SDK & MCP

traceCall

Simulates AgentFirewall.execute (an off-policy call throws FIREWALL_REJECTED with the contract's error and nothing is sent), sends the transaction, reads AgentAction from the receipt, then asks AgentTrace to verify and anchor the proof.

import { encodeFunctionData, parseAbi } from "viem";
import { traceCall } from "agenttrace-monad";

const result = await traceCall({
  network: "monad-testnet",
  signer: process.env.AGENT_KEY,   // the firewall's executor: hex key or viem Account
  firewallId: 2,
  target: "0x1664be58ee54af91c756428f466bad6e4f9911c3",
  data: encodeFunctionData({
    abi: parseAbi(["function deposit(uint256 agentId, uint256 amount)"]),
    functionName: "deposit",
    args: [2n, 25n],
  }),
});
// { txHash, executionId, agentId, proofStatus, proofHash, anchorTxHash, proofUrl, explorerUrl }

Also exported: the typed AgentTrace client for the HTTP API (endpoints).

MCP firewall server

agents/mcp-firewall/server.ts is a stdio MCP server. Every write goes through traceCall, so the host model cannot leave the onchain policy. Without AGENT_KEY it still answers agenttrace_policy and refuses to sign.

{ "mcpServers": { "agenttrace": {
  "command": "npx",
  "args": ["-y", "tsx", "/absolute/path/to/AgentTrace/agents/mcp-firewall/server.ts"],
  "env": {
    "NETWORK": "monad-testnet", "AGENT_ID": "2", "FIREWALL_ID": "2",
    "AGENT_KEY": "<executor key>"
  }
} } }

agenttrace_policy

Reads the agent's firewall: targets, functions, value limits

demo_deposit

DemoProtocol.deposit through the firewall; returns the verified proof

demo_withdraw

DemoProtocol.withdraw through the firewall

call_contract

Any target + calldata; rejected unless the firewall allows target and selector