OpenChainGraph Suite · ART-565 · Agentic Payments Evidence

KYA Credential × x402 Payload Scope Verifier

Cross-checks a declared KYA (Know Your Agent) credential's scope against a declared x402 payment payload: the payload amount against the credential's spend cap, the payload network and asset against its allowed set, the payload payee against its merchant allowlist, the payload's validity window against the credential's, and scope-string coverage of the payment scheme. Returns a verdict of IN_SCOPE, OUT_OF_SCOPE, or INDETERMINATE when the credential omits a claim the payload needs; it never guesses. This tool never fetches either input, never contacts Skyfire or a facilitator, and performs no signature verification.

Verify-only: no execution, no settlement No signature verification claimed Zero network calls No PII: agent/credential ids and a payment payload only
🔒 All inputs are processed locally in your browser. No data is transmitted. Do not enter real personal data — use synthetic or anonymised inputs only.
⚠ This never initiates, signs, or settles an x402 payment (x402 EXECUTION is a KILLED ledger row) and never verifies a signature: the pinned Skyfire docs (2026-08-06) do not specify a caller-reproducible KYA signing scheme in this context, so this is a scope cross-check only.
KYA credential

Documented Skyfire kya-pay claims (docs.skyfire.xyz, pinned 2026-08-06): sub, aud, ssi, iss, iat, exp, env. spend_cap_amt, allowed_networks, allowed_assets, payee_allowlist, scope are this tool's own scope-representation fields layered on top, not documented Skyfire claims.

x402 payload

PaymentPayload shape reused from the x402 decoder (tools/277).

Findings
Indeterminate reasons
Rejected inputs
Rationale
    Execution Hash (SHA-256)
    What this does not do

    It does not fetch a KYA credential or x402 payload from anywhere: you declare both. It does not verify a signature: the pinned Skyfire docs don't specify a caller-reproducible signing scheme in this context. It does not initiate, sign, or settle a payment: x402 execution is a killed ledger row. See art-26 for decoding raw x402 headers and tools/478 for the KYA policy side this tool cross-checks against a concrete payload.

    The claim shape, in one sentence

    Skyfire's published kya-pay token claims (docs.skyfire.xyz/docs/common-token-claims.md, /docs/token-schemas.md, pinned 2026-08-06) document identity, audience-binding, and expiry claims (sub/aud/ssi/iss/iat/exp/env) plus spend fields (amt/cur/val); they do not enumerate an explicit network-allowlist, asset-allowlist, or multi-entry payee-allowlist array, so this tool layers allowed_networks/allowed_assets/payee_allowlist/scope on top as its own scope representation.

    

    



    
  
    
    
    Ask your agent
    
    
  
    
  
    Copy this paragraph into Claude, OpenClaw, or any MCP-aware agent to run this exact tool, with this sample, and verify the artifact.
    
  
    Run the AINumbers MCP tool `verify_kya_x402_scope`. Task: Cross-check a declared KYA (Know Your Agent) credential's scope against a declared x402 PaymentPayload: amount vs the credential's spend cap, network/asset vs its allowed set, payee vs its merchant allowlist, validity window vs the payload's timestamps, and scope-string coverage of the payment scheme.
Call it with arguments: {"policy_parameters":{"kya_credential":{"sub":"buyer-agent-001","aud":"seller-agent-042","ssi":"svc-abc123","iss":"https://issuer.skyfire.xyz","iat":1754400000,"exp":1754500000,"env":"production","spend_cap_amt":"10000000","allowed_networks":["base"],"allowed_assets":["0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48"],"payee_allowlist":["0xMERCHANT0000000000000000000000000000beef"],"scope":["payments:x402:exact"]},"x402_payload":{"x402Version":1,"scheme":"exact","network":"base","asset":"0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48","payload":{"signature":"0xsig","authorization":{"from":"0xBUYER","to":"0xMERCHANT0000000000000000000000000000beef","value":"5000000","validAfter":1754400100,"validBefore":1754400400,"nonce":"0x01"}}}}}
Verify before trusting: call `verify_execution_hash` on mcp.ainumbers.co (https://mcp.ainumbers.co/mcp) with the parameter `claimed_hash` set to the returned `execution_hash`, passing the full artifact the run returned (the object containing `policy_parameters` + `output_payload` + `execution_hash`; equivalently `policy_parameters` + `output_payload` with `claimed_hash`), not the bare hash string.
Return the ledger link https://ledger.ainumbers.co/ so a human can re-verify without contacting us.
PII rule: All inputs are processed locally in your browser. No data is transmitted. Do not enter real personal data — use synthetic or anonymised inputs only.
Open the tool with the sample prefilled: https://ainumbers.co/chaingraph/art-565-kya-x402-scope-verifier.html#p=v1.H4sIAAAAAAAA_wHHAjj9eyJreWFfY3JlZGVudGlhbCI6eyJzdWIiOiJidXllci1hZ2VudC0wMDEiLCJhdWQiOiJzZWxsZXItYWdlbnQtMDQyIiwic3NpIjoic3ZjLWFiYzEyMyIsImlzcyI6Imh0dHBzOi8vaXNzdWVyLnNreWZpcmUueHl6IiwiaWF0IjoxNzU0NDAwMDAwLCJleHAiOjE3NTQ1MDAwMDAsImVudiI6InByb2R1Y3Rpb24iLCJzcGVuZF9jYXBfYW10IjoiMTAwMDAwMDAiLCJhbGxvd2VkX25ldHdvcmtzIjpbImJhc2UiXSwiYWxsb3dlZF9hc3NldHMiOlsiMHhBMGI4Njk5MWM2MjE4YjM2YzFkMTlENGEyZTlFYjBjRTM2MDZlQjQ4Il0sInBheWVlX2FsbG93bGlzdCI6WyIweE1FUkNIQU5UMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMGJlZWYiXSwic2NvcGUiOlsicGF5bWVudHM6eDQwMjpleGFjdCJdfSwieDQwMl9wYXlsb2FkIjp7Ing0MDJWZXJzaW9uIjoxLCJzY2hlbWUiOiJleGFjdCIsIm5ldHdvcmsiOiJiYXNlIiwiYXNzZXQiOiIweEEwYjg2OTkxYzYyMThiMzZjMWQxOUQ0YTJlOUViMGNFMzYwNmVCNDgiLCJwYXlsb2FkIjp7InNpZ25hdHVyZSI6IjB4c2lnIiwiYXV0aG9yaXphdGlvbiI6eyJmcm9tIjoiMHhCVVlFUiIsInRvIjoiMHhNRVJDSEFOVDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDBiZWVmIiwidmFsdWUiOiI1MDAwMDAwIiwidmFsaWRBZnRlciI6MTc1NDQwMDEwMCwidmFsaWRCZWZvcmUiOjE3NTQ0MDA0MDAsIm5vbmNlIjoiMHgwMSJ9fX19Qpwfh8cCAAA