Antibodies are signed by their publisher, staked on chain, and addressable by a stable CVE-style identifier. Cheap matches resolve locally in microseconds. Novel threats verify in a Chainlink CRE TEE, triggered on-chain and attested by the DON. The network is the immune system.
npm install @immunity-protocol/sdk
Chain agnostic.
Every action is screened. A hit resolves locally in microseconds; only the slice that's genuinely new triggers a Chainlink CRE TEE on-chain. Propagation is instant — enforcement is trust-gated, so a lone flag can't censor anyone. No human in the loop.
An AI agent passes any tx, scraped content, or counterparty message to immunity.check(). The fee is mandatory — it pays for the evaluation. On a hit, the network already knows: the LLM is skipped, the answer is instant, and the fee rewards the publisher.
A miss is the slice that is actually new. An on-chain verification request triggers Chainlink CRE; encrypted context goes to the TEE enclave; a DON-signed verdict is written back on-chain. A confirmed threat seeds a new antibody — a future cache hit for everyone.
The antibody is visible network-wide the moment it is published. But a lone or low-reputation flag stays advisory — it warns, never hard-blocks. A hard block needs K independent reputable publishers corroborating the same target, so a $1 actor can't censor the Uniswap router.
On-chain events propagate the antibody; local caches and the indexer update; the same attack is blocked everywhere — by SDK on agents, by the Uniswap hook on pools. Anyone can challenge a false antibody with a bond; the CRE jury rules and the loser is slashed.
Novel checks and the challenge jury trigger CRE on-chain; the TEE returns a DON-signed, attested verdict written back on chain.
Publishers are *.immunity.eth subnames via Durin L2 on Base — protocol-owned, so a slashed publisher can't transfer the name to escape its history. Reputation mirrors into ENS text records.
An on-chain hook reverts swaps from antibody-flagged addresses while keeping canonical routers un-blockable. A real on-chain consumer of the registry.
Every check carries a flat $0.01 fee — it pays for the security evaluation, and it's priced to be profitable on its own. A known threat resolves from the cache instantly and 80% rewards the publisher whose antibody caught it; anything novel is screened by an attested Chainlink CRE verdict — Claude in a TEE — and the fee funds that compute. No subsidy, no tiers. Settled on-chain on Base, no off-chain accounting.
Flat fee on every immunity.check() — priced to cover an attested Chainlink CRE screen (Claude in a TEE) and still profit. A cached hit rewards the publisher; a novel action funds its CRE verdict.
When a CRE-verified novel threat seeds a new antibody. Funds the on-chain registry write.
No subscription. No minimum. No volume discount tiers.
Reward for the cache entry that saved an inference. Paid in USDC on chain by the Registry contract. While an antibody is on probation the share is escrowed, released on maturation and clawed back on slash.
Skin in the game. A false antibody earns zero: challenged, the CRE jury rules, the stake and escrowed rewards are slashed. Legitimate ones mature, unlock, and reclaim the stake.
Real money. $1.78 distributed so far.
Operators pay a cent a check for an attested verdict on every action — known threats resolve instantly from the cache, novel ones get a fresh CRE/Claude screen the fee pays for. Publishers earn USDC every time their antibody catches a threat someone else was about to hit. Treasury keeps the Registry funded and the CRE subscription topped up. Every fee, reward, and stake settles on-chain on Base, fully auditable, no off-chain accounting.
Antibodies recognize threats five ways: cheap, instant pattern matches at the edge, escalating to TEE-verified inference only when something genuinely new shows up. Examples are real patterns the demo fleet catches.
Specific wallets and contracts the network has flagged. Hash-table lookup, instant.
Suspicious function shapes regardless of who calls them. Selector + argument heuristics.
Runtime bytecode hash. Re-deployed clones can't hide under a fresh address.
Multi-hop taint topology. Bad actors at one remove still get caught.
Manipulation patterns and prompt-injection markers in the agent's input.
What the network is blocking the most right now. Click any IMM ID to inspect the matcher, evidence, and publisher.
The SDK is a single import. Pass any tx or context to immunity.check() and the network responds with a verdict, evidence, and matching antibodies before you sign.
import { Immunity } from "@immunity-protocol/sdk";
const immunity = new Immunity({
wallet,
// Called when verdict is SUSPICIOUS. Return true to allow, false to block.
// Defaults to "deny" if not provided.
onEscalate: async (verdict) => {
return await notifyOperator({
antibody: verdict.matched[0],
confidence: verdict.confidence,
reason: verdict.reason,
});
},
escalationTimeout: 300, // seconds, default 300
onTimeout: "deny", // "deny" | "allow", default "deny"
});
// Before any agent action
const result = await immunity.check(tx, context);
if (!result.allowed) {
console.warn(`Blocked by ${result.antibodies[0].immId}: ${result.reason}`);
return;
}
// Safe to proceed
await wallet.sendTransaction(tx);immunity.check as a tool any agent calls
Agents check before they sign. Pools check before they swap. Same registry, two enforcement points, no install required for the second.
Install the SDK in your agent. Every action is checked against the network's collective immunity before signing. Works on any chain, any pool, any tx type.
Deploy a Uniswap v4 pool with the Immunity hook. Every swap on your pool is checked against the global registry. LPs are protected automatically — no install required.
Every antibody is a public artifact. Subscribe via RSS, JSON, or webhook. Wallet UIs, security researchers, and other agents can consume the feed without running an SDK.