Squid

Squid is the trust and liability layer that verifies every agentic AI transaction, enforces custom contracts, and creates cryptographic audit trails so both consumers and merchants are protected.

Comment

Why (Problem)

Amazon launched an AI agent that buys products from other websites on your behalf. Within months, it had listed 500,000 products from small businesses without their consent. Merchants started receiving orders for products they never sold. When customers wanted refunds, the merchants paid millions of dollars out of pocket. Not Amazon.

This isn't an isolated incident. Agentic payments skyrocketed in last two months and they've already cost consumers millions in unauthorized purchases, and big companies hundreds of millions in refunds and lawsuits.

There is no legal framework for AI spending money. When an AI agent makes the wrong purchase, consumers have no way to prove what they authorized and merchants have no way to verify the order was legitimate.

What (Solution)

Every AI agent transaction runs through Squid before money moves. We validate the purchase against the human's intent contract, run it through constraint checks, score the agent's trust based on behavioral history, and generate a cryptographic evidence bundle anchored to Solana. If the agent deviates from what was authorized, the transaction is blocked, the trust score drops, and permissions tighten automatically.

A squid releases ink to create a defensive trail. That's exactly what we do. Every AI agent transaction generates an immutable evidence trail on Solana that protects both the consumer and the merchant.

┌────────────────────────────────────────────────────────┐
│                                                        │
│   PayPal (1998)            "Trust for strangers"       │
│       │                                                │
│       ▼                                                │
│   Stripe (2010)            "Trust for developers"      │
│       │                                                │
│       ▼                                                │
│   SQUID (2026)             "Trust for AI agents"       │
│                                                        │
├────────────────────────────────────────────────────────┤
│                                                        │
│                    ┌───────────────┐                   │
│   Visa TAP  ───────┤               ├──→ Authorized     │
│   PayPal AP2  ─────┤               │    Commerce       │
│   Stripe x402  ────┤     SQUID     │                   │
│   Mastercard  ─────┤               ├──→ Solana         │
│   Any AI Agent  ───┤               │    (immutable     │
│                    │               │     proof)        │
│   Prompt           │  Intent       │                   │
│   Injection ──X    │  Trust        │                   │
│   Overspending ──X │  Risk         │                   │
│   Fraud ────────X  │  Evidence     │                   │
│   Unauthorized ──X │  Disputes     │                   │
│                    └───────────────┘                   │
│                                                        │
│       Every dollar. Every decision. Every agent.       │
│                                                        │
└────────────────────────────────────────────────────────┘

Who

Consumers (free): they delegate purchases to AI agents. Squid gives them real-time control over what their agent can buy, full visibility into every decision the agent makes, and an evidence-backed dispute system when something goes wrong. Consumers never pay. They're the protected party.

Merchants (paid, per-transaction fee): they receive orders from AI agents. Squid provides verified proof of human intent behind every order, reducing fraudulent chargebacks and giving them confidence that the purchases hitting their checkout are legitimate. Merchants pay because Squid saves them money on chargebacks they'd otherwise eat.

Agent platforms (paid, API subscription + per-transaction fee): companies like OpenClaw, Daydream, Simular, and Amazon Buy for Me that are building AI shopping agents but have no native trust scoring, constraint enforcement, or dispute resolution. They integrate Squid's API instead of building it themselves.

Payment networks (partners, not customers): Visa, PayPal, Mastercard, and Stripe have built the rails for agent commerce but explicitly lack the accountability layer on top. Squid sits above all of them, protocol-agnostic. They benefit from reduced fraud exposure across their networks.

When

NOW! In 2026, Mastercard completed Europe's first live end-to-end payment executed entirely by AI agent. Visa launched its Agentic Ready program with 21 banking partners. AI agents influenced $262 billion in holiday sales. Visa predicts millions of consumers will use AI agents to complete purchases by the end of 2026.

The market is projected to hit $14 trillion by 2030. The rails are live. The accountability layer is not. We're building it now.

Where

Where the problem exists: Everywhere AI agents touch money. Retail (Amazon Buy for Me), procurement (McKinsey purchasing agents), travel (Expedia booking agents), groceries, office supplies. Every industry where an AI agent can place an order on behalf of a human has the same gap: no verification of intent, no audit trail, no dispute system. The problem is platform agnostic and industry agnostic.

Where Squid sits: Between the agent and the payment. Squid is not a payment processor and not an agent platform. It sits above the payment rails (Visa, PayPal, Mastercard, Stripe) and below the agent platforms (OpenClaw, Daydream, Amazon). Every transaction passes through Squid before money moves. We are the verification layer that the existing stack is missing.

How (Tech Stack)

Flask API is the enforcement engine. Every purchase request hits Flask before money moves. Constraint checks, trust score computation, risk rate calculation, evidence bundle generation.

Next.js + Tailwind powers the consumer dashboard. Real time trust scores, transaction history, proof drawer, dispute actions, spending controls.

Supabase handles the database and auth. User profiles, agent records, transaction history, evidence bundles, JWT session management.

Stripe handles payment processing. Card tokenization via Stripe Elements, direct charges to the human’s card. Raw card data never touches our servers.

Rye.AI is the universal checkout API. When a purchase is approved, Rye handles the actual product checkout across merchants.

Solana provides the tamper proof audit trail. Every evidence bundle is SHA 256 hashed and anchored on chain via devnet. Block number, timestamp, signature, memo, all publicly verifiable on Solana Explorer. No one can alter a receipt after the fact.

Gemini 3.0 Flash powers AI driven post purchase auditing. Evaluates every evidence bundle using metrics derived from the TRiSM (Trust, Risk, and Security Management) framework for agentic AI systems (arxiv.org/abs/2506.04133). Generates a human readable verdict: MATCH or MISMATCH, with confidence score and flagged issues.

OpenClaw is the agent runtime. Handles conversational AI, product search, and shopping logic via iMessage. Squid doesn't replace the agent. It governs it.

PyJWT handles JWT based auth. Supabase tokens validated on every request. Links every transaction to an authenticated human identity.

Built With

Share this project:

Updates