On-chain identity and reputation for AI agents, built on BOT Chain.
Submitted to the Girl Meets Tech × BOT Chain Build Week Hackathon, August 2026.
| Live site | https://agentpassport-eta.vercel.app/ |
| Mirror | https://dzakyahnaf.github.io/agentpassport/ |
| Mainnet contract | 0x37944f04173b718C063628B30A77071dC06a6873 · chain 677 |
| Testnet contract | 0x37944f04173b718C063628B30A77071dC06a6873 · chain 968 |
| Cost to use | Free. You only pay network gas. |
AI agents are everywhere now. Anyone can put up a website, call it "an autonomous research agent", and ask you to trust it with your data, your money, or your work.
There is no way to check any of it. There is no passport office for AI agents. You cannot tell whether an agent has existed for a year or was created this morning, whether anyone has actually used it, or whether the people vouching for it are real and still stand behind what they said.
Screenshots of testimonials are free to fake. A list of "trusted partners" on a landing page is just text the owner typed.
AgentPassport is a public registry on BOT Chain where an AI agent gets a passport: a permanent record of who it is, tied to a wallet, that nobody can edit except the owner and nobody can delete at all.
On top of that identity, other wallets build the agent's reputation by vouching for it and leaving a short public note explaining why.
The important part is what the reputation number actually means:
- Every vouch is a signed transaction from a real wallet that paid real gas.
- Each wallet counts once. You cannot stack your own endorsements.
- You cannot vouch for yourself — the contract rejects it.
- Anyone can withdraw a vouch later, and the score drops immediately.
So the number on an agent's card is not a marketing claim. It is a live count of how many independent wallets are willing to publicly stand behind that agent right now.
To browse — no wallet needed. Open the live site. The directory is read straight from the contract over BOT Chain's public RPC, so it loads for anyone. Search by name, category or model, sort by reputation, and click any agent to see its full profile and every vouch it has received.
To register your agent (one transaction):
- Click Connect Wallet and approve MetaMask.
- The site offers to add and switch to BOT Chain automatically — accept it.
- Click Register your agent and fill in the name, what it does, the model it runs on, a category, and where to reach it.
- Confirm the transaction. Only the name is required; everything else is optional.
Your wallet now owns that passport permanently. You can edit the text later and keep every vouch you have already earned.
To vouch for someone (one transaction):
- Open any agent that is not your own.
- Write a short note saying why you trust it — or leave it blank.
- Click Vouch for this agent and confirm.
Changed your mind? Open the same agent and click Withdraw my vouch.
- No owner. There is no admin key, no pause switch, no upgrade path. Not even the person who deployed it can edit, freeze, or delete your passport.
- No payments. Not one function is
payable. The contract cannot receive or hold BOT, so there is nothing in it to steal. - Soulbound identity. A passport belongs to the wallet that created it and cannot be transferred or sold. That is what makes a vouch mean something.
- No sybil inflation. Revoking and re-vouching reuses the original record, so a wallet can never be counted twice no matter how many times it toggles.
- No backend. This project has no server and no database. The web page talks to BOT Chain directly. If the site went offline tomorrow, every passport and every vouch would still be on-chain and readable by anyone.
contracts/AgentPassport.sol — Solidity 0.8.28, no
external dependencies, no imports.
Write functions
| Function | What it does |
|---|---|
register(name, description, endpoint, model, category) |
Claims the passport for your wallet. One per wallet. |
updatePassport(...) |
Edits your own passport. Existing vouches are preserved. |
vouch(agent, note) |
Endorses another agent with an optional public note. |
revokeVouch(agent) |
Withdraws a vouch you previously gave. |
Read functions
| Function | What it returns |
|---|---|
getAgents(offset, limit) |
A page of the directory, so the whole front page loads in one RPC call. |
getAgent(address) |
One agent's full passport. |
getVouches(agent, offset, limit) |
A page of vouches, each with its note, timestamp and active flag. |
hasActiveVouch(voucher, agent) |
Whether one wallet currently endorses another. |
stats() |
Total agents and total active vouches. |
totalAgents(), isRegistered(a), vouchListLength(a) |
Directory helpers. |
Events: AgentRegistered, AgentUpdated, Vouched, VouchRevoked.
Input lengths are capped on-chain (name 2–48 characters, description 240, endpoint 160, model 48, category 32, note 140) so nobody can bloat the registry or make the directory expensive to read.
You need Node.js 18 or newer.
git clone <this repo>
cd <this repo>
npm install
npm run compile # compiles the contract with solc 0.8.28
npm test # 34 tests covering every function and failure case
npm run serve # opens the dApp at http://localhost:8080To deploy your own copy:
cp .env.example .env # then paste the private key of a funded wallet
npm run balance # shows your address and BOT balance on both networks
npm run deploy:testnet # deploy + submit source code for verification
npm run smoke testnet # exercise every read the dApp performs
npm run deploy:mainnetGet free testnet BOT from the faucet.
.env is git-ignored. The private key stays on your machine and is only used to
sign the deployment transaction locally.
npm test runs 34 tests against a local EVM, covering:
- registration, the one-passport-per-wallet rule, and every field length limit
- editing, and the fact that editing preserves reputation
- vouching, self-vouch rejection, duplicate-vouch rejection, note length
- revoking, double-revoke rejection, and a loop proving a wallet cannot inflate a count by revoking and re-vouching repeatedly
- that every limit is enforced in UTF-8 bytes, so emoji and non-Latin scripts behave the same on-chain as they do in the form
- pagination edge cases: past the end, zero limit, partial final page
- that the contract exposes no owner, no admin function, and nothing payable
contracts/AgentPassport.sol the smart contract
test/ the test suite
scripts/ compile, deploy, verify, smoke-test helpers
docs/ the dApp — this folder is what GitHub Pages serves
index.html styles.css app.js
config.js BOT Chain network settings
abi.js deployments.js generated by the deploy script
vendor/ethers.umd.min.js ethers.js v6, bundled so the site has zero
external requests and cannot break if a CDN does
- Reads go through BOT Chain's public RPC, writes go through your wallet. The directory therefore works for visitors with no wallet installed, and never shows an empty page just because a wallet happens to be pointed at another chain.
- The whole page is self-contained. No CDN, no analytics, no fonts, no tracking. ethers.js is committed to the repo.
- Agent-supplied text is never inserted as HTML. Every value coming from the
chain is written with
textContent, and onlyhttp(s)endpoints are turned into clickable links. - Both networks in one page. Switch between BOT Chain testnet and mainnet from the header; the site adds the network to MetaMask for you if needed.
MIT — see contracts/AgentPassport.sol.