trenchcoat
Free · no sign-up
Website report · 12 min ago

www.agentwormhole.com

“Agent Wormhole — security for AI agents that spend money”

Template-written 28 evidence items Code reader analysed 15 scripts
What this means for you

Agent Wormhole only talked to its own servers while we watched.E1

  • An AI agent used the site and saw 0 of 4 claimed features working.E24E26E28E25E27
  • AI / agents: The site describes local agent-security tools (the wormhole-guard Python CLI and the wormhole-x402 npm guard) and serves an llms.txt with a full description. There is no in-browser demo or chat, and the tools need to be installed and run on a machine, so I couldn't watch them work.E24E26E28
  • On-chain / smart contracts: The /x402 page explains the per-scan USDC payment flow and the guard's allow/refuse rules on Base and Solana, and gives npm install commands. Paying for a scan needs a wallet and USDC, so I couldn't try it in the browser.E25
  • Live data / analytics: The homepage shows burn and buyback figures (43,973,817 $WORM burned, $18,365.33 spent on buybacks, 16 buybacks in 7 days). Each entry links to a Robinhood Chain blockscout transaction. The figures were already in the page when it loaded and the page made no network calls, so I didn't see the data update live.E24
  • Tech check: the site claims on-chain / smart contracts, live data / analytics and a working app / platform, and its public page shows matching evidence.E20E21E18E10E11
  • Tech check: the site mentions ai / agents, but we found nothing behind it in what its public page loads.E19
  • We saw no known analytics or advertising services load on the first visit.E1

Tech check

What the site says about itself, next to what its public page actually loads. Facts only, no verdict: you decide.

Nothing found on the public page

AI / agents

“…M buybacks and burns. Dashboard Docs agentwormhole.com/llms.txtcopy Your agents talk. Mind what they pass on AI ag…”E19

No matching code, calls or services in what loaded for us.

Evidence found

On-chain / smart contracts

“…-attestation in one round trip, before anything exists on-chain. Pay per scan in USDC via x402, on Base or Solana. No…”E20

Blockchains named in its code: Robinhood ChainE18

Evidence found

Live data / analytics

“…ted. These fees are used for $WORM buybacks and burns. Dashboard Docs agentwormhole.com/llms.txtcopy Your agents talk.…”E21

Calls to its own backend: /api/burn, /api/burn/historyE10E11

Evidence found

A working app / platform

“…~/.wormhole on your machine. The hosted dashboard and API are a separate, opt-in layer: they exist only if you s…”E22

Calls to its own backend: /api/burn, /api/burn/historyE10E11

Wallet code: viemE7

Calls its own backend /api/burn, /api/burn/historyE10E11
Wallet code viemE7
Contract calls in its code none seen
Talks to AI services none seen
Live connections none seen

The real tech may live elsewhere. This page links to: github.com/runningoffcode/agent-wormhole · check the code

What the AI agent tried

An AI agent (claude-opus-5-5) used the site in our sandbox for 5 steps and saw 0 of 4 claimed features working. It can't connect a wallet, pay, sign or log in, so those features count as "couldn't test". What it reports is what it observed, not a verdict.

Couldn't test

AI / agents

The site describes local agent-security tools (the wormhole-guard Python CLI and the wormhole-x402 npm guard) and serves an llms.txt with a full description. There is no in-browser demo or chat, and the tools need to be installed and run on a machine, so I couldn't watch them work.E24E26E28

Couldn't test

On-chain / smart contracts

The /x402 page explains the per-scan USDC payment flow and the guard's allow/refuse rules on Base and Solana, and gives npm install commands. Paying for a scan needs a wallet and USDC, so I couldn't try it in the browser.E25

Not seen working

Live data / analytics

The homepage shows burn and buyback figures (43,973,817 $WORM burned, $18,365.33 spent on buybacks, 16 buybacks in 7 days). Each entry links to a Robinhood Chain blockscout transaction. The figures were already in the page when it loaded and the page made no network calls, so I didn't see the data update live.E24

Couldn't test

A working app / platform

The Dashboard link goes to dashboard.agentwormhole.com/login, where the only option is 'Continue with GitHub', so the console requires a login. The docs page loads and lists the CLI commands and the hosted-API sections.E27E28

Also noticed

Things the agent saw along the way that aren't among the site's claims. Not counted above.

Noticed

Open-source packages linked

The site links a GitHub repo (runningoffcode/agent-wormhole), the PyPI package wormhole-guard and the npm package wormhole-x402. llms.txt describes the tools as Apache 2.0, 100% local and without telemetry.E24E26

What it is

  • The Internet Archive first saved this site on 2026-10-08 (33 days ago).E23
  • The site describes itself as: “Security for AI agents that spend money. Agent Wormhole verifies a payment against its quote before it is signed, scans the text an agent re”E2
  • It's built with React and Next.js (common tools for building web apps).E5E6
  • In your browser it runs compiled WebAssembly code in your browser.E8
  • It has sections such as /x402, /cases, /research, /docs, /contact and /llms.txt.E14E15
  • While loading, it called 2 endpoints on its own servers, such as /api/burn and /api/burn/history.E10E11

Where your data goes

On a first visit the page only talked to its own servers (www.agentwormhole.com).

Crypto and wallets

  • Wallet tools in the code: viem.E7
  • Chains named in the code: Robinhood Chain.E18
  • 2 contract or wallet addresses are written into the code.E16E17
2 addresses found in the code
0x3ba500f1ababbcf0f0247d06d1c56fd7e6c4c09d0x000000000000000000000000000000000000dead

Paste any of these into the box on the home page to get the contract's report.

How key features work

Connecting your wallet

It connects to crypto wallets using viem. Connecting shows the site your wallet address; it doesn't move funds by itself.E7

viem

Reading the blockchain

It reads blockchain data (Robinhood Chain) to show balances, prices or contract state.E18

Robinhood Chain

Loading its content

Its content loads from its own API while you browse (/api/burn and /api/burn/history).E10E11

/api/burn/api/burn/history

Drawing and editing in the browser

The page draws and edits graphics in your browser using WebAssembly and the canvas.E8E9

webassemblycanvas

Pages and API calls

Pages it links to

//x402/cases/research/docs/contact/llms.txt/privacy/terms/_next/image

Endpoints

Called while loading (seen) or named in the code (code).

www.agentwormhole.com/api/burnseenE10
www.agentwormhole.com/api/burn/historyseenE11
/api/burn/historycodeE12
/api/burncodeE13

Evidence

Every sentence above points to one of these. Code references show the file, line:column and the short identifier that matched, never the site's code itself.

E1
Page title: Agent Wormhole — security for AI agents that spend money
page title · https://www.agentwormhole.com/
E2
Page description: Security for AI agents that spend money. Agent Wormhole verifies a payment against its quote before it is signed, scans the text an agent reads for in
page description · https://www.agentwormhole.com/
E3
Site name: Agent Wormhole
page site_name · https://www.agentwormhole.com/
E4
30 request(s) to www.agentwormhole.com
types: 12 image, 8 script, 3 font
GET https://www.agentwormhole.com/ · image · 30 requests · network recording
E5
React detected by the code reader (react-runtime)
confidence: medium
www.agentwormhole.com/_next/static/chunks/453pof2vctwbe.js · “react-runtime” · the code reader
E6
Next.js detected by the code reader (next-runtime)
confidence: high
www.agentwormhole.com/_next/static/chunks/1y_r1zly1708p.js · “next-runtime” · the code reader
E7
viem found in the code
www.agentwormhole.com/_next/static/chunks/1y_r1zly1708p.js @ 38:171 · “viem” · pattern scan
E8
Uses the browser ability: webassembly
runs compiled WebAssembly code in your browser
www.agentwormhole.com/_next/static/chunks/turbopack-3cgtxutfl_k-9.js @ 1:10349 · “WebAssembly.instantiateStreaming(” · pattern scan
E9
Uses the browser ability: canvas
draws graphics on a canvas
www.agentwormhole.com/_next/static/chunks/1y_r1zly1708p.js @ 1:321 · “getContext("2d"” · pattern scan
E10
The page called /api/burn on www.agentwormhole.com (GET)
GET https://www.agentwormhole.com/api/burn · fetch · network recording
E11
The page called /api/burn/history on www.agentwormhole.com (GET)
GET https://www.agentwormhole.com/api/burn/history · fetch · network recording
E12
Code reader found the endpoint /api/burn/history
how: call:fetch
www.agentwormhole.com/_next/static/chunks/1y_r1zly1708p.js @ 3:132155 · “/api/burn/history” · the code reader
E13
Code reader found the endpoint /api/burn
how: call:fetch
www.agentwormhole.com/_next/static/chunks/1y_r1zly1708p.js @ 3:136200 · “/api/burn” · the code reader
E14
11 links to pages on the same site
page links · https://www.agentwormhole.com/ · /, /x402, /cases, /research, /docs, /contact, /llms.txt, /privacy, /terms
E15
Code reader found the route /_next/image
www.agentwormhole.com/_next/static/chunks/1y_r1zly1708p.js @ 1:3734 · “/_next/image” · the code reader
E16
Address in code: 0x3ba500f1ababbcf0f0247d06d1c56fd7e6c4c09d
www.agentwormhole.com/ (page HTML) @ 1:66298 · “0x3ba500f1ababbcf0f0247d06d1c56fd7e6c4c09d” · pattern scan
E17
Address in code: 0x000000000000000000000000000000000000dead
www.agentwormhole.com/_next/static/chunks/1y_r1zly1708p.js @ 3:137157 · “0x000000000000000000000000000000000000dead” · pattern scan
E18
Chain in code: Robinhood Chain
www.agentwormhole.com/_next/static/chunks/1y_r1zly1708p.js @ 3:135386 · “chain.robinhood.com” · pattern scan
E19
The site says: “…M buybacks and burns. Dashboard Docs agentwormhole.com/llms.txtcopy Your agents talk. Mind what they pass on AI ag…”
page text · https://www.agentwormhole.com/ · …M buybacks and burns. Dashboard Docs agentwormhole.com/llms.txtcopy Your agents talk. Mind what they pass on AI ag…
E20
The site says: “…-attestation in one round trip, before anything exists on-chain. Pay per scan in USDC via x402, on Base or Solana. No…”
page text · https://www.agentwormhole.com/ · …-attestation in one round trip, before anything exists on-chain. Pay per scan in USDC via x402, on Base or Solana. No…
E21
The site says: “…ted. These fees are used for $WORM buybacks and burns. Dashboard Docs agentwormhole.com/llms.txtcopy Your agents talk.…”
page text · https://www.agentwormhole.com/ · …ted. These fees are used for $WORM buybacks and burns. Dashboard Docs agentwormhole.com/llms.txtcopy Your agents talk.…
E22
The site says: “…~/.wormhole on your machine. The hosted dashboard and API are a separate, opt-in layer: they exist only if you s…”
page text · https://www.agentwormhole.com/ · …~/.wormhole on your machine. The hosted dashboard and API are a separate, opt-in layer: they exist only if you s…
E23
The Internet Archive first saved agentwormhole.com on 2026-10-08 and has snapshots from 6 different days
page web archive · https://web.archive.org/web/20261008013650/agentwormhole.com
E24
Agent step 1: view
AI agent step 1 · view on /
E25
Agent step 2: go /x402
AI agent step 2 · go on /x402
E26
Agent step 3: go /llms.txt
AI agent step 3 · go on /llms.txt
E27
Agent step 4: go /
AI agent step 4 · go on /login
E28
Agent step 5: go /docs
AI agent step 5 · go on /docs

Limits

  • We only see what your browser sees: code and requests on a first visit, without logging in or accepting cookie banners. What the servers do with data is invisible from outside.
  • Site code is usually minified (compressed), so names are partly lost and some code may be only partly analysed.
  • Some trackers only load after you accept cookies or log in, so the real list can be longer.
  • We visited from a server in the United States. Sites load different trackers and cookie banners in different countries (visitors in the EU usually get a consent banner first).
  • The tech check compares the site's own words with what its public page loads. Work done on servers, in private code or in separate apps isn't visible here, so 'nothing found' means not visible on the public page, not that it doesn't exist.
  • This text was written from fixed templates because no AI writer was available. It uses exactly the same evidence.
  • The code reader hit its size budget on parts of 5 large bundle file(s); those parts weren't fully analysed.

Facts, not judgements: this page describes what the code and traffic show, not anyone's intent. Not financial advice. Case id yrDQn6Lp.