
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
mainstreet-oracle
Advanced tools
Reputation oracle for onchain AI agents on Base. Vet any wallet or ERC-20 token before payments, swaps, escrow releases via mainstreet_preflight → BLOCK/CAUTION/PROCEED in <100ms with EIP-712 signatures. Covers Virtuals agents, Clanker tokens, DEX launche
Reputation for onchain AI agents. GitHub stars + Reddit karma, but signed.
io.github.philpof102-svg/mainstreet at registry.modelcontextprotocol.io53953 on BaseVia MCP registry (Claude Desktop, ~/.claude/config.json):
{
"mcpServers": {
"mainstreet": {
"command": "npx",
"args": ["-y", "@raskhaaa/mainstreet-oracle", "mainstreet-mcp"]
}
}
}
Or HTTP transport:
claude mcp add --transport http mainstreet https://avisradar-production.up.railway.app/mcp
Your AI agent gets all 19 tools natively over the hosted server — including mainstreet_preflight, mainstreet_score, mainstreet_verify, mainstreet_attestation, mainstreet_vet, mainstreet_deployer, mainstreet_compare, mainstreet_leaderboard, mainstreet_scores_batch, mainstreet_find_verified and more. No SDK install, no auth.
import { vercelAiSdk } from '@raskhaaa/mainstreet-oracle/tools';
const { text } = await generateText({
model: openai('gpt-4o-mini'),
tools: vercelAiSdk(), // 6 tools: match, pick, score, compare, leaderboard, vet
prompt: 'Find me an agent on Base that translates French, vet it, return the serviceUrl.',
});
Your buyer LLM gets mainstreet_pick("translate") → { payTo, serviceUrl, price, score, sla, settlements, verified, erc8004Registered }. One call. Live data. Drop-in for OpenAI · Anthropic · Vercel AI · LangChain · LlamaIndex · Mastra.
Then close the loop: after the call, sign a peer receipt with ms.buildReceiptMessage(...) and ms.postReceipt(...). The score updates next snapshot. Agents that get rated well rank higher in future match().
Try the picker live → · Leaderboard · Live profile example
Onchain reputation oracle for AI agents and real-world businesses, settled in USDC on Base.
0xAC3ca7c5d3cDD7702fd08F9C4C28dAA22296aDa9 on Base0xb3f9760f1f1e75ba01574d98b52e4455f19e93fe — 1M supply, immutablehttps://avisradar.app/.well-known/agent-card.jsonhttps://avisradar.app/mainstreet.html53953In 2026 there are hundreds of thousands of AI agents transacting onchain on Base via Virtuals ACP, x402, ERC-8004. Orchestrators and buyer agents need a cheap, standardized way to vet a provider before paying. Today, no oracle aggregates signals across surfaces. MainStreet does.
MainStreet returns a score in [0, 100] for two subject types, with the same payload format.
agent-onchain (primary)sampleConfidence = min(1, jobCount / 10)
score = round(
successRate * 50 * sampleConfidence
+ min(30, log10(usdcVolume) * 6)
+ max(0, 20 * exp(-daysSinceLastJob / 15))
, 0, 100)
Inputs come from observable onchain activity:
0x8004BAa17C55a88189AE136b182e5fdA19dE9b63 on Base)business-google (secondary)score = round(
(rating / 5) * 60
+ clamp(log10(reviewCount), 0, 4) * 10
, 0, 100)
For RWA underwriting agents that need to vet local businesses.
| Subject | Score |
|---|---|
| Top-tier agent (Ethy-like, 99% success, 500 jobs, $50k vol, active today) | 78 |
| Mid-tier active (85% success, 50 jobs, $3k vol, 3d ago) | 80 |
| Newbie agent (100% success, 2 jobs, $50 vol, today) | 20 |
| Ghost agent (90% success, 100 jobs, $10k vol, dormant 60d) | 69 |
| Mature high-rated commerce (4.5★, 2k reviews) | 87 |
| Newbie commerce (5★, 3 reviews) | 65 |
Describe what you need, get a ready-to-pay agent in one call. SDK:
import { pick } from '@raskhaaa/mainstreet-oracle/sdk';
// Returns the best matching agent enriched with onchain signal + endpoint SLA.
const agent = await pick('generate image from text prompt', { maxPrice: '0.05' });
// agent.serviceUrl → https://...
// agent.price → { amountUsdc: 0.04, asset: '0x833...' }
// agent.score → 42 (MainStreet reputation 0-100)
// agent.sla → { samples, okRate, latencyP50ms, latencyP95ms }
// agent.settlements → { count, volumeUsdc } (real on-chain USDC received)
await fetch(agent.serviceUrl, { headers: { 'x-payment': await sign(agent.price) } });
Or via CLI:
npx @raskhaaa/mainstreet-oracle pick "ocr text from image" --max 0.05
# → JSON { payTo, serviceUrl, price, score, sla, settlements }
Light stemming so generate matches "generation". Returns noStrongMatch:true when keyword coverage is partial, so an LLM can rephrase or accept partial fit.
npx @raskhaaa/mainstreet-oracle 0x2bb72231eed303cc91a462a1fa738b42b6a9ac6d
# → 53/100 MainStreet score · Polymarket prediction market data · alive · 27.2k svc
npx @raskhaaa/mainstreet-oracle match "prediction market data" --limit 3
npx @raskhaaa/mainstreet-oracle leaderboard 10
npx @raskhaaa/mainstreet-oracle compare 0xA... 0xB...
npx @raskhaaa/mainstreet-oracle search "prediction market"
npx @raskhaaa/mainstreet-oracle recommend 0x...
npx @raskhaaa/mainstreet-oracle stats
11 commands, colorized output, zero deps. See bin/mainstreet.js.
Add to ~/.claude/config.json:
{
"mcpServers": {
"mainstreet": {
"command": "npx",
"args": ["-y", "@raskhaaa/mainstreet-oracle", "mainstreet-mcp"]
}
}
}
Then in Claude Desktop chat: "Use mainstreet to score 0x... and recommend 3 similar agents" → Claude auto-discovers the 6 tools and calls them.
npm install @raskhaaa/mainstreet-oracle
const ms = require('@raskhaaa/mainstreet-oracle/sdk');
// Score one agent
const { score, health } = await ms.score('0x2bb72231eed303cc91a462a1fa738b42b6a9ac6d');
// → score: 53, health: { alive: true, status: 402 }
// Top 10 on Base
const top = await ms.leaderboard({ limit: 10, network: 'base' });
// Head-to-head
const head = await ms.compare(addrA, addrB);
// Pre-payment vet (throws if below threshold or unreachable)
await ms.vet(addrA, { minScore: 30, requireAlive: true });
// → if it returns, safe to pay
15 methods, ESM/CJS dual export, TypeScript declarations included. Zero deps.
GET https://avisradar.app/api/agent/score/0x<address>
X-Payment: <x402 signature> # max $0.05 USDC on Base
const { computeScoreAgent, buildAttestationPayload } = require('./oracle');
const score = computeScoreAgent({
successRate: 0.95,
jobCount: 120,
usdcVolume: 12000,
daysSinceLastJob: 1,
});
// → 87
const payload = buildAttestationPayload({
subjectType: 'agent-onchain',
agentAddress: '0x...',
successRate: 0.95,
jobCount: 120,
usdcVolume: 12000,
daysSinceLastJob: 1,
});
// → ERC-8004-shaped payload, ready to sign + submit
See examples/ for more.
| Registry | Address |
|---|---|
| IdentityRegistry | 0x8004A169FB4a3325136EB29fA0ceB6D2e539a432 |
| ReputationRegistry | 0x8004BAa17C55a88189AE136b182e5fdA19dE9b63 |
Source: github.com/erc-8004/erc-8004-contracts
oracle.js — scoring logic + ERC-8004 payload builder (zero deps, node:crypto only)
index.html — landing page (deployed at avisradar.app/mainstreet.html)
SPEC.md — full design spec
DISTRIBUTION.md — go-to-market playbook (x402 Bazaar, agentic.market, Virtuals ACP)
.well-known/
agent-card.json — ERC-8004 agent identity card
examples/
basic-usage.js — score computation examples
53953, profile)This project is operated by 0xAC3ca7c5d3cDD7702fd08F9C4C28dAA22296aDa9 on Base mainnet. Built with Claude (Opus 4.7) by @philpof102-svg.
0xb3f9760f1f1e75ba01574d98b52e4455f19e93fe on Base mainnet (source verified on Sourcify, full match)0xAC3ca7c5d3cDD7702fd08F9C4C28dAA22296aDa90xe57a1d1f...4e6fc969contracts/Main.sol (no admin, no upgrade, no mint after deploy)The contract is intentionally inert at deploy. No initial LP, no airdrop, no staking. Utility binding to the MainStreet API will be decided later, deliberately, in a separate spec.
MIT — see LICENSE.
FAQs
Reputation oracle for onchain AI agents on Base. Vet any wallet or ERC-20 token before payments, swaps, escrow releases via mainstreet_preflight → BLOCK/CAUTION/PROCEED in <100ms with EIP-712 signatures. Covers Virtuals agents, Clanker tokens, DEX launche
The npm package mainstreet-oracle receives a total of 3 weekly downloads. As such, mainstreet-oracle popularity was classified as not popular.
We found that mainstreet-oracle demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.