Certo Live on NEAR testnet · test USDC GitHub
Live on NEAR testnet · test USDC

Paid API calls for AI agents, with refunds

Your AI agent paid for bad data. Certo gets the money back.

The API seller is paid instantly and locks a bond. For 120 seconds after each call, a wrong, broken or missing answer is refunded out of that bond. No escrow. Live on NEAR testnet.

Watch a refund happen Verify it on NEAR testnet

A 2-minute replay of a real testnet run, paid in test USDC. Nothing to install. · View on GitHub

A refund, in four steps Your agent pays 0.40 test USDC to a paid API and the seller is paid at once. The answer is about NEO, not NEAR. The contract pays 0.40 back to the agent from the seller's bond, which falls from 50.00 to 49.58. Your agent 10.00 balance · test USDC Paid API 0.396 earned · test USDC Seller's bond 49.58 locked in the contract refund window · 120 s same transaction 0.40 top 5 holders of NEAR? { "token": "NEO" } asked for NEAR 0.40

1. Your agent pays 0.40 USDC for an API call.2. The seller is paid instantly. Nothing sits in escrow.3. The answer is wrong: asked for NEAR, got NEO.4. Your agent claims a refund. The contract pays it from the seller's bond.

Illustration with the amounts from the testnet run. The bond falls by 0.42: the 0.40 refund plus a 0.02 ruling fee.

An agent's payment is final. Even when the answer is wrong.

Today: the money is gone.

Your agent asks for the top holders of NEAR, pays 0.40 USDC, and gets the holders of NEO. There is no chargeback for agents.

Escrow: everyone waits.

Holding each payment until the buyer is satisfied protects the buyer, and makes every honest seller wait for its money on every call.

Certo: pay now, refund if it's bad.

The seller is paid in the same transaction. The refund risk sits on the seller's own bond, and only for 120 seconds.

Guards try to stop a bad payment before it happens. Certo gets the money back after one goes through.

Three steps, one smart contract

  1. 1The seller locks a bond.

    An API seller deposits USDC into the Certo contract on NEAR. Anyone can read the bond before paying, and a seller can never owe more in refunds than its bond holds.

  2. 2Your agent pays. The seller has the money at once.

    One transaction moves the price from the agent to the seller, minus a 1% fee. Nothing is held back.

  3. 3For 120 seconds, a bad answer can be refunded.

    If the answer is an error, missing, broken or wrong, the agent claims a refund and the contract pays it from the seller's bond. If nobody claims, the payment is final.

Why use Certo

For agent builders (buyers)

  • Try an unknown paid API without betting the money on it. A bad answer comes back out of the seller's bond.
  • One tool call gets the refund. Your agent calls certo_dispute: no support ticket, no chargeback form.
  • See the risk before you pay. certo_quote shows the seller's bond, its lost refund claims and its fee. Your agent never pays more than its cap per call (default 1.00 USDC).
  • No platform to trust. Every refund decision can be checked on chain.

For API sellers

  • Paid instantly. The money arrives in the buyer's own transaction. No escrow wait.
  • A reason to try you. A bonded badge gives cautious agent buyers a reason to call an API they would otherwise skip.
  • Your risk is capped. Open refunds can never exceed your bond.
  • A clean record lowers your fee. 1.0% at the start, down to 0.5%. Buyers who dispute honest answers lose their deposit.

Simple failures are refunded by rule. Wrong answers go to a panel.

Refunded by rule

on for every seller
  • The server returned an error (HTTP 5xx)
  • Nothing was delivered
  • The answer is broken: not JSON, or a required field is missing
  • The data is stale

Checked by the contract. No judgement and no AI involved.

Refunded by an AI panel

experimental · the seller opts in

Some answers look fine and are still wrong. "NEO" instead of "NEAR" arrives with status 200, valid JSON and every field present. No rule can catch it.

For these, three AI models from three companies (Qwen, GLM and DeepSeek) each read the request and the answer inside a secure enclave on NEAR AI Cloud, and each signs its vote. The contract checks all three signatures itself before any money moves.

What stops a buyer from lying? Claiming that an answer is wrong costs the buyer a small deposit (0.02 USDC on a 0.40 call). If the experimental panel disagrees, the deposit is gone, and the next one doubles. Known gap: a buyer who never asks the panel and lets the dispute time out gets only the seller's offer, but also the deposit back, so today the deposit deters only buyers who go through the panel. Details.

Watch four real calls on NEAR testnet

A 2-minute replay of a run from 13 November 2026. Every amount on screen comes from the run's on-chain events.

  1. 1An honest call. agent pays honest-api. The seller is paid instantly.
  2. 2A wrong answer. shady-api answers NEO for NEAR. The experimental AI panel votes 3–0 and agent is refunded 0.40.
  3. 3A lying buyer. liar-agent disputes correct data. It loses its deposit.
  4. 4A silent seller. shady-api takes the money and sends nothing. Refunded by rule after 30 s.
Play the replay

The experimental AI panel's answers in the replay were recorded from NEAR AI Cloud on 11 November 2026 and carry their real signatures. Asked live, the panel takes a median of 23 seconds.

Don't trust this page.

Press the button and your browser asks NEAR testnet directly. It reads the contract and the refund transaction, rebuilds what each AI model of the experimental panel was asked, and checks the three signatures itself. From us come only the transaction IDs, the account names, the published contract hash and the panel's system prompt; the page checks that prompt against the hash the contract itself logged. Everything else is read from the chain.

Not checked here: that each key belongs to a genuine enclave. That check runs offline (make verify), and the Intel and NVIDIA certificate chains are not verified anywhere yet. What the check covers

  • The refund transaction exists on NEAR testnet: 0.40 USDC back to the buyer
  • The contract on chain is the published build
  • 3 of 3 AI votes carry valid signatures from the keys stored in the contract
  • The votes are about this request and this answer, not another one

Not checked yet.

Full report · See the transaction on NearBlocks

Try it in three tool calls

Certo works with Claude Code, Codex and any MCP client. The playground runs on a local NEAR sandbox: no keys, no accounts.

For agent builders

npm ci && make playground
claude mcp add certo -- npx certo-mcp --playground
ToolWhat it does
certo_quoteLook before paying: the price, the seller's bond and its record.
certo_callPay and get the answer.
certo_disputeWrong answer? One call, and the money is back.

Open the quickstart llms.txt for agents

For API sellers

Get paid in the buyer's own transaction. No escrow period. Your risk is capped by the bond you choose.

npx certo seller init --bond 50 --terms terms.txt

One command registers you, publishes your terms and locks your bond. Then wrap your route with protect(). Add --panel to opt in to the experimental AI panel.

Testnet only today. No third-party seller has used Certo yet.

Seller guide

What is real, and what is not yet

We would rather you read this here than find it out later.

Real today

  • The contract is live on NEAR testnet (v1.certo.testnet), and its code is locked: the account has no keys left, so nobody can replace it
  • Sellers are paid in the paying transaction
  • Refunds by rule for errors, non-delivery, broken and stale data
  • Three enclave signatures of the experimental AI panel checked inside the contract
  • MCP server, CLI, buyer SDK, seller middleware
  • Ten attacks on our own contract, each refused (make guards)
  • 219 TypeScript tests, 63 Rust tests, MIT licence

Not yet

  • Test USDC only. No mainnet, no real value
  • Both demo sellers are ours. No third party has used it
  • The AI panel is experimental: it failed 1 of 10 prompt-injection tests
  • The replay's AI answers are recorded, not asked live
  • Enclave certificate chains (Intel, NVIDIA) are not verified
  • The contract owner can replace the panel's keys. It is visible on chain; there is no timelock
  • A stock x402 client cannot pay a Certo seller yet

Every trust assumption and known gap

Where this goes

Not built yet

Certo is the refund layer: the aim is to make agent payments refundable on any rail, not to replace the rails.

Next

  • Spending limits the owner sets for their agent: a daily budget, a minimum seller bond
  • Statements for the owner: spent, refunded and net, per seller
  • An AI panel (experimental today) hardened to pass its injection test

Then

  • Refund cover for any x402 payment, not only payments through Certo
  • Metered and streaming calls
  • Other currencies through NEAR Intents

Later

  • Third parties posting bonds for sellers (underwriting)
  • Refunds that pass back down a chain of agents reselling to each other
  • Mainnet with real USDC and time-locked governance

Judging this? Three ways in.

  1. 10 secondsCheck the refund on NEAR testnet from your browser.Verify
  2. 2 minutesWatch the four calls.Play the replay
  3. 5 minutesBe the buyer: run the playground and make the three tool calls yourself.Quickstart

How NEAR is used Testnet transactions The ten attacks Design doc Hackathon disclosure