Vantix Protocol · v0.1.0
Verifiable identity and policy-bound agent execution infrastructure
A technical overview of the Vantix Protocol — an MIT-licensed, self-custodial developer stack that issues hardware-attested verifiable credentials and enforces non-bypassable policy guardrails at the signing surface, backed by a tamper-evident audit log.
1. The compliance gap
Fintech onboarding
Financial platforms spend weeks on KYC/AML onboarding. Identity verification is fragmented across third-party vendors, audit trails are spreadsheet-based, and regulators increasingly demand a verifiable chain of custody — not a database dump.
AI agent execution
Autonomous agents are executing trades, staking, and transacting on-chain with no policy layer between the model and the signing key. Prompt injection is a real attack vector. If an LLM is compromised, a hot wallet with unrestricted API keys can be fully drained. No audit record proves what the agent did — or was prevented from doing.
Shared requirement
Both problems demand the same compliance primitive: a hardware-rooted, cryptographically-signed proof of identity or policy, with an append-only, tamper-evident audit trail that regulators accept and platforms can verify programmatically.
2. Architecture
Vantix is a TypeScript monorepo of seven MIT-licensed packages, composable as a stack or usable independently.
Stack diagram
┌─────────────────────────────────────────────┐ │ Frontend (Next.js PWA) │ │ /api/verify · /api/attestation │ ├──────────────────┬──────────────────────────┤ │ Human Verify │ Agent Attestation │ │ (identity VC) │ (agent-bound VC) │ ├──────────────────┴──────────────────────────┤ │ Tamper-evident Audit Log │ │ (shared, hash-chained, append-only) │ ├─────────────────────────────────────────────┤ │ Agent Wallet · Secure Enclave · Policy │ │ engine (P-256, WebAuthn, local-first) │ ├─────────────────────────────────────────────┤ │ Hyperliquid TK · Coinbase TK · MCP srv │ └─────────────────────────────────────────────┘
@vantix/secure-enclave
Hardware key generation and signing. P-256 via WebAuthn passkeys, iOS App Attest, or Android Key Attestation. The private key never leaves device silicon.
@vantix/agent-wallet
Hardware-bound wallet runtime. Maintains a key ring, signs exchange API requests, and enforces a non-bypassable local policy engine before any signature reaches the enclave.
@vantix/human-verify
Issues and verifies W3C Verifiable Credentials for human identity. Every issuance and verification is recorded in the shared tamper-evident audit chain. Supports credential revocation.
@vantix/agent-attestation
Agent-track counterpart. Issues verifiable credentials binding an agent to a policy hash. Platforms verify the attestation before trusting the agent. Reuses the shared audit log.
@vantix/hyperliquid-agentkit
Hyperliquid exchange client. Nonce-safe action builders, extraAgent onboarding, and builder-fee routing. Connects to the Secure Enclave via the agent wallet.
@vantix/coinbase-agentkit
Coinbase (CDP) integration. Trade, swap, stake, supply, borrow. Every request is signed through the policy engine.
@vantix/mcp-server
Model Context Protocol server. Exposes policy-gated tools to AI agents (Cursor, Claude Code). Tools include wallet init, trade execution (policy-checked), and policy inspection.
3. Security model
Hardware root of trust
Keys are generated inside the device's Secure Enclave / TPM and never leave it. The P-256 keypair is created via the platform's native attestation service (WebAuthn on browsers, App Attest on iOS, Key Attestation on Android). The attestation object proves the key was created in genuine, untampered silicon.
Policy engine isolation
The policy engine (`@vantix/agent-wallet`) sits between the model runtime and the signing hardware. Every signing request is evaluated against local policies (max trade size, asset allow/block lists, withdrawal toggle, destination whitelist, transfer caps). If the request violates a rule, the engine rejects it before a signature is generated. The LLM's reasoning loop is never trusted with the raw key.
Tamper-evident audit log
Every credential issuance, verification, and revocation is written to an append-only audit log. Each entry carries a SHA-256 hash of the previous entry, forming a chain. AuditLog.verify() recomputes every hash in the chain and reports modified or deleted entries. This is the compliance artifact regulators accept — a single source of truth that cannot be silently rewritten.
Credential signing
Credentials are signed over the canonical credential subject using HMAC-SHA256 (HS256) with a secret issuer key. The signature is bound to the credential and recomputed at verification time. Even an attacker with write access to the credential store cannot forge a claim without the issuer secret. Upgrade path: Ed25519 via WebCrypto or HSM.
Revocation
Every credential carries a credentialStatus field (W3C VC data model). Revocation flips the status and writes a credential.revoked audit entry. A revoked credential returns valid: false with error "Credential revoked." Revocation state lives outside the signed subject — flipping status does not invalidate the original issuer signature.
4. Regulatory alignment
SEC self-custody safe harbor (2026–2031)
The April 2026 SEC Staff Statement confirmed that self-custodial wallet interfaces are exempt from broker-dealer registration through 2031. Vantix never holds, controls, or has access to user private keys — it is local-first and self-custodial by design. No token, no custody, no broker-dealer activity.
EU Digital Operational Resilience Act (DORA)
DORA requires financial entities to maintain ICT incident logs and report security events. Vantix's hash-chained audit log provides a verifiable, append-only record — audit-grade evidence for regulatory review and incident response.
Market abuse / MiCA
By binding each trade to an attested agent with a verified policy hash, Vantix enables platforms to demonstrate that trade execution was policy-bound and audited — a strong control against manipulation claims.
No money services business (MSB)
Vantix does not intermediate transfers, handle fiat, or process payments. It is developer infrastructure, not a financial service. No registration burden under BSA / state money-transmitter laws.
5. Business model
All core SDKs are MIT-licensed. Revenue paths are layered:
All seven packages are open-source, tested, and documented. The distribution engine.
Managed credential issuance, verification, and audit-log ingestion with uptime SLAs. Pay per credential, not per developer.
Custom HSM integrations, threshold multisig policies, and white-label SDK licensing for regulated exchanges and quant firms.
Hyperliquid builder-fee routing: 0.04% of volume routed through Vantix-attested agents is directed to the protocol. Sustainable, token-free.
6. Current status
7
Packages
78
Tests
MIT
License
TypeScript 5.7
Language
Node ≥ 20
Runtime
Pending npm login
Publish