steps.

1. Get Your API Key
// Get your API key from www.proofgate.xyz/dashboard/keys
// Free: 100/mo | Pro ($49): 10K/mo | Enterprise: Unlimited
// On-chain proofs: Buy credit packs OR Enterprise gets unlimited

const API_KEY = 'pg_live_xxx';
2. Validate Transaction
// Submit transaction for validation
const response = await fetch('https://www.proofgate.xyz/api/validate', {
  method: 'POST',
  headers: { 
    'Content-Type': 'application/json',
    'Authorization': 'Bearer ' + API_KEY
  },
  body: JSON.stringify({
    from: '0xYourAgentWallet',
    to: '0xContractAddress',
    data: '0xa9059cbb...', // calldata
    value: '0',
    chainId: 8453, // Base
    guardrailId: 'optional-guardrail-id'
  })
});

const result = await response.json();
console.log('Validation:', result.validationId);
3. Execute if Safe
// Check result and execute
if (result.safe) {
  // ✅ Transaction passed all checks
  console.log('Approved:', result.reason);
  await wallet.sendTransaction({ to, data, value });
} else {
  // 🚫 Transaction blocked by guardrail
  console.error('Blocked:', result.reason);
  console.error('Failed checks:', result.checks.filter(c => !c.passed));
}

// Response includes credits remaining
console.log('Credits left:', result.creditsRemaining);

API Keys

All API requests require authentication. Create and manage your API keys in the Dashboard.

Free

100

validations/month

10 req/min

Pro - $49/mo

10,000

validations/month

60 req/min

Enterprise

Unlimited

validations + on-chain

600 req/min

ON-CHAIN CREDITS

Any tier can purchase on-chain proof credits separately. Use recordOnChain: true in your request to record the validation on Base Mainnet. View credit packs →

Key Format

pg_live_

API Key

Full access to all 19 chains (mainnet + testnet). All validations cost 1 credit.

Authentication Methods
# Method 1: Authorization header (recommended)
curl -X POST https://www.proofgate.xyz/api/validate \
  -H "Authorization: Bearer pg_live_xxx..." \
  -H "Content-Type: application/json"

# Method 2: X-API-Key header
curl -X POST https://www.proofgate.xyz/api/validate \
  -H "X-API-Key: pg_live_xxx..." \
  -H "Content-Type: application/json"

# Method 3: Query parameter (for testing only)
curl "https://www.proofgate.xyz/api/validate?api_key=pg_live_xxx..."
Error Responses
// 401 - Missing or invalid API key
{ "error": "API key required", "code": "AUTHENTICATION_REQUIRED" }

// 402 - No credits remaining
{ "error": "No credits remaining. Please upgrade your plan", "code": "PAYMENT_REQUIRED" }

// Successful responses include remaining credits
{ "validationId": "val_...", "result": "PASS", "creditsRemaining": 95, "tier": "free" }

Supported Chains

ProofGate validates transactions across multiple EVM-compatible chains. All validation proofs are recorded on Base Mainnet.

Layer 1

EthereumEthereum
1
BNB ChainBNB Chain
56
AvalancheAvalanche
43114
SonicSonic
146
CeloCelo
42220
GnosisGnosis
100

Layer 2

BaseBase
8453
ArbitrumArbitrum
42161
OptimismOptimism
10
PolygonPolygon
137
zkSynczkSync Era
324
LineaLinea
59144
ScrollScroll
534352
MantleMantle
5000
Polygon zkEVMPolygon zkEVM
1101

Testnets

Base SepoliaBase Sepolia
84532
SepoliaSepolia
11155111
Polygon AmoyPolygon Amoy
80002
BSC TestnetBSC Testnet
97

More testnets available on request

NOTE

All chains share the same validation API. Just specify the chainId in your request. All tiers get instant API validation. On-chain proof recording (Base Mainnet) is available for Business and Enterprise tiers — creating an immutable audit trail for compliance.

Security Features

ProofGate runs a 2-tier security system on every validation. Always Active checks run automatically on every request — no configuration needed. Configurable checks can be tuned per guardrail for fine-grained control.

Always Active

Runs on every validation

These protections are enforced on every single validation request, with or without a guardrail configured.

Malicious Address Blacklist

3,800+ known malicious addresses synced daily from ScamSniffer, OFAC SDN, and MEW darklist. Auto-blocks Tornado Cash mixers, Lazarus Group wallets, confirmed rug pulls, phishing drainers, and sanctioned entities.

Zero Slippage Protection

Blocks all swaps with amountOutMin=0 on major DEX routers (Uniswap V2/V3, SushiSwap, PancakeSwap, Aerodrome, etc.). Zero slippage = guaranteed sandwich attack.

Contract Bytecode Scanning

Fetches contract bytecode via RPC and scans for dangerous patterns: selfdestruct, delegatecall to unknown targets, suspicious proxy patterns, and unverified contracts. Critical findings = FAIL.

Infinite Approval Detection

Blocks unlimited token approvals (type(uint256).max). Prevents malicious contracts from draining your entire token balance through excessive allowances.

Configurable per Guardrail

Per-guardrail rules

Fine-tune these settings in your guardrail configuration for additional protection.

Configurable Rules
// GuardrailRules — set per guardrail

max_slippage_bps: number
  // Maximum slippage tolerance in basis points (1 bps = 0.01%)
  // Example: 100 = 1% max slippage on DEX swaps
  // Zero slippage is ALWAYS blocked regardless of this setting

block_mev_vulnerable: boolean
  // Block MEV-vulnerable swaps (medium/high risk)
  // Default: false (advisory mode — warns but doesn't block)
  // Set to true to reject transactions vulnerable to
  // sandwich attacks and frontrunning

allowed_contracts: string[]
  // Whitelist specific contract addresses
  // Agent can ONLY interact with these contracts
  // Empty = all contracts allowed (not recommended)

blocked_contracts: string[]
  // Blacklist specific contract addresses
  // Transactions to these contracts are always rejected
  // Checked in addition to the global malicious blacklist

MEV DETECTION

MEV vulnerability detection runs on every swap transaction as an advisory by default. The check analyzes swap parameters to assess sandwich attack and frontrunning risk (low/medium/high). To upgrade from advisory to blocking, set block_mev_vulnerable: true in your guardrail rules.

Secure Architecture

For maximum security, keep your private keys away from your LLM. Use a signer microservice that validates transactions before signing.

The Problem

Most AI agents give the LLM direct access to the private key. If the LLM gets prompt-injected, attackers can drain the wallet.

❌ UNSAFE: LLM has private key

  +------------------+
  |   LLM / Agent    |
  |  (has priv key)  | -----> Blockchain
  |  Can sign ANY tx |
  +------------------+

The Solution

Separate the LLM from the signer. Add ProofGate as a validation layer between them.

✅ SECURE: LLM cannot access private key

  +-----------+      +----------------+      +------------+
  | LLM/Agent | ---> | Signer Service | ---> | Blockchain |
  | (no key)  |      |  (has key)     |      +------------+
  +-----------+      +-------+--------+
                             |
                             v
                      +------------+
                      | ProofGate  |
                      | validates  |
                      +------------+

Two Integration Options

1. Framework Plugin

Use our Eliza or GOAT plugins. The plugin calls ProofGate automatically before every transaction. Simplest setup if you're using a supported framework.

2. Signer Microservice

Deploy a separate service that holds the private key. LLM sends transaction intent, service validates via ProofGate, then signs and submits.

Signer Microservice Flow
// LLM/Agent (no private key)
const result = await fetch('http://signer-service:3000/execute', {
  method: 'POST',
  body: JSON.stringify({
    to: '0xUniswapRouter...',
    data: '0x38ed1739...',  // swap calldata
    value: '0'
  })
});

// Signer Service (has private key)
// 1. Receives transaction intent
// 2. Validates via ProofGate API
// 3. If PASS → signs and submits
// 4. If FAIL → returns error, never signs

// Even a prompt-injected LLM cannot sign
// arbitrary transactions — ProofGate blocks them

Validation API

Submit transactions for pre-execution validation and retrieve results.

POST /api/validate — Request
Submit a transaction for validation. Free tier: 100/month. Pro: 10,000/month.
curl -X POST https://www.proofgate.xyz/api/validate \
  -H "Authorization: Bearer pg_live_xxx..." \
  -H "Content-Type: application/json" \
  -d '{
    "from": "0xAgentWallet",
    "to": "0xContractAddress",
    "data": "0xcalldata...",
    "value": "0",
    "chainId": 8453,
    "guardrailId": "guardrail_xxx",
    "guardrailIds": ["guardrail_1", "guardrail_2"]
  }'
POST /api/validate — Response
Returns validation result with detailed per-check breakdown and remaining credits.
{
  "validationId": "val_xxx",
  "result": "PASS",
  "safe": true,
  "reason": "All 5 checks passed",
  "checks": [
    {
      "check": "chain_support",
      "passed": true,
      "message": "Chain 8453 (Base) is supported",
      "severity": "info"
    },
    {
      "check": "blocked_address",
      "passed": true,
      "message": "Address not in blacklist",
      "severity": "info"
    },
    {
      "check": "contract_risk",
      "passed": true,
      "message": "Contract scanned - no suspicious patterns",
      "severity": "info"
    },
    {
      "check": "mev_vulnerable",
      "passed": true,
      "message": "MEV risk advisory (low)",
      "severity": "warning"
    }
  ],
  "creditsRemaining": 95
}

Evidence Storage

Store and retrieve cryptographic evidence of validation results.

POST /evidence
Store validation evidence. Requires API key authentication.
curl -X POST https://www.proofgate.xyz/evidence \
  -H "X-API-Key: your_api_key" \
  -H "Content-Type: application/json" \
  -d '{
    "requestId": "req_123",
    "payload": {
      "transaction": {...},
      "validationResult": "PASS",
      "timestamp": "2026-02-01T15:00:00.000Z"
    }
  }'

# Response:
# {
#   "evidenceURI": "https://www.proofgate.xyz/evidence/abc123",
#   "contentHash": "0x5678...",
#   "id": "abc123"
# }
GET /evidence/:id
Retrieve stored evidence by ID. Public endpoint, no authentication required.
curl https://www.proofgate.xyz/evidence/abc123

# Response:
# {
#   "id": "abc123",
#   "requestId": "req_123",
#   "payload": {...},
#   "contentHash": "0x5678...",
#   "createdAt": "2026-02-01T15:00:00.000Z",
#   "evidenceURI": "https://www.proofgate.xyz/evidence/abc123"
# }

Integrations & SDKs

Official SDKs with full type support and async capabilities.

TS

TypeScript / JavaScript

npm v0.1.1
npm install @proofgate/sdk
TypeScript Example
import { ProofGate } from '@proofgate/sdk';

const pg = new ProofGate({ apiKey: 'pg_your_api_key' });

const result = await pg.validate({
  chainId: 8453,
  from: wallet.address,
  to: contractAddress,
  data: txData,
});

if (result.result === 'PASS') {
  await wallet.sendTransaction({ to, data });
}
PY

Python

PyPI v0.1.1
pip install proofgate
Python Example
from proofgate import ProofGate

pg = ProofGate(api_key="pg_your_api_key")

result = pg.validate(
    chain_id=8453,
    from_address=wallet.address,
    to_address=contract_address,
    data=tx_data,
)

if result.result == "PASS":
    wallet.send_transaction(to=to, data=data)
cargo add proofgate
Rust Example
use proofgate::ProofGate;

let pg = ProofGate::new("pg_your_api_key")?;

let result = pg.validate(
    8453,
    &from_address,
    &to_address,
    &tx_data,
    None,
).await?;

if result.result == "PASS" {
    wallet.send_transaction(&to, &data).await?;
}
go get github.com/ProofGate/proofgate-go
Go Example
import proofgate "github.com/ProofGate/proofgate-go"

client, _ := proofgate.NewClient(proofgate.Config{
    APIKey:  "pg_your_api_key",
    ChainID: 8453,
})

result, _ := client.Validate(ctx, proofgate.ValidationRequest{
    From:  wallet.Address(),
    To:    contractAddress,
    Data:  txData,
})

if result.Safe {
    wallet.SendTransaction(to, data)
}

Eliza Framework Plugin

Drop-in plugin for ai16z Eliza framework. Automatically validates all blockchain transactions before execution.

InstallGitHub
npm install @proofgate/eliza-plugin
Eliza Character Config
// character.json
{
  "name": "MySecureAgent",
  "plugins": ["@proofgate/eliza-plugin"],
  "settings": {
    "proofgate": {
      "apiKey": "pg_your_api_key",
      "guardrailId": "your_guardrail_id",
      "autoValidate": true,
      "blockOnFail": true
    }
  }
}
How It Works
// The plugin automatically intercepts wallet transactions:

// 1. Agent wants to execute a DeFi trade
agent.execute("Swap 100 USDC for ETH on Uniswap");

// 2. Plugin intercepts before signing:
//    → Validates against your guardrail
//    → Checks balance requirements
//    → Verifies contract whitelist

// 3. If PASS: Transaction proceeds normally
// 4. If FAIL: Transaction blocked, agent notified

// All validations recorded on-chain for audit trail

Features

  • Auto-validation - Every tx checked before signing
  • Configurable blocking - Block or warn on failed validations
  • On-chain proofs - All validations recorded on Base
  • Trust score tracking - Build verifiable agent reputation

GOAT SDK Plugin

Transaction guardrails for the GOAT SDK. Protect DeFi operations across 50+ plugins including Uniswap, Aave, 1inch, and more.

ProofGate/goat-plugin-proofgatenpm install @proofgate/goat-plugin
Usage with GOAT SDK
import { ProofGatePlugin } from '@proofgate/goat-plugin';
import { getOnChainTools } from '@goat-sdk/adapter-vercel-ai';
import { viem } from '@goat-sdk/wallet-viem';

// Initialize with your API key
const proofgate = new ProofGatePlugin({
  apiKey: process.env.PROOFGATE_API_KEY,
  autoBlock: true,  // Block unsafe transactions
});

// Add to your GOAT tools
const tools = await getOnChainTools({
  wallet: viem(walletClient),
  plugins: [
    proofgate,
    // ... other plugins (uniswap, aave, etc.)
  ],
});

// All DeFi transactions now validated automatically
How It Works
// Before any transaction executes:
// 1. ProofGate intercepts the tx params
// 2. Validates against your guardrails:
//    → Checks for infinite approvals
//    → Verifies contract whitelist
//    → Enforces value limits

// 3. If PASS: Transaction proceeds normally
// 4. If FAIL: Transaction blocked (if autoBlock: true)

// Available tools:
// - proofgate_validate_transaction (detailed validation)
// - proofgate_is_safe (quick boolean check)

Features

  • 50+ DeFi plugins - Works with Uniswap, Aave, 1inch, Curve, etc.
  • Auto-blocking - Optionally block unsafe transactions
  • 19 chains supported - All major L1s and L2s
  • On-chain proofs - All validations recorded on Base

Smart Contracts

ProofGate's on-chain infrastructure for validation proofs. All contracts are verified and open source.

ValidationRegistry

Core validation logic, proof storage & batch publishing

Core
registerValidation()batchRegister()getValidation()
View on BaseScan

NETWORK DETAILS

Network:Base Mainnet
Chain ID:8453
RPC URL:https://mainnet.base.org
Deployed:Feb 3, 2026

VALIDATION FLOW

API RequestValidateValidationRegistryOn-Chain Proof

Key Functions

Solidity Interface
// Register a single validation proof
function registerValidation(
  bytes32 requestHash,
  address agent,
  uint8 result,      // 0=PASS, 1=FAIL
  string calldata evidenceURI
) external;

// Batch register multiple proofs (gas efficient)
function batchRegister(
  bytes32[] calldata hashes,
  address[] calldata agents,
  uint8[] calldata results,
  string[] calldata evidenceURIs
) external;

// Query validation by hash
function getValidation(bytes32 hash) 
  external view returns (Validation memory);

Evidence Service

REST API for storing and retrieving detailed validation evidence. Evidence is stored off-chain with hashes anchored on-chain.

POST /evidence - Store Evidence
curl -X POST https://www.proofgate.xyz/evidence \
  -H "Content-Type: application/json" \
  -d '{
    "requestHash": "0x1234...",
    "checks": [
      {"name": "balance_check", "passed": true, "details": "..."},
      {"name": "whitelist_check", "passed": true, "details": "..."}
    ],
    "verdict": "PASS",
    "timestamp": "2026-02-03T12:00:00Z"
  }'

# Response:
{
  "id": "ev_abc123",
  "uri": "https://www.proofgate.xyz/evidence/ev_abc123"
}
GET /evidence/:id - Retrieve Evidence
curl https://www.proofgate.xyz/evidence/ev_abc123

# Response:
{
  "id": "ev_abc123",
  "requestHash": "0x1234...",
  "checks": [...],
  "verdict": "PASS",
  "timestamp": "2026-02-03T12:00:00Z",
  "onChainTx": "0xabcd..."  // Base transaction hash
}

Validator Agent

Background service that processes validation requests, runs guardrail checks, and records results on-chain.

Validation Flow

1
Receive Request

Agent polls for pending validation requests from the queue

2
Load Guardrail

Fetches the guardrail configuration for the request

3
Run Checks

Executes validation checks: blacklist, bytecode scan, MEV detection, slippage, approvals, limits

4
Store Evidence

Saves detailed check results to Evidence Service

5
Record On-Chain

Publishes validation proof to Base via batch publisher

Supported Checks
// Available validation checks:

chain_support      // Verify chain is supported (19 chains)
blocked_address    // Check against 3,800+ malicious address blacklist
contract_risk      // Bytecode scanning for suspicious patterns
mev_vulnerable     // MEV/sandwich attack vulnerability detection
excessive_slippage // Zero slippage and configurable max protection
infinite_approval  // Block unlimited token approvals
balance_check      // Verify sufficient balance for tx
allowed_contracts  // Verify contract is whitelisted
max_value          // Check against daily/tx limits
max_approval       // Check approval amount limits

System status: ONLINE