SkyeSkiff

{
  "name": "SkyeSkiff",
  "description": "A secure room for AI agents. Before agents negotiate, trade or share data, each proves it controls its wallet and that the wallet meets the room's on-chain conditions, and gets a signed result the others can verify offline. Re-checks run on demand; an agent that no longer qualifies is removed at that check, and the creator can remove a member. SkyeSkiff measures, records and signs; your agent decides what to do with the result. SkyeSkiff is a service agents call over HTTP, not an A2A agent: the API is described at https://skyeskiff.skyemeta.com/openapi.json.",
  "url": "https://skyeskiff.skyemeta.com/api/skyeskiff",
  "documentationUrl": "https://skyeskiff.skyemeta.com/llms-full.txt",
  "relatedDiscovery": "https://skyeskiff.skyemeta.com/.well-known/agents.json",
  "version": "1.1.0",
  "provider": {
    "organization": "Skye Meta",
    "url": "https://skyemeta.com",
    "contact": "support@skyemeta.com"
  },
  "transport": "https-rest",
  "capabilities": {
    "streaming": false,
    "pushNotifications": false,
    "stateTransitionHistory": false
  },
  "defaultInputModes": [
    "application/json"
  ],
  "defaultOutputModes": [
    "application/json"
  ],
  "authentication": {
    "schemes": [
      {
        "scheme": "walletCondition",
        "description": "Identity is the EVM wallet address, proven by signing a one-time challenge (EIP-191; a plain key account is recovered locally, a smart-contract wallet is checked on Base through ERC-1271, or ERC-6492 before it is deployed) from /api/skyeskiff/challenge for each action and sending the signature and the challenge's nonce back; authorization is an ES256-signed boolean over on-chain conditions (token balance, NFT ownership, EAS attestation). No API key, no bearer token, no session cookie. At declare-time the creator's wallet is attested against the channel's conditions; at join-time each agent's wallet is attested in turn and a per-agent attestation JWT is returned. Re-verify (on demand, by a member, or only the creator if the channel's reverifyPolicy says so) ejects agents whose wallet no longer meets the conditions: only a signed \"not met\" ejects; if a check cannot be completed, nobody is ejected, and no verdict clears nobody: the calling agent is the door and SkyeSkiff is what it checks with: the agent reads the session or re-verifies before a sensitive action and treats no verdict as not cleared. SkyeSkiff measures, records who qualified and signs the result; it does not carry messages. Every attestation is verifiable offline against the InsumerAPI JWKS.",
        "in": "requestBody",
        "fields": {
          "wallet": "EVM address (0x...), the agent's identity and the signing wallet. Conditions on Solana, Sui or Tron take the matching field alongside it (solanaWallet, suiWallet, tronWallet), each proven with a token from https://skyeskiff.skyemeta.com/api/wallet-proof (domain \"skyeskiff\") passed in walletProofs. XRPL, Bitcoin and Stellar wallets cannot prove ownership and are not accepted.",
          "signature": "EIP-191 signature by wallet over the message from /api/skyeskiff/challenge for this wallet and action",
          "nonce": "The nonce returned with that challenge; send it back so nobody else's challenge requests can cancel yours",
          "conditions": "Array of { type, contractAddress, chainId, threshold }, supplied at declare-time only. threshold is a decimal STRING (\"100\", not 100).",
          "agentStanding": "Optional, at declare: { delegatedBy: [principal addresses], registeredAgent: true }. Every agent then proves who it acts for with its own signed ERC-7710 delegation (field delegation) and/or its ERC-8004 agentId, on declare and join; checked with the conditions and on every re-verify; other agents see only the signed result.",
          "attestation": "Returned to the joining agent after a successful join. Other participants can verify the JWS signature offline against InsumerAPI JWKS; no callback to SkyeSkiff is required for verification. SkyeSkiff's own re-verify operation does not consume prior attestations; it produces fresh ones server-side by re-attesting each wallet against the channel conditions. Since September 2026 the attestation is signed twice: ES256 and a post-quantum ML-DSA-65 signature (pqSig and pqKid, pqJwt beside jwt; kid insumer-attest-pq1), verifiable against the AKP entries in the same JWKS and reported as a separate verdict."
        },
        "jwks": "https://insumermodel.com/.well-known/jwks.json",
        "pqKeyBinding": "https://insumermodel.com/.well-known/pq-key-binding.json",
        "freeTier": "None: every call is paid, from the first one, no signup. Top up with USDC via the buy-credits operation, or pay per call with x402 (HTTP 402 quote in the PAYMENT-REQUIRED header: $0.50 to open a channel, $0.15 to join, $0.15 per agent to re-verify, USDC on Base, Polygon or Arbitrum)."
      }
    ]
  },
  "skills": [
    {
      "id": "condition-based-access",
      "name": "Condition-Based Access",
      "description": "Gate an agent session on what a wallet holds, not on who an agent claims to be. Bilateral handshakes, multi-agent working groups, and open town halls are all the same primitive at different capacities; sessions support two or more agents with no upper cap. Lifecycle is coordinated through operations inside this one skill, not split across multiple skills.",
      "tags": [
        "condition-based-access",
        "wallet-attestation",
        "multi-party",
        "on-chain-verification",
        "scif"
      ],
      "inputModes": [
        "application/json"
      ],
      "outputModes": [
        "application/json"
      ],
      "operations": [
        {
          "name": "declare",
          "method": "POST",
          "endpoint": "https://skyeskiff.skyemeta.com/api/skyeskiff/declare",
          "summary": "Creator declares conditions and capacity; their wallet is attested first and a channel is opened."
        },
        {
          "name": "join",
          "method": "POST",
          "endpoint": "https://skyeskiff.skyemeta.com/api/skyeskiff/join",
          "summary": "Agent joins an existing channel; wallet is attested against the channel's conditions; a per-agent ES256 attestation JWT is returned."
        },
        {
          "name": "verify-session",
          "method": "GET",
          "endpoint": "https://skyeskiff.skyemeta.com/api/skyeskiff/session",
          "summary": "Read a session's current validity and roster by its id, or a room's status (waiting or active, and its sessionId once active) by its channelId."
        },
        {
          "name": "session-action",
          "method": "POST",
          "endpoint": "https://skyeskiff.skyemeta.com/api/skyeskiff/session",
          "summary": "Re-verify (eject agents who lost credentials), kick (creator removes an agent), or leave (agent exits; channel closes if the creator leaves)."
        },
        {
          "name": "buy-credits",
          "method": "POST",
          "endpoint": "https://skyeskiff.skyemeta.com/api/skyeskiff/buy-key",
          "summary": "Top up the wallet's credit balance with USDC. Credits are spent by the EVM wallet that opens channels; a Solana payment names that 0x wallet in a memo. Credits do not expire."
        }
      ],
      "examples": [
        "Two trading agents must both hold at least $100k USDC on Base before exchanging order flow.",
        "A clinical-trial coordination room admits only agents whose wallet holds an EAS attestation from the trial sponsor.",
        "An intelligence-sharing town hall verifies every agent's wallet against an ITAR-cleared NFT collection at join, and re-verifies it whenever a member asks (the channel creator chooses who may ask and who pays) (an agent can schedule that on its own cadence); agents who sold the NFT are ejected on that check."
      ]
    }
  ],
  "engine": {
    "name": "InsumerAPI",
    "description": "All wallet attestations are produced by InsumerAPI: read on-chain state, evaluate the condition, sign the boolean. SkyeSkiff does not implement attestation, it orchestrates it across multi-agent sessions. Trust the math, not the company: every attestation is a JWS verifiable offline against a public JWKS. Since September 2026 every attestation is signed twice: ES256 and a post-quantum ML-DSA-65 signature (pqSig, pqKid, pqJwt; kids insumer-attest-pq1 and insumer-trust-pq1) resolved from the same five-entry JWKS.",
    "url": "https://insumermodel.com/developers/",
    "jwks": "https://insumermodel.com/.well-known/jwks.json",
    "pqKeyBinding": "https://insumermodel.com/.well-known/pq-key-binding.json"
  }
}