xProof

Prove Before Act
Trust primitive for AI agents & humans on MultiversX

Live App • Quick Start • API • Agent Integration • Trust Leaderboard • Architecture • Acquisition guide (FR) • Changelog

---

Trust is programmable. Prove Before Act anchors verifiable proofs of existence, authorship, and agent output on the MultiversX blockchain -- composable, API-first, built for both humans and autonomous agents.

---

Live Proof

The Prove Before Act README is certified on the MultiversX blockchain.

• File: README.md
• SHA-256: 285da2ed7cced35b4d039a80956a4df8907bd33f83aaac8551b6f66c31251bd1
• Date: February 23, 2026 at 09:49 UTC
• Transaction: 41f1ebd363d28de787a2328a2bc99f0b3bad2d73f91baff649ee8a6516e7cc95
• Network: MultiversX Mainnet

This is not a demo. A real payment, a real hash, a real immutable proof.

---

What is Prove Before Act?

Prove Before Act is a trust primitive. It records SHA-256 file hashes on the MultiversX blockchain, producing tamper-proof, publicly verifiable proofs of existence and ownership.

Jason Petitfourg — AI Product Builder is the founder of Prove Before Act. Prove Before Act is the accountability pattern for autonomous agents; xProof is its reference implementation. Before acting, an agent commits and proves a declared decision basis (WHY), then proves WHAT happened. WHY is not a request for internal chain-of-thought. See the founder story and the public production proof.

Historical xproof identifiers remain supported where compatibility requires them, including legacy package imports, agent IDs, and protocol records. They are not a separate public product brand.

• Client-side hashing -- SHA-256 is computed locally. Your file never leaves your device.
• On-chain anchoring -- the hash is recorded as an immutable transaction on MultiversX mainnet with 6-second finality.
• Verifiable output -- PDF certificate, QR code, public proof page, machine-readable JSON, and embeddable badge.
• Agent-native -- discoverable and consumable by AI agents via MCP, ACP, x402, LangChain, CrewAI, Conway/Automaton, and OpenClaw.
• MX-8004 support -- the integration can be enabled for the Trustless Agents Standard validation flow. Check /api/mx8004/status for whether it is active; the current production status is not_configured.

Why MultiversX?

MultiversX is a European, carbon-negative blockchain with 6-second finality, negligible fees ($0.001/tx), and a growing ecosystem of AI-native protocols. Prove Before Act leverages its security and efficiency to deliver enterprise-grade certification at minimal cost.

---

Why It Matters -- Real Scenarios

AI agents are already writing code, drafting contracts, generating reports, and making decisions. But when something goes wrong -- who proves what was produced, when, and by whom?

Prove Before Act is the answer layer.

---

"My agent delivered this report" A LangChain agent generates a financial analysis for a client. Prove Before Act certifies the output before delivery. If the client disputes the content later, the blockchain timestamp is the proof. Irrefutable. No he-said-she-said.

---

"This build was not tampered with" Your CI/CD pipeline compiles and ships. Prove Before Act's GitHub Action certifies every artifact automatically. Six months later, a security audit asks: "Is this binary what you deployed?" -- one hash check, case closed.

---

"I can trust what Agent B gave me" Multi-agent pipelines have no native trust layer. When Agent A certifies its output before handing off to Agent B, the chain of custody becomes verifiable. Agents can prove they did their job. Pipelines become auditable end-to-end.

---

"Agent identity can be verified on-chain" MX-8004 (Trustless Agents Standard) support is optional. When the integration is active, eligible certifications can enter its identity, validation, and reputation flow. Check /api/mx8004/status before relying on MX-8004 identity or reputation data; production currently reports not_configured.

---

"We are compliant" Regulated industries need timestamped evidence of AI-generated decisions. Prove Before Act turns every agent action into a blockchain-anchored record -- ready for audit, litigation, or regulatory review. Zero extra work.

---

"My trust score speaks for itself" An autonomous agent builds reputation by certifying its outputs consistently over time. Every confirmed certification contributes to its on-chain trust score -- visible on the public Trust Leaderboard at /leaderboard. Clients and peer agents query /api/trust/{wallet} before engaging. Trust becomes mathematical, not reputational.

Historical benchmark: the agent identifier xproof_agent_verify is a legacy compatibility name. Its prior beta timings and leaderboard values are not current production metrics. Use a public agent profile and proof response for live status.

---

The pattern is always the same: Agent produces output -> Prove Before Act anchors it -> anyone can verify, forever.

---

Pricing

Low flat rate per certification. No tiers, no subscriptions, no monthly fees. Current price is served live at https://provebeforeact.com/api/pricing.

Current pricing: https://provebeforeact.com/api/pricing

Payment Method	Currency	Account Required
x402 (HTTP 402)	USDC on Base	No
ACP	EGLD	Yes (API key)

Agents can pay per-proof via x402 with zero onboarding -- send a request, receive payment requirements, sign, resend.

---

Quick Start

Use the API (fastest)

# Certify a file in one call
curl -X POST https://provebeforeact.com/api/proof \
  -H "Authorization: Bearer pm_your_api_key" \
  -H "Content-Type: application/json" \
  -d '{
    "file_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
    "filename": "report.pdf",
    "author_name": "Your Name"
  }'

Response:

{
  "proof_id": "uuid",
  "status": "certified",
  "file_hash": "e3b0c44...",
  "verify_url": "https://provebeforeact.com/proof/uuid",
  "certificate_url": "https://provebeforeact.com/api/certificates/uuid.pdf",
  "proof_json_url": "https://provebeforeact.com/proof/uuid.json",
  "blockchain": {
    "network": "MultiversX",
    "transaction_hash": "txhash...",
    "explorer_url": "https://explorer.multiversx.com/transactions/txhash..."
  }
}

Use the Web App

Go to provebeforeact.com, connect your MultiversX wallet, drop a file, certify. Done.

Self-Host

git clone https://github.com/jasonxkensei/prove-before-act.git
cd prove-before-act
npm install
cp .env.example .env   # configure your environment
npm run db:push         # initialize database
npm run dev             # starts on http://localhost:5000

Prerequisites: Node.js 20+, PostgreSQL (or Neon), MultiversX wallet.

See docs/environment-variables.md for configuration details.

---

For Developers

POST /api/proof -- Single Certification

Certify one file hash on-chain in a single API call.

curl -X POST https://provebeforeact.com/api/proof \
  -H "Authorization: Bearer pm_your_api_key" \
  -H "Content-Type: application/json" \
  -d '{
    "file_hash": "<64-char-sha256-hex>",
    "filename": "output.txt",
    "author_name": "Agent Name",
    "webhook_url": "https://your-server.com/webhook"
  }'

Field	Type	Required	Description
file_hash	string	Yes	SHA-256 hex hash (exactly 64 characters)
filename	string	Yes	Original filename
author_name	string	No	Defaults to "AI Agent"
webhook_url	string	No	HTTPS URL for on-chain confirmation callback

POST /api/batch -- Batch Certification

Certify up to 50 files in a single call. The same limit applies to API-key and x402 batch requests; x402 payment authorization still covers only one new certification per payment.

curl -X POST https://provebeforeact.com/api/batch \
  -H "Authorization: Bearer pm_your_api_key" \
  -H "Content-Type: application/json" \
  -d '{
    "files": [\
      {"file_hash": "<hash1>", "filename": "file1.txt"},\
      {"file_hash": "<hash2>", "filename": "file2.py"}\
    ],
    "author_name": "Agent Name"
  }'

Verification

Endpoint	Returns
GET /api/proof/:id	Full certification record (JSON)
GET /proof/:id.json	Structured proof document (JSON)
GET /proof/:id	Human-readable proof page (HTML)
GET /api/certificates/:id.pdf	PDF certificate with QR code
GET /badge/:id	Dynamic SVG badge (shields.io style)

Webhooks

When a proof is confirmed on-chain, Prove Before Act sends a POST to your webhook_url. Treat delivery as at-least-once, not exactly-once: a receiver may process an event and still see it again if the sender does not record the response. The sender makes up to three attempts per delivery round with backoff. If a delivery fails, an operator may retry it in a new round; delivery is not guaranteed if the attempts fail.

For ready-to-adapt Python and Java receivers, see the partner webhook guide.

Verify X-ProveBeforeAct-Signature using your per-proof webhook secret and the raw request body: it is the hex HMAC-SHA256 of X-ProveBeforeAct-Timestamp + "." + rawBody. The timestamp is Unix epoch seconds. Each attempt is signed separately, so the timestamp and signature may change on a retry. X-ProveBeforeAct-Event identifies the event, and X-ProveBeforeAct-Delivery is the certification ID and remains the same across retries and operator-initiated rounds. The legacy X-xProof-* headers are also sent with identical values. Verify the signature and timestamp before trusting the delivery ID.

Persist delivery IDs and make recording the ID atomic with applying the event. For example, with Express and PostgreSQL, after signature verification:

CREATE TABLE webhook_deliveries (
  delivery_id text PRIMARY KEY
);

app.post("/webhook", async (req, res) => {
  const deliveryId = req.get("X-ProveBeforeAct-Delivery");
  if (!deliveryId) return res.sendStatus(400);

  const client = await pool.connect();
  try {
    await client.query("BEGIN");
    const { rowCount } = await client.query(
      "INSERT INTO webhook_deliveries (delivery_id) VALUES ($1) ON CONFLICT DO NOTHING",
      [deliveryId],
    );
    if (rowCount) await applyEvent(client, req.body); // same transaction
    await client.query("COMMIT");
    return res.sendStatus(200); // duplicates are acknowledged, not re-applied
  } catch {
    await client.query("ROLLBACK");
    return res.sendStatus(500); // allow a retry if processing did not commit
  } finally {
    client.release();
  }
});

API Keys

Generate API keys from the Settings page after connecting your wallet. Keys use the pm_ prefix and support per-key rate limiting.

Prepaid packs: Stripe or USDC

Starter, Pro, and Business certification packs can be purchased through hosted Stripe Checkout with POST /api/credits/stripe/checkout. This is an additional payment option, particularly useful for buyers who do not use crypto. The existing USDC/Base flow (/api/credits/purchase then /api/credits/confirm) remains available.

Stripe credits are granted only after the signed Stripe webhook confirms payment; the browser success redirect cannot add credits. See docs/api-reference.md.

---

For Agents

Prove Before Act is designed to be discovered, consumed, and paid by autonomous agents across every major protocol.

Universal Compatibility

Protocol	Endpoint / Resource	Description
MCP	POST /mcp	JSON-RPC 2.0 endpoint; discover the current tool set with tools/list
x402	POST /api/proof, POST /api/batch	HTTP 402 payment flow -- no account needed
ACP	GET /api/acp/products	Agent Commerce Protocol -- discover, checkout, confirm
MX-8004	On-chain registries	Supported integration; inspect /api/mx8004/status for active vs not_configured
OpenAI Plugin	GET /.well-known/ai-plugin.json	ChatGPT plugin manifest
MCP Manifest	GET /.well-known/mcp.json	Model Context Protocol discovery
Agent Protocol	GET /.well-known/agent.json	Agent discovery manifest
LangChain	GET /agent-tools/langchain.py	Python tool definition
CrewAI	GET /agent-tools/crewai.py	Python tool definition
llms.txt	GET /llms.txt, GET /llms-full.txt	LLM-friendly documentation

x402 -- Pay Per Proof, No Account

Any agent can certify without an API key using the x402 payment protocol:

1. Send POST /api/proof without auth
2. Receive HTTP 402 with payment requirements (USDC on Base, eip155:8453)
3. Sign the payment and resend with X-PAYMENT header
4. Receive the proof

Low flat rate per certification. Current pricing: https://provebeforeact.com/api/pricing. No signup. No API key. No account.

MCP -- Model Context Protocol

Prove Before Act exposes a live MCP server at POST /mcp. The core acquisition and verification tools include:

• register_trial -- obtain a free API key without a wallet
• certify_file -- certify a file hash on MultiversX
• verify_proof -- verify an existing certification
• audit_agent_session -- create a pre-action audit record
• investigate_proof -- reconstruct the audit trail for a proof

The server can expose additional tools for confidence staging, proof retrieval, attestations, outcomes, and calibration. Always call MCP tools/list (or discover_services) for the complete, current schema rather than hard-coding an exhaustive list.

ACP -- Agent Commerce Protocol

Full commerce flow for programmatic purchasing:

GET  /api/acp/products       # Discover products and pricing
GET  /api/acp/openapi.json   # OpenAPI 3.1 specification
POST /api/acp/checkout       # Start checkout session
POST /api/acp/confirm        # Confirm transaction
GET  /api/acp/health          # Health check

MX-8004 -- MultiversX Trustless Agents Standard

Prove Before Act supports an MX-8004 validation integration, but support and activation are distinct. The current production response from /api/mx8004/status is status: "not_configured", so certifications are not presently registered in MX-8004.

When configured, the integration exposes identity, validation, reputation, and transaction-queue capabilities. Treat a certification as MX-8004 validated only when its live status response confirms the active integration and validation result.

Conway/Automaton Skill

Prove Before Act ships a ready-made skill for Conway Automatons:

skills/prove-before-act/SKILL.md

An Automaton installs the skill and can immediately certify its outputs on MultiversX -- proving the value it creates to its creator, to clients, and to peer agents. This aligns directly with the Automaton survival-by-work model.

Agent Trust Leaderboard

Every certification builds cumulative on-chain reputation. The Trust Leaderboard makes it public and discoverable.

• Pages: /leaderboard — public, sortable, filterable. /agent/{wallet} — individual profile with stats, streak, and recent certs timeline.
• Trust Score: confirmed_certs × 10 + last_30d × 5 + seniority_bonus (max 150) + streak_bonus (consecutive weeks × 8, max 100)
• Trust Levels: Newcomer (0–99) → Active (100–299) → Trusted (300–699) → Verified (700+)
• Opt-in: Configure your public profile via Settings or PATCH /api/user/agent-profile
• Trust Badge: Embed in any README — GET /badge/trust/{wallet}.svg returns a dynamic shields.io-style badge showing current level and score

Reference agent: xproof_agent_verify is a legacy agent identifier retained for compatibility. Fetch its public profile and proof records for current metrics rather than relying on historic benchmark values.

• Full review: moltbook.com

---

OpenClaw Skill

ClawHub-standard skill for the OpenClaw ecosystem:

• Repository: github.com/jasonxkensei/prove-before-act-openclaw-skill
• Includes SKILL.md, certify.sh, and full API reference

GitHub Action

Integrate Prove Before Act into your CI/CD pipeline:

- uses: jasonxkensei/prove-before-act-action@v1
  with:
    api_key: ${{ secrets.PROVEBEFOREACT_API_KEY }} # XPROOF_API_KEY remains accepted for existing setups
    files: dist/**

Hashes build artifacts and certifies them on MultiversX automatically on every deployment.

See github-action/README.md for full documentation.

---

How It Works

User/Agent                    Prove Before Act                     MultiversX
    |                           |                           |
    |  1. Submit file hash      |                           |
    |     (API / Web / MCP)     |                           |
    |-------------------------->|                           |
    |                           |                           |
    |  2. SHA-256 validated     |                           |
    |     (client-side or API)  |                           |
    |                           |                           |
    |                           |  3. Transaction signed    |
    |                           |     & broadcast           |
    |                           |-------------------------->|
    |                           |                           |
    |                           |  4. Anchored on-chain     |
    |                           |     (6s finality)         |
    |                           |<--------------------------|
    |                           |                           |
    |  5. Proof returned        |  6. MX-8004 validation    |
    |     (JSON + PDF + URL)    |     only when active      |
    |<--------------------------|-------------------------->|
    |                           |                           |
    |  7. Webhook notification  |                           |
    |     (HMAC-signed)         |                           |
    |<--------------------------|                           |

---

Core Capabilities

Capability	Description
Client-Side Hashing	SHA-256 computed in-browser. Zero data leaves your device.
Blockchain Anchoring	Immutable proof on MultiversX mainnet.
MX-8004 Support	Optional on-chain validation, reputation, and identity integration; inspect /api/mx8004/status for live activation.
x402 Payments	HTTP 402 native payment -- USDC on Base, no account needed.
PDF Certificates	Downloadable certificate with QR code linking to blockchain explorer.
Public Proof Pages	Shareable /proof/:id pages for independent verification.
Verification Badges	Dynamic SVG badges (shields.io style) with embeddable Markdown.
Wallet Authentication	Native Auth via xPortal, MultiversX Web Wallet, WalletConnect.
Agent Commerce Protocol	Agents discover, purchase, and consume certifications programmatically.
MCP Server	JSON-RPC 2.0 endpoint with discoverable certification, audit, verification, trial, and investigation tools.
LangChain / CrewAI	Ready-made Python tool definitions.
Webhook Delivery	HMAC-SHA256 signed notifications with retry and exponential backoff.
API Keys	pm_-prefixed bearer tokens with per-key rate limiting.
LLM Discovery	llms.txt, OpenAI plugin, MCP manifest, agent.json -- all served.
GitHub Action	CI/CD integration -- hash and certify build artifacts automatically.
Conway/Automaton Skill	Ready-made SKILL.md for sovereign agent output certification.
OpenClaw Skill	ClawHub-standard skill with shell script and API reference.
Agent Trust Leaderboard	Public on-chain trust registry. Score = certified certs × history × streak. Levels: Newcomer / Active / Trusted / Verified. Dynamic SVG badge embeddable in any README.

---

API Reference

Full documentation: docs/api-reference.md

Core Endpoints

Method	Endpoint	Auth	Description
POST	/api/proof	API Key / x402	Certify a file hash (single call)
POST	/api/batch	API Key / x402	Batch certification (up to 50 files)
GET	/api/proof/:id	Public	Get proof data
GET	/proof/:id.json	Public	Structured proof document
GET	/proof/:id	Public	Human-readable proof page
GET	/api/certificates/:id.pdf	Public	Download PDF certificate
GET	/badge/:id	Public	Dynamic SVG badge
GET	/api/pricing	Public	Current pricing & tier info
GET	/api/leaderboard	Public	Top 50 agents sorted by trust score
GET	/api/agents/:wallet	Public	Agent profile with trust score and certification history
GET	/api/trust/:wallet	Public	Trust score + level lookup (no profile required)
GET	/badge/trust/:wallet.svg	Public	Dynamic trust badge (shields.io style)
GET	/badge/trust/:wallet/markdown	Public	Ready-to-embed trust badge markdown
PATCH	/api/user/agent-profile	Session	Update public agent profile

Authentication

Method	Endpoint	Auth	Description
POST	/api/auth/wallet/sync	Native Auth	Authenticate via wallet signature
GET	/api/auth/me	Session	Get current user
POST	/api/auth/logout	Session	End session

Agent Commerce Protocol

Method	Endpoint	Auth	Description
GET	/api/acp/products	Public	Discover products and pricing
GET	/api/acp/openapi.json	Public	OpenAPI 3.1 specification
POST	/api/acp/checkout	API Key	Start checkout session
POST	/api/acp/confirm	API Key	Confirm transaction
GET	/api/acp/health	Public	Health check

API Key Management

Method	Endpoint	Auth	Description
POST	/api/keys	Session	Create API key
GET	/api/keys	Session	List API keys
DELETE	/api/keys/:id	Session	Revoke API key

---

License

Proprietary — source available. See LICENSE.