The gate for agents and people on Ethereum
Misogi simulates every transaction and signature, checks who is on the other side and holds it to your rules before anything is signed. Agents spend from a Safe within their charms; drainers, hidden instructions and look-alike addresses are turned away.
Good morning
Your agent pays vendors in USDC on Ethereum. Every payment passes the same five checks, and anything unusual waits for you.
The model proposes. These checks decide.
Agent
Pick something from the inbox. The model reads it and proposes a payment. Five checks written in plain code decide what actually happens, so a convincing scam can change the proposal but never the outcome.
Approvals
These passed the domain check but went over a limit, or came from a vendor you have not approved yet. Approving pays this one invoice, once, to the registered address.
Rules
If the agent is ever compromised, these limits are the most it can spend. Anything above them waits for your approval.
Registry
Paste the address from an invoice or an email. Misogi tells you whether it is the payout that domain registered.
It says which address receives payments, and on which network.
_payto.yourdomain.com TXT "base:usdc:0xYourPayoutAddress"Misogi reads the record from several resolvers, then writes the domain and address to the registry on Ethereum.
A new address only takes effect after 72 hours. Payers keep paying the old one, and you can cancel if you did not ask for it.
Agent purchases · x402
A merchant names its domain in the 402 response. Before the agent signs, the guard compares the requested pay-to address with that domain's registered payout. A hacked server can edit its own response. It cannot edit the registry.
Unregistered merchants: up to $2 after screening
History
Paid, held and refused payments, including who approved them. Copy it as CSV for your books.
| When | Payee | Reference | Amount | Result | Decided by |
|---|
道具Build · Docs
Everything you need to use Misogi, connect agents and run it yourself on Ethereum mainnet.
Misogi is the gate every onchain action passes through before it is signed. Agents, bots and people send a transaction or a signature; Misogi decodes it, simulates it against Ethereum mainnet, checks who is on the other side and holds it to your rules.
Agents never hold the keys to your money. They spend from your Safe through the Omamori module, which enforces each agent's limits onchain, so even a compromised server cannot exceed them.
Press Enter the shrine. Misogi uses Sign-In with Ethereum, so there is no password.
Approvals and unsealing need a passkey (Face ID, Touch ID, Windows Hello or a security key). It is bound to one request each time.
Paste your Safe address and the Omamori module address. Misogi prepares the enableModule batch for the Safe app.
Give it a name, the addresses it may pay or call, spending caps per token per period, and an expiry. Sign the grant in your Safe, then press Confirm grant. The API key is shown once.
Use the SDK, the MCP server for Claude or Cursor, or the Telegram bot. Every action goes through the gate.
import { Misogi } from '@misogi/sdk'; const misogi = new Misogi({ apiKey: process.env.MISOGI_AGENT_KEY!, baseUrl: 'https://api.yourdomain.com' }); // Plain words, English or Indonesian. It still passes the gate. const r = await misogi.say('send 20 usdc to vitalik.eth'); console.log(r.verdict, r.summary, r.txHash);
Every action runs through the same checks, in order. Each check adds findings; the strongest finding decides the verdict.
eth_simulateV1 against the latest block (falls back to eth_call): balance changes, approvals, EIP-7702 delegations, Permit, Permit2 and Seaport signatures.{
"verdict": "wait", // "pass" | "wait" | "refuse"
"summary": "New recipient: first payment to 0x8d…31 waits 24 hours",
"findings": [
{ "feature": "shimenawa", "level": "wait", "text": "First payment to this address", "forces": "wait" },
{ "feature": "kagami", "level": "info", "text": "−20 USDC from your Safe, +20 USDC to 0x8d…31" }
],
"valueUsd": 20
}Seven zones, one gate. Each card lists what the feature does and where to reach it in the API.
Every action passes the torii before it is signed.
The gate that marks the line between the outside world and sacred ground.
Every transaction and signature is decoded, simulated and checked against your rules. The answer is Pass, Wait or Turn away, with the reason.
POST /v1/gate/txPOST /v1/gate/signatureThe sacred mirror hung to draw Amaterasu out of the cave. It shows things as they are.
Simulates the transaction against mainnet state and shows exactly which balances change, which approvals are granted and what gets delegated.
POST /v1/gate/tx (simulation inside every check)The water pavilion where visitors purify their hands before entering.
Cleans tweets, emails, documents and web pages before an agent reads them: hidden text, invisible unicode, encoded commands and injected instructions are quarantined.
POST /v1/temizuyaPOST /v1/agent/purifyThe sacred rope that marks a boundary not to be crossed.
Your rules: per-transaction and daily limits, allowed recipients, approval caps, and a waiting period before new recipients or changed rules take effect.
GET /v1/mePUT /v1/me/policyZigzag paper streamers shaped like lightning, marking what is pure.
A clear label on every address, token and contract: safe, caution or danger, with the evidence behind it.
GET /v1/kasagi/:addressWatchers that never sleep, and the way out when things go wrong.
The pair of lion-dogs at the shrine entrance, one mouth open (a), one closed (un).
Two watchers on your wallets. A watches what comes in (dust, poisoned lookalikes, bait NFTs). Un watches what goes out (new approvals, delegations, unusual transfers).
GET /v1/komainuPOST /v1/komainuDELETE /v1/komainu/:idThe land of the dead, whose entrance Izanagi sealed with a boulder.
A blocklist of drainers and scam addresses, synced from public threat feeds and your own reports. Nothing passes to them.
GET /v1/yomiPOST /v1/yomi/reportThe cave where Amaterasu hid, sealing the light inside.
Emergency seal: one action freezes every agent, revokes their charms and prepares the revoke transactions for every open approval.
POST /v1/iwato/sealPOST /v1/iwato/unseal/optionsPOST /v1/iwato/unseal/verifyThe sword Yamato Takeru used to cut the grass and escape a ring of fire.
Recovery for a Safe: guardians you choose can replace a lost or stolen owner key after a public delay that the owner can cancel.
PUT /v1/hondenYour agents, the charms that limit them, and the priest who approves.
Foxes, the messengers of Inari.
Your agents. Each one has an API key, a charm that limits it, and a timeline of everything it tried to do.
GET /v1/agentsPOST /v1/agentsPUT /v1/agents/:id/charmPOST /v1/agents/:id/revokePOST /v1/agents/:id/rotate-keyA protective charm carried everywhere.
Onchain session limits for each agent, enforced by a Safe module: allowed contracts, spend caps per token per period, and an expiry date.
POST /v1/agents/:id/confirm-grantGET /v1/agents/:id/remainingThe priest who performs the rites.
Human approval with a passkey. When an agent asks for something outside its charm, you approve that one action, once.
GET /v1/approvalsPOST /v1/approvals/:id/optionsPOST /v1/approvals/:id/verifyPOST /v1/approvals/:id/rejectThe sacred dance, repeated in rhythm.
Recurring strategies run by your agent inside the gate: dollar-cost averaging and limit orders through CoW Protocol, and scheduled transfers.
GET /v1/kaguraPOST /v1/kaguraPATCH /v1/kagura/:idDELETE /v1/kagura/:idPayments, tasks, receipts and recurring flows.
The offering box where coins are tossed.
Pay-per-use with x402: before an agent pays for an API call, the guard checks who will receive the money and how much.
POST /v1/agent/saisenPOST /v1/agent/saisen/:id/paidPOST /v1/saisen/checkWooden plaques where visitors write their wishes.
A task board with onchain escrow. Post a task and its reward, an agent or person takes it, and the reward is released when you accept the result.
GET /v1/emaPOST /v1/ema/draftThe shrine seal stamped into a pilgrim's book.
An onchain receipt (an EAS attestation) for every payment that passed the gate and every task completed. Together they form a reputation.
GET /v1/goshuinThe thousands of gates lining the path at Fushimi Inari.
Recurring payments: payroll, subscriptions and allowances. Each payment passes its own gate when it is due.
GET /v1/senbonPOST /v1/senbonPATCH /v1/senbon/:idDELETE /v1/senbon/:idThe portable shrine carried from place to place.
Bridge check before assets leave mainnet: is this the canonical bridge, is the contract verified, and does the simulation send funds where you expect.
POST /v1/mikoshiTools for traders: token fortunes, cleansing, lanterns on the path.
Fortune slips drawn at the shrine, from great blessing to great curse.
Token check before you buy: honeypot, buy and sell tax, mint and owner powers, liquidity and holders, graded from Daikichi to Daikyo.
GET /v1/omikuji/:tokenBad fortunes are tied at the shrine so the misfortune stays behind.
Tie a token and leave it: it is hidden from your views and every transaction that touches it is turned away.
POST /v1/musubiStone lanterns that light the path to the shrine.
Alerts: price levels from Chainlink feeds and activity from wallets you watch.
GET /v1/toroPOST /v1/toroDELETE /v1/toro/:idThe purification wand the priest waves over people and things.
Cleanse a wallet: every open token and NFT approval with its risk, the transactions to revoke them, and a check for EIP-7702 delegations.
GET /v1/haraegushi/:address?Who is on the other side, and how far to trust them.
The top beam of the torii, resting above everything.
Who is on the other side: ENS, ERC-8004 agent identity, verified contracts, domains registered in the Kasagi registry, and your own address book.
GET /v1/kasagi/resolve?q=GET /v1/kasagi/:addressPOST /v1/kasagi/registerGET|POST|DELETE /v1/bookThe curved sacred jewel, one of the three imperial treasures.
A trust score for any address or agent, built from age, verification, identity, threat feeds and Goshuin receipts.
GET /v1/magatama/:addressThe innermost hall where the kami dwells.
Your vault: a Safe that agents can never touch directly, with Omamori and Kusanagi modules attached.
GET /v1/hondenPUT /v1/hondenPlain words in, guarded actions out. Morning briefs and audits.
The roosters set on a perch to crow the sun goddess out of her cave.
A morning brief: balances, what your agents did overnight, what is waiting for you and what changed.
GET /v1/niwatoriPUT /v1/me/settingsThe belief that words carry spirit and power.
Say it in plain words, in English or Indonesian. Misogi turns it into a transaction that still passes the gate.
POST /v1/kotodamaPOST /v1/agent/intentThe path that leads to the shrine.
The timeline: every request, check, approval and result, in order.
GET /v1/sandoGET /v1/sando/:idPOST /v1/sando/:id/sentGET /v1/eventsThe great purification held at the end of June and December.
A scheduled audit of every wallet and agent: approvals, delegations, charms close to expiry, risky tokens and threat-feed hits.
GET /v1/oharaePOST /v1/oharae/runThe TypeScript SDK is a thin client over the REST API. Agent keys start with msk_ and are created in Kitsune.
pnpm add @misogi/sdk # or use packages/sdk from the repo| Method | What it does |
|---|---|
me() | Who am I, which Safe I spend from, my limits and whether the gate is sealed. |
check(action) | Ask the gate without doing anything. Returns the verdict and the charm findings. |
execute(action) | Check, then sign and send through Omamori if it passes. Wait creates an approval request. |
executeOrThrow(action) | Same as execute, but throws TurnedAway when the gate refuses. |
say(text) | Kotodama: plain words become a transaction that still passes the gate. |
payInvoice({to, amount, token, invoiceId}) | Pay an invoice by domain, ENS or address. |
request(id) | Status of one request: waiting, approved, executed, rejected or failed. |
waitFor(id, {timeoutMs, intervalMs}) | Poll until a human approves or rejects. |
purify(text, {html, source}) | Temizuya: clean text before the model reads it. |
omikuji(token) | Token fortune from Daikichi to Daikyo, with reasons. |
magatama(address) | Trust score 0 to 100 with its factors. |
resolve(query) | Resolve a domain, ENS name or label to an address, with Yomi blocklist status. |
saisen(resource, requirements) | Check an x402 payment request before paying. |
saisenPaid(requestId, txHash?) | Record that an x402 payment was made. |
const res = await misogi.execute({ to: '0xA0b8…eB48', data, title: 'Pay invoice INV-2241' }); if (res.verdict === 'pass') console.log('sent', res.txHash); if (res.verdict === 'wait') { const done = await misogi.waitFor(res.requestId, { timeoutMs: 30 * 60_000 }); console.log(done.status); // "executed" once you approve with your passkey } if (res.verdict === 'refuse') console.log('turned away:', res.summary);
import { saisenFetch } from '@misogi/sdk'; // pay() is your x402 payer; Saisen checks recipient and amount before it runs. const guardedFetch = saisenFetch(misogi, pay); const res = await guardedFetch('https://paid-api.example/v1/answer');
| Error | When |
|---|---|
MisogiError | HTTP error from the API (status, message, body). |
TurnedAway | Thrown by executeOrThrow when the verdict is refuse (summary, findings, requestId). |
Base URL https://api.yourdomain.com/v1. People sign in with SIWE and send Authorization: Bearer mss_… (session). Agents send Authorization: Bearer msk_…. Bodies are JSON; big integers are strings. Errors return {"error": "…"}; a refused gate check returns 422 with the full result.
curl -X POST https://api.yourdomain.com/v1/agent/check \
-H "Authorization: Bearer $MISOGI_AGENT_KEY" \
-H "content-type: application/json" \
-d '{"to":"0xd8dA6BF26964aF9D7eEd9e03E53415D37aA96045","value":"10000000000000000","title":"Tip"}'GET /v1/auth/noncePOST /v1/auth/verifyPOST /v1/auth/logoutGET /v1/mePUT /v1/me/policyPUT /v1/me/settingsPOST|DELETE /v1/me/telegramPOST /v1/gate/txPOST /v1/gate/signaturePOST /v1/temizuyaPOST /v1/kotodamaGET /v1/agentsPOST /v1/agentsPUT /v1/agents/:id/charmPOST /v1/agents/:id/confirm-grantGET /v1/agents/:id/remainingPOST /v1/agents/:id/revokePOST /v1/agents/:id/rotate-keyGET /v1/agent/mePOST /v1/agent/checkPOST /v1/agent/executePOST /v1/agent/intentGET /v1/agent/requests/:idPOST /v1/agent/purifyPOST /v1/agent/saisenPOST /v1/agent/saisen/:id/paidGET /v1/approvalsPOST /v1/approvals/:id/optionsPOST /v1/approvals/:id/verifyPOST /v1/approvals/:id/rejectPOST /v1/passkeys/register/optionsPOST /v1/passkeys/register/verifyDELETE /v1/passkeys/:idPOST /v1/iwato/sealPOST /v1/iwato/unseal/optionsPOST /v1/iwato/unseal/verifyGET /v1/kasagi/resolve?q=GET /v1/kasagi/:addressPOST /v1/kasagi/registerGET /v1/magatama/:addressGET /v1/omikuji/:tokenPOST /v1/musubiGET /v1/haraegushi/:address?GET|POST|DELETE /v1/bookGET /v1/hondenPUT /v1/honden/v1/kagura/v1/senbon/v1/toro/v1/komainuGET /v1/ema · POST /v1/ema/draftGET /v1/goshuinPOST /v1/mikoshiGET /v1/yomi · POST /v1/yomi/reportGET /v1/niwatoriGET /v1/oharae · POST /v1/oharae/runGET /v1/sando · /v1/sando/:id · POST /v1/sando/:id/sentGET /v1/events · POST /v1/events/readPOST /v1/saisen/checkGET /v1/features · GET /v1/healthLets Claude Desktop, Claude Code, Cursor and other MCP clients act through the gate with an agent key.
{
"mcpServers": {
"misogi": {
"command": "node",
"args": ["--import", "tsx", "/path/to/misogi/apps/mcp/src/index.ts"],
"env": { "MISOGI_API_URL": "https://api.yourdomain.com", "MISOGI_AGENT_KEY": "msk_…" }
}
}
}| Tool | What it does |
|---|---|
misogi_purify | Clean text before the model reads it. |
misogi_check | Ask the gate about a transaction. |
misogi_execute | Check and send through Omamori. |
misogi_say | Plain words to a gated transaction. |
misogi_request_status | Status of a waiting request. |
misogi_token_fortune | Omikuji for a token. |
misogi_trust_score | Magatama for an address. |
misogi_resolve | Resolve a domain, ENS or label. |
misogi_x402_check | Saisen check of an x402 request. |
Alerts, briefs and approvals in Telegram. Free text without a command is read by Kotodama, in English or Indonesian.
| Command | What it does |
|---|---|
/start | Welcome and link instructions. |
/link CODE | Link this chat to your account (code from the app settings). |
/check text | Kotodama: say what you want, it passes the gate. |
/approvals | What is waiting for you, with approve and reject buttons. |
/omikuji 0x… | Token fortune. |
/trust 0x… | Trust score. |
/cleanse [0x…] | Open approvals and revoke transactions. |
/watch 0x… | Komainu watches a wallet. |
/brief | Niwatori morning brief now. |
/seal | Ama-no-Iwato: freeze every agent. |
Solidity 0.8.28, Foundry, 25 tests. Deploy the shared contracts once, and one pair of modules per Safe.
| Contract | Key functions | Purpose |
|---|---|---|
OmamoriModule | grant(agent, expiresAt, requireGate, targets, tokens, maxPerPeriod, periods)execute(to, value, data, deadline, gateSig)revoke · seal · unseal | Safe module. Agent charms: targets, caps per token per period, expiry, optional EIP-712 gate co-signature (domain "Misogi Omamori" v1). |
KusanagiRecovery | propose(prevOwner, oldOwner, newOwner)confirm · execute · cancel | Guardians replace a lost owner key after a public delay; the Safe can cancel. |
KasagiRegistry | register(domain, payout, controller, deadline, sig)requestChange · executeChange · cancelChangepayoutOf(domain) | Domain to payout address, attested after a DNS _payto check. Changes wait 72 hours in public. |
EmaBoard | post · take · submit · accept · cancel | Task escrow: the reward is locked until the result is accepted. |
| What | Address |
|---|---|
| EAS (Goshuin) | 0xA1207F3BBa224E2c9c3c6D5aF63D0eb1582Ce587 |
| EAS SchemaRegistry | 0xA7b39296258348C78294F95B872b282326A97BDF |
| CoW GPv2Settlement (Kagura) | 0x9008D19f58AAbD9eD0D60971565AA8510560ab41 |
| CoW VaultRelayer | 0xC92E8bdf79f0507f65a392b0ab4667716BFE0110 |
cd packages/contracts KASAGI_ATTESTER=0x… KASAGI_GOVERNANCE=0x… forge script script/Deploy.s.sol --rpc-url $MISOGI_RPC_URL --broadcast --verify --ledger SAFE_ADDRESS=0x… MISOGI_GATE_ADDRESS=0x… MISOGI_SEALER_ADDRESS=0x… \ KUSANAGI_GUARDIANS=0xA,0xB,0xC KUSANAGI_THRESHOLD=2 \ forge script script/DeployModules.s.sol --rpc-url $MISOGI_RPC_URL --broadcast --verify --ledger
Shimenawa rules live on your account. Tightening applies at once; loosening is staged and needs your passkey.
| Rule | Default | Meaning |
|---|---|---|
perTxUsd | 250 | Most one action may move without asking. |
dailyUsd | 1,000 | Most all actions together may move in a day. |
newRecipientHours | 24 | First payment to a new address waits this long. |
unknownRecipient | wait | What to do with an address you have never paid. |
unlimitedApproval | wait | Unlimited token approvals. |
youngContractDays | 30 | Contracts younger than this need a human. |
unpricedOutflow | wait | Tokens without a Chainlink price. |
x402MaxUsd | 1 | Most per x402 purchase without asking. |
allowedContracts | [] | Contracts that skip the young-contract rule. |
allowedDelegates | [] | EIP-7702 delegates you trust. |
blockedTokens | [] | Tokens tied with Musubi. |
One server runs four services that share one SQLite file. Only the signer holds keys, and it publishes no port.
| Service | Role |
|---|---|
api | Public HTTP API on :8787 behind HTTPS. |
signer | The only process with private keys (agent keys AES-256-GCM encrypted). HMAC-authenticated, private network only. |
worker | Komainu, Toro, Kagura, Senbon, Ema indexer, Niwatori, Oharae, request expiry. |
bot | Telegram bot (optional profile). |
web | Static site (Vite build) on any host. |
pnpm install cd packages/contracts && forge install foundry-rs/forge-std --no-git && cd ../.. cp .env.example .env # fill RPC, Etherscan, keys (see below) openssl rand -hex 32 # SIGNER_SHARED_SECRET openssl rand -hex 32 # SIGNER_MASTER_KEY (back it up) cast wallet new # GATE_PRIVATE_KEY, SEALER_PRIVATE_KEY, KASAGI_ATTESTER_PRIVATE_KEY docker compose up -d --build # signer, api, worker docker compose --profile telegram up -d bot # optional VITE_API_URL=https://api.yourdomain.com pnpm --filter @misogi/web build
| Variable | What |
|---|---|
MISOGI_RPC_URL | Mainnet RPC with eth_simulateV1 (Alchemy, QuickNode, Infura or your node). |
ETHERSCAN_API_KEY | Contract source, age and history. |
SIGNER_SHARED_SECRET | HMAC between services. |
SIGNER_MASTER_KEY | Encrypts agent keys. |
GATE_PRIVATE_KEY | Gate co-signer; its address goes into each Omamori module. |
WEBAUTHN_RP_ID · WEBAUTHN_ORIGIN · SIWE_DOMAIN | Your web app domain. |
KASAGI_REGISTRY · EMA_BOARD | Addresses from Deploy.s.sol. |
TELEGRAM_BOT_TOKEN | Optional, for the bot and alerts. |
The amount is above the charm cap for this period. Wait for the period to reset, or raise the cap in Kitsune (needs a Safe signature).
The charm expired or was revoked. Prepare a new charm in Kitsune and sign the grant in your Safe.
The charm requires the gate co-signature. Send the action through Misogi, not directly to the module.
Ama-no-Iwato is closed. Unseal it from the app with your passkey.
Your RPC does not support eth_simulateV1, so Misogi fell back to eth_call. Use a provider that supports it.
Each agent address pays its own gas. Send it a little ETH; Kitsune shows the balance.
Tekan Enter the shrine dan tanda tangani pesan Sign-In with Ethereum.
Dipakai untuk menyetujui aksi dan membuka segel. Setiap persetujuan hanya berlaku untuk satu aksi.
Tempel alamat Safe dan modul Omamori, lalu tanda tangani batch di aplikasi Safe.
Tentukan tujuan yang boleh, batas per token per periode dan masa berlaku. API key hanya ditampilkan sekali.
Lewat SDK, server MCP, atau bot Telegram. Setiap aksi lewat gerbang: Lolos, Tunggu, atau Ditolak. Darurat? Tekan Ama-no-Iwato.
Approve with passkey
Press and hold to approve
In this demo the hold stands in for your device passkey (fingerprint or face).
Sign in with an Ethereum wallet. Misogi asks for one signature to prove the address is yours; it never moves funds.