{ "version": "1.1", "name": "Phoenix Zero \u2014 Cross-Chain Execution Oracle", "description": "Execution oracle for AI agents: answers 'is it safe to send NOW?' 12 monitored chains polled every ~2 seconds (chains_in_service in /v1/health says how many are in service now). Evidence at three levels: kernel TLS round trip (eBPF, a separate field, not part of the verdict), network level (RPC latency), and execution level (revert ratio on Base and Arbitrum). Feed records signed BLAKE3+Ed25519. Silicon DNA caller classification (agent/human/bot): every request is classified by the caller's behaviour (request rhythm, User-Agent and header consistency); the label is returned in the X-Silicon-DNA-* response headers and is not a block by itself (what is recorded: llms.txt).", "homepage": "https://rtt.phoenix-ai.work", "documentation": "https://rtt.phoenix-ai.work/docs", "contact": "aleksandrkent64@gmail.com", "payment": { "networks": [ { "network": "eip155:8453", "chain": "Base", "asset": "USDC", "asset_address": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913" }, { "network": "eip155:137", "chain": "Polygon", "asset": "USDC", "asset_address": "0x3c499c542cEF5E3811e1192ce70d8cC03d5c3359" }, { "network": "eip155:42161", "chain": "Arbitrum One", "asset": "USDC", "asset_address": "0xaf88d065e77c8cC2239327C5EDb3A432268e5831" } ], "facilitator": "Coinbase CDP", "payTo": "0xbb967F16C7f3e9B4c1626680684445d41dBE44Ab", "price": "0.01", "currency": "USDC", "surge_pricing": { "normal": "0.01", "elevated": "0.03", "critical": "0.10" } }, "sdk": { "npm": "phoenix-mcp-server", "github": "https://github.com/kant19801201behax5/SiliconDNA-PhoenixZero/tree/master/sdk", "integration": "2 lines of code \u2014 auto-pays x402 via EIP-712" }, "capabilities": [ "Binary pre-flight safety check (safe=true/false)", "12-chain sequencer health monitoring", "Silicon DNA behavioral caller classification (14 layers)", "eBPF XDP kernel-level threat filtering", "Cross-chain correlation matrix (R_xy) \u2014 exploratory, not yet validated for bot detection", "Request-timing entropy + Spearman correlation analysis", "Timing-jitter measurement of the serving node (layer L0); no device or NIC fingerprinting", "x402 micropayments on Base, Polygon, Arbitrum One" ], "endpoints": [ { "path": "/v1/safe", "method": "GET", "description": "THE KEY ENDPOINT. Binary safety check: safe=true (execute now) or safe=false (wait). Returned reason codes: ok, elevated_latency, high_latency, sequencer_stall, elevated_revert, high_revert, chain_halted, data_stale, no_data, no_working_nodes (the last three are HTTP 503, not charged). Also returns head_block_tx_count, tx_per_block_recent (mean over the last 10 distinct blocks, needs 3) and tx_sample_n: transactions per block, the chain's own system transactions included. Information only: they do not change the verdict.", "price": "0.01", "currency": "USDC", "intent": [ "is it safe to transact", "chain safety", "pre-flight check", "revert risk" ], "params": { "chain": "base|arbitrum|optimism|zksync|scroll|mantle|linea|blast|mode|taiko|polygon_zkevm|casper" } }, { "path": "/v1/health", "method": "GET", "description": "Health report of the 12 monitored chains: P99 RTT, packet loss (rpc_loss_pct: RPC requests without a valid answer, last ~2 min), stall detection, chain head age, revert ratios, kernel TLS round-trip (kernel_tls_rtt, eBPF, last 60 s; a separate field, not part of the verdict). Per chain also head_block_tx_count, tx_per_block_recent (mean over the last 10 distinct blocks, needs 3) and tx_sample_n: transactions per block, the chain's own system transactions included. Information only: they do not change the verdict. `recommendation` is the most severe state among the chains in service (since this version); `recommendation_all_chains` is the same over all 12; `recommendation_scope` lists the chains counted; `recommendation_by_chain` gives each chain its status, reason and evidence; `out_of_service` lists chains left out (closed: newest block older than 24 h; or no RPC node returned a valid answer for 30 min) with the reason. `chains_in_service` and `chains_total` are the counts.", "price": "0.01", "currency": "USDC", "intent": [ "network health", "sequencer status", "L2 monitoring" ] }, { "path": "/v1/price", "method": "GET", "description": "FREE (no payment): Current surge pricing tier and gas pressure metrics.", "price": "0", "currency": "USDC", "intent": [ "gas price", "surge pricing", "cost check" ] }, { "path": "/v1/correlation", "method": "GET", "description": "Cross-chain Pearson correlation matrix (R_xy) with Frobenius anomaly score. Returns 12\u00d712 correlation matrix and synchronized pairs. Exploratory: not yet validated on real bot-cluster data.", "price": "0.01", "currency": "USDC", "intent": [ "cross-chain correlation", "anomaly detection", "cascade risk", "systemic risk", "experimental" ] }, { "path": "/v1/health-proof", "method": "GET", "description": "HMAC-SHA256 commitment over the node's health assessment and eBPF XDP/LSM status (attached in the kernel, not merely loaded; node.ebpf.lsm_mode counts how many services run in each LSM mode: enforce, enforce_exec, observe; lsm_guard_basis and lsm_links_attached give the evidence). Verifiable only by this node: the key is created in memory at start and changes on restart. Not a zero-knowledge proof and not signed with a published key.", "price": "0.01", "currency": "USDC", "intent": [ "verifiable proof", "health attestation", "HMAC commitment" ] }, { "path": "/v1/demo/safe", "method": "GET", "description": "FREE demo: 100 calls/IP/day. Returns safe=true/false without detailed metrics. Try before you buy.", "price": "0", "currency": "USDC", "intent": [ "free trial", "demo", "test" ] }, { "path": "/v1/classify", "method": "POST", "description": "Caller classification: HUMAN / LEGIT_AGENT / MALICIOUS_BOT / SYBIL / UNKNOWN (no evidence either way). 14-layer analysis: request rhythm (entropy, Spearman correlation), User-Agent and header consistency, wallet and payment evidence. Optional `target` in the JSON body: a User-Agent string to classify instead of your own (only the string is evaluated, confidence at most 0.5).", "price": "0.01", "currency": "USDC" }, { "path": "/v1/preflight", "method": "POST", "description": "Pre-flight decision PASS / DEGRADED / FAIL for one chain with an evidence_id (SHA-256 of the decision inputs). Returns rtt_p99_ms, revert_ratio (null where not measured: all chains except Base and Arbitrum) with revert_data_available, stall_flag, gas_pressure, blob_base_fee.", "price": "0.01", "currency": "USDC" }, { "path": "/v1/classify", "method": "GET", "description": "Same as POST /v1/classify; ?target= classifies that string instead of the caller (only the string is evaluated, confidence at most 0.5). A GET without payment returns 402 with the price.", "price": "0.01", "currency": "USDC" }, { "path": "/v1/preflight", "method": "GET", "description": "Same as POST /v1/preflight; parameters in the query string (?chain=base). A GET without payment returns 402 with the price.", "price": "0.01", "currency": "USDC" }, { "path": "/v1/chains/:chain", "method": "GET", "description": "Per-chain status: P99/P95 RTT, stall flag, revert ratio (Base and Arbitrum), recommendation, out_of_service.", "price": "0.01", "currency": "USDC" }, { "path": "/v1/stream-pass", "method": "GET", "description": "30-day pass to the live WebSocket stream (tier searcher: the full live feed, up to 5 simultaneous sessions). One payment of 30 USDC, scheme exact, Base or Arbitrum One only; the price is fixed (no surge). The answer carries the api_key, shown once (only its hash is stored). The 30 days run from the payment on the chain, not from the activation of the key; the key works within about 60 seconds. Many x402 clients default to a $1 maximum. To buy this pass, raise your client limit to at least $30. The $0.99 day pass (GET /v1/stream-pass-day) fits the default limit. A lost answer can be repeated with the same payment header within 5 minutes (same answer, no second charge): replay is possible only from the paying IP or with the payer wallet signature (header X-Pass-Claim: :<0x signature>, an EIP-191 personal_sign by the paying wallet over 'Phoenix Zero stream pass claim: proof= time=', proof = lowercase hex SHA-256 of the Payment-Signature header value you sent, unix_seconds not older than 5 minutes). When the pass ends the stream sends {\"type\":\"pass_expired\"} and closes the connection. NO REFUNDS. Enterprise keys with other terms: on request by e-mail.", "price": "30", "currency": "USDC", "networks": [ "eip155:8453", "eip155:42161" ], "refunds": "none", "intent": [ "live stream access", "websocket key", "real-time feed" ] }, { "path": "/v1/stream-pass-day", "method": "GET", "description": "1-day pass to the live WebSocket stream (tier searcher: the full live feed, up to 2 simultaneous sessions). One payment of 0.99 USDC, scheme exact, Base or Arbitrum One only; the price is fixed (no surge). The answer carries the api_key, shown once (only its hash is stored). The 1 day (24 hours) runs from the payment on the chain, not from the activation of the key; the key works within about 60 seconds. $0.99 day pass works with default x402 clients (<= $1 per payment); the $30 / 30-day pass needs your client's per-payment limit raised to at least $30. A lost answer can be repeated with the same payment header within 5 minutes (same answer, no second charge): replay is possible only from the paying IP or with the payer wallet signature (header X-Pass-Claim: :<0x signature>, an EIP-191 personal_sign by the paying wallet over 'Phoenix Zero stream pass claim: proof= time=', proof = lowercase hex SHA-256 of the Payment-Signature header value you sent, unix_seconds not older than 5 minutes). When the pass ends the stream sends {\"type\":\"pass_expired\"} and closes the connection. NO REFUNDS.", "price": "0.99", "currency": "USDC", "networks": [ "eip155:8453", "eip155:42161" ], "refunds": "none", "intent": [ "live stream access", "websocket key", "real-time feed", "day pass" ] } ], "stream": { "protocol": "websocket", "url": "wss://rtt.phoenix-ai.work/ws", "auth": "first message after connecting: {\"api_key\": \"\"}, or {} for the keyless feed; the answer is AUTH_OK with your tier and delay_s", "free": { "tier": "public", "delay_s": 300, "note": "keyless feed, delayed, without kernel-RTT records" }, "live_tiers": [ "enterprise", "professional", "searcher" ], "max_sessions_per_key": 5, "live_tiers_access": "searcher: buy a 30-day pass, GET /v1/stream-pass (30 USDC once, 5 sessions), or a 1-day pass, GET /v1/stream-pass-day (0.99 USDC once, 2 sessions); x402 exact, Base or Arbitrum One, no refunds; professional and enterprise: on request (contact above)", "pass": { "path": "/v1/stream-pass", "price": "30", "currency": "USDC", "days": 30, "term_starts": "at the payment on the chain (block time), not at the activation of the key", "usable_within_s": 60, "max_sessions": 5, "at_expiry": "the stream sends {\"type\":\"pass_expired\"} and closes the connection", "refunds": "none", "client_limit": "Many x402 clients default to a $1 maximum. To buy the $30 pass, raise your client limit to at least $30.", "lost_answer": "repeat the same request with the same payment header within 5 minutes; replay is possible only from the paying IP or with the payer wallet signature", "claim_header": "X-Pass-Claim: :<0x signature>", "claim_message": "Phoenix Zero stream pass claim: proof= time=", "claim_proof": "lowercase hex SHA-256 of the Payment-Signature header value you sent", "claim_signature": "EIP-191 personal_sign by the paying wallet; unix_seconds not older than 5 minutes" }, "day_pass": { "path": "/v1/stream-pass-day", "price": "0.99", "currency": "USDC", "days": 1, "term_starts": "at the payment on the chain (block time), not at the activation of the key", "usable_within_s": 60, "max_sessions": 2, "at_expiry": "the stream sends {\"type\":\"pass_expired\"} and closes the connection", "refunds": "none", "client_limit": "$0.99 day pass works with default x402 clients (<= $1 per payment); the $30 / 30-day pass needs your client's per-payment limit raised to at least $30." }, "payment": "the stream is not sold per call; the per-call x402 prices in this file cover the REST API. Live access is a 30-day pass (GET /v1/stream-pass, 30 USDC) or a 1-day pass (GET /v1/stream-pass-day, 0.99 USDC). A payer's wallet address is not a credential for the live feed." }, "chains_monitored": [ "base", "arbitrum", "optimism", "zksync", "scroll", "mantle", "linea", "blast", "mode", "taiko", "polygon_zkevm", "casper" ], "identity": { "method": "Silicon DNA 14-layer behavioral classification", "paper": "https://doi.org/10.5281/zenodo.22239862", "layers": [ "L0 PQC session (ML-KEM-768)", "L1 Browser/GPU user-agent consistency", "L2 Header forgery score (Frankenstein)", "L3 Request-timing Spearman rho", "L4 Request-timing variance (CV)", "L5 Argon2id proof-of-work", "L6 Request-timing Shannon entropy", "L7 Timing verdict (human/agent-like)", "L8 TLS fingerprint risk (needs a TLS front; inactive behind Cloudflare)", "L9 Request rate (last 60 s)", "L10 Sybil cohort flag", "L11 Header richness", "L12 Edge geo header present", "L13 Session continuity" ], "enforcement": "eBPF XDP drops packets of banned IPs in the kernel. Linux BPF LSM guard: execve is denied for the x402 gateway's service (child processes included, except the one start of the service by systemd) and for the on-chain publisher's own process (guard by process ID; a child process is not covered), and the publisher's outgoing IPv4/IPv6 connections may go only to ports 53, 443, 7777 and 8545; the gateway's network connections are recorded, not restricted; other services are not under this guard; the file-open hook does not restrict file access. Limits: this does not stop malicious code loaded inside the same process, and there is no guarantee if root is compromised (software self-protection on a virtual machine, not hardware attestation). x402 limit of 10 calls / 60 s per wallet" }, "security": { "response_signing": { "algorithm": "secp256k1-personal_sign(sha256(response_json))", "public_key_endpoint": "/v1/signing-key" }, "security_txt": "/.well-known/security.txt", "ebpf_isolation": "No probe reads packet payloads. The TLS round-trip probe reports timestamps, round-trip time, process and thread ids, a TLS object pointer, an event type (round trip or TCP retransmit) and a chain label. The process and network sensor reports process and thread ids, process name, executed file name, destination port and a keyed HMAC-SHA256 hash of the destination IP address of outgoing connections: the raw address reaches the sensor process in user space and is hashed there, not in the kernel. The XDP filter compares source addresses with the ban list in the kernel and exports no packet data." } }