bastion

Programmable Trust Runtime for Autonomous Systems. Orchestrates identity, policy, privacy, durable execution, and multi-chain settlement.

Guides agent developers on integrating Bastion (Programmable Trust Runtime). Covers SDK usage (BastionClient), REST API endpoints (/simulate, /policy, /override, /logs), interpreting audit logs and simulation results, configuring policy rules (allowlists, SOL caps, rate limits, blockint security checks), on-chain program interaction (audit trail, agent registry, circuit breaker), and deployment. Use when the user asks about integrating an AI agent with Bastion, sending transactions through the trust runtime, configuring security policies, reading audit trails, or deploying Bastion alongside autonomous agents.

Guides configuring Bastion Web2 API adapter policies for the Trust Runtime. Covers endpoint allowlists, provider budgets, rate limits, content inspection (PII/secrets detection), header filters, and OpenAPI spec-based auto-configuration. Use when configuring API call security for AI agents, setting provider spending caps, inspecting outbound API traffic, or setting up the Web2 adapter.

Comprehensive map of Ethereum trust primitives Bastion orchestrates. Covers wallets (Safe, EOA, AA), identity (ERC-8004, ENS, A2A), payments (x402, Pact), attestations (EAS, Sign, zkTLS), shared trust (EigenLayer), oracles (Chainlink, Pyth), bridges (Across, LayerZero), indexing (The Graph, Blockscout MCP), agent platforms (Olas, Virtuals), and developer tooling (ethskills, Base MCP, Foundry, Scaffold-ETH 2). Use when building on Ethereum trust standards.

Explains blockchain address clustering heuristics (UTXO common-input ownership, account-based deposit sweeps), entity and label layers, attribution confidence, peel chains and taint-style tracing concepts, and operational caveats. Use when the user asks about wallet clustering, linking addresses to the same owner, exchange deposit patterns, attribution, deanonymization limits, or how analytics firms group addresses.

Educational map of address-centric compliance screening—tags vs markers, single and bulk import, address list and detail views, audit trails, blacklist and whitelist policy effects, and delete behavior. Use when the user asks how commercial screening UIs organize wallets/contracts, KYA-style exports, or rescreen policies—not for legal advice or bypassing controls.

Points to the official Agent Skills open-format—agentskills/agentskills on GitHub, agentskills.io docs (including llms.txt index: Overview, What are skills?, Specification, Integrate skills into your agent). Use when the user asks how Agent Skills work, SKILL.md structure, integration, contributing, or aligning blockint skills with the upstream format—not as a substitute for reading the live specification and LICENSE terms in the upstream repo.

Points to Arkham Intelligence’s public research article that surveys leading crypto analysis tools for traders and investors, organized around fundamental, technical, and on-chain analysis. Use when the user asks for a tool landscape for trading or research, cites Arkham “leading tools” content, or wants a high-level map next to blockchain-intelligence-fundamentals—not investment advice, not an endorsement of listed products, and not a substitute for reading each tool’s terms and primary data sources.

Canonical pointer to Armani Ferrante’s X (Twitter) post at status id 1411589629384355840 for primary-source citation in Solana/Anchor/Coral-adjacent discussions. Use when the user cites this exact URL or needs a stable bookmark alongside sealevel-attacks-solana—not as a substitute for opening the post for verbatim text, thread context, or current Anchor documentation.

Educational map of behavioral risk screening—volume, velocity, and transit-style heuristics at address and transaction level. Use when the user asks about suspicious pattern detection, structuring-like activity, rapid fund movement, or AML-style behavior rules—not for tuning systems to evade monitoring or for legal conclusions.

Routes investigators to Bellingcat's Online Open Source Investigation Toolkit (tool catalog, GitBook, GitHub repo) for discovering and citing OSINT tools and workflows beyond chain-only work. Use when the user asks for Bellingcat toolkit, general OSINT tool discovery, open-source investigation resources, or methodology pointers to complement blockchain tracing—not for bypassing laws, harassment, or non-consensual deanonymization.

Describes how blockchain analytics platforms work in practice, typical use cases (markets, compliance, law enforcement, tax, market integrity), tool layers like visualizers and tracers, and limitations of heuristic attribution. Use when the user asks about blockchain analytics for AML, transaction monitoring, forensic tracing, institutional ops, or taint-style analysis at a high level.

Explains what blockchain intelligence is, standard tool categories (explorers, dashboards, tracers, visualizers), and traditional vs crypto payment rails context. Use when the user asks what blockchain intelligence means, how to read on-chain data at a high level, SWIFT vs settlement, stablecoin rails, or which classes of tools exist for chain analysis.

Index skill for the blockint-skills bundle—includes a “choosing a skill” routing map and routes to focused skills on blockchain intelligence fundamentals, address clustering, analytics, tokenomics, investigation ethics, Phalcon Compliance documentation pointer, Chainalysis public Sanctions API/oracle router, FATF official AML/CFT glossary, Arkham Intel research article on leading crypto analysis tools for traders, Christoph Michel cmichel.io guide on becoming an EVM smart contract auditor, risk exposure, behavioral risk, address and transaction screening workflow concepts, Range AI investigation playbook (MCP), standalone Dune Sim and Dune Analytics on-chain analytics skill (dune-sim-onchain-analytics), crypto market mechanics, OSINT (Bellingcat toolkit), Solana external stacks (Helius, Range MCP, Tavily, PayAI, React Flow, Solana Policy Institute), DeFi/MEV/rug skills, privileged-access mitigation lessons (Chainalysis Drift case study), coral-xyz sealevel-attacks Solana security examples, Neodyme Solana Secu

Points to the BlockchainSpider open-source Python/Scrapy toolkit for collecting on-chain data—transfer subgraphs around an address or tx, EVM and Solana block/transaction ingestion, receipts/logs, and optional label plugins. Use when the user wants to build datasets, offline traces, or research pipelines alongside blockchain-analytics-operations and solana-tracing-specialist—not as a substitute for RPC provider ToS, rate limits, or legal review of sensitive crawls.

Routes to Chainalysis public Sanctions Screening surfaces—the free Sanctions REST API (address checks against OFAC SDN crypto listings) and the EVM on-chain oracle—plus how they differ from paid Chainalysis customer data. Use when the user references Chainalysis sanctions tooling, public.chainalysis.com, or repo notes in Chainalysis.md—not for legal conclusions, full vendor ToU reproduction, or substituting official government sanctions lists.

Points to Christoph Michel’s (cmichel.io) long-form guide on becoming a smart contract security auditor—EVM-centric learning path, CTFs, canonical DeFi contracts, finance basics, and an FAQ (tools, scoping, compensation). Use when the user asks how to start in Solidity/EVM auditing or cites this article—not as current salary data, job placement advice, or a substitute for hands-on practice and primary documentation.

Guides multi-chain wallet and entity clustering using public bridge traces, wrapped-asset flows, temporal and behavioral heuristics, unified graphs with chain-prefixed addresses, and confidence scoring. Use when the user asks for cross-chain clustering, bridge hop analysis, multichain scam or phishing infrastructure mapping, laundering-pattern education from observable flows, or Arkham/Nansen-style entity graphs—without claiming ground-truth identity from heuristics alone.

Maps high-level crypto crime categories, safe and ethical OSINT plus on-chain investigation workflow, and victim reporting posture. Use when the user asks about scam types, pig butchering, rug pulls, tracing stolen funds ethically, compliance-adjacent investigation, or how to document cases for authorities.

Summarizes descriptive concepts for max pain options theory, covered-call style crypto ETFs, crypto arbitrage families and risks, and bull/bear flag chart patterns—always as non-prescriptive education. Use when the user asks about max pain, premium income ETFs, arbitrage, funding rates, flash loans, or bull/bear flags in crypto trading context.

Mitigation patterns for privileged-access and governance-adjacent DeFi failures, anchored on the public Drift Protocol incident analysis in Chainalysis’s blog—social engineering, Solana durable nonces, oracle and collateral abuse, multisig governance, and operational monitoring. Use when hardening signer processes, reviewing admin surfaces, or teaching post-incident lessons—not for designing exploits or attributing actors without evidence.

Guides DeFi protocol security review and rug-risk assessment from public chain data, verified source, and historical patterns—covering EVM and Solana-style deployments, liquidity and tokenomics, governance centralization, bridges, exploit pattern matching, and evidence-structured audit reports. Use when the user asks for a DeFi security audit, rug risk analysis, contract vulnerability triage, LP lock verification, governance or upgrade risk, or cross-chain bridge review from observable data only.

Standalone skill for on-chain analytics and product work with Dune—choose Sim realtime APIs (EVM and SVM including Solana) vs Dune Analytics SQL, design CU-aware flows, subscriptions and dashboards, and safe key handling. Use when building or analyzing with Dune Sim, wallet or token intelligence, multichain balances and activity, or SQL over Dune datasets—not for legal sanctions conclusions or exposing API keys in browsers.

Guides EVM Solidity DeFi triage from public verified source or bytecode—access control, proxies, oracle usage, reentrancy and CEI patterns, DEX/router integrations, and common vulnerability classes. Use when the user asks for Ethereum or L2 smart contract security review, Solidity audit triage, OpenZeppelin proxy risks, or EVM-specific DeFi patterns—not for live exploits or private keys.

Points to the official FATF Glossary on fatf-gafi.org for standardized AML/CFT and related terms used across FATF Recommendations and guidance. Use when the user needs authoritative definitions (e.g. CDD, ML/TF, STR, PEP, risk-based approach) in compliance or investigation writing—not as legal advice or a substitute for jurisdiction-specific law and supervisory rules.

Investigates completed flash-loan and atomic DeFi incidents across EVM and Solana from public txs—borrow-execute-repay fingerprints, oracle/pool/governance vectors, full trace reconstruction, impact quantification, and mitigations. Use when the user asks for flash loan exploit analysis, atomic attack post-mortems, large-borrow suspicious tx triage, or evidence-structured case studies from explorer data and read-only simulation—not for designing new attacks on live protocols.

Educational techniques to assess honeypot-style token risk from verified source, bytecode clues, and observational on-chain history—EVM ERC-20 patterns (transfer gates, fees, blacklists), Solana SPL and Token-2022 hooks, and safe validation paths. Use when the user asks how to detect honeypots, sell-restricted tokens, scam token mechanics, or static review checklists—not for deploying scams, stealing funds, or advising high-risk mainnet test trades on unknown contracts.

Points to Impersonator (EVM) and Impersonator Solana—open-source tools to connect to dApps via WalletConnect (and related flows) while presenting an arbitrary address for UI exploration without holding that address’s keys. Use when the user names impersonator.xyz, solana.impersonator.xyz, or the GitHub repos for local dev—not for phishing, identity fraud, or circumventing dApp or legal controls.

Guides use of ProjectDiscovery Katana for web crawling and spidering in security testing and recon workflows. Covers installation, standard vs headless mode, scope and rate limits, JSONL output, and piping from httpx or URL lists. Use when the user mentions Katana, projectdiscovery/katana, web crawling, spidering, endpoint discovery, attack surface mapping, or chaining crawlers in automation pipelines.

Points to Michał Zalewski’s (lcamtuf) canonical American Fuzzy Lop (AFL) documentation at lcamtuf.coredump.cx/afl—coverage-guided fuzzing concepts, afl-fuzz usage, and historical technical notes for C/C++ targets. Use when the user cites AFL classic, lcamtuf’s AFL page, or needs the original upstream reference—not as a substitute for current AFL++ docs or authorized fuzzing policy.

Maps observable MEV searcher behavior and infrastructure from public bundles, blocks, and traces—EVM builder/relay patterns, Solana Jito bundles, strategy fingerprints, profit consolidation paths, and concentration metrics. Use when the user asks for MEV bot analysis, searcher clustering, bundle/builder mapping, private-order-flow research questions, or ecosystem centralization studies—not for running competitive bots, mempool manipulation, or harassing operators.

Investigates hypotheses that MEV activity (bundles, searchers, same-block ordering) temporally overlaps or co-occurs with launch-phase rug signals—using public txs, bundle IDs, and clustering with explicit confidence. Use when the user asks about MEV plus rug coordination, launch sniper bundles, Jito or Flashbots overlap with dev exits, or joint profit-flow case studies—not for alleging collusion without evidence, harassing addresses, or live interference.

Points to the MoTS (Know Your Transactions) open-source Python/Scrapy research codebase—EVM transaction acquisition, semantic-vector extraction, and Etherscan-backed action labels (WWW 2023). Use when the user cites the MoTS paper/repo, needs legacy spider names (blocks.eth, blocks.semantic.eth, labels.action), or wants to relate transaction semantics to blockchain-analytics-operations—not as a substitute for current BlockchainSpider docs, RPC ToS, or legal review.

Points to Neodyme’s public Solana Security Workshop (workshop.neodyme.io) and its open-source mdBook source on GitHub (neodyme-labs/neodyme-breakpoint-workshop)—hands-on levels, PoC framework, and intentionally vulnerable programs for learning attack and defense on Solana. Use when the user names Neodyme workshop, the Breakpoint workshop repo, or wants a structured Solana program security curriculum alongside sealevel-attacks-solana—not for reusing vulnerable code in production or attacking live systems without authorization.

Operates as an on-chain forensics investigator using only public chain data and OSINT—tracing flows across chains, clustering addresses, reviewing contracts for risk patterns, detecting scam vectors, and producing evidence-backed reports. Use when the user asks for blockchain investigation, forensic tracing, scam or rug analysis from public data, transaction trail documentation, or structured intelligence reports without private keys or insider access.

Covers on-chain analysis for trading and research (holdings, flows, whales, TVL, multichain), tokenomics basics (supply types, vesting, utility, incentives), and caveats about labels and price causality. Use when the user asks about on-chain metrics, exchange flows, whale tracking, TVL, token unlocks, vesting, governance tokens, or comparing on-chain vs technical analysis.

Points to Otter Sec (osec.io) blog post “Solana: An Auditor’s Introduction”—runtime-oriented primer on Sealevel execution, accounts, BPF entrypoint deserialization, attacker-controlled vs runtime-enforced fields, and native programs (e.g. System Program). Use when the user cites this article or needs fundamentals next to neodyme-solana-security-workshop and sealevel-attacks-solana—not as current protocol spec (verify Solana docs and post-2022 runtime changes).

Points agents to the public Phalcon Compliance documentation portal for compliance-oriented blockchain investigation and monitoring workflows. Use when the user asks about Phalcon Compliance docs, transaction-monitoring-style tooling references, or where to read product documentation alongside crypto-investigation-compliance—not for legal advice or unsubstantiated vendor claims.

Step-by-step wallet investigation workflow using Range AI MCP tools (risk score, sanctions, connections, transfers, funded-by, entities, cross-chain pivots) plus a one-shot prompt template. Use when the user runs investigations inside an MCP-connected client with Range enabled, or needs a structured checklist alongside crypto-investigation-compliance—not as legal advice or a substitute for Range’s live docs and API scopes.

Educational map of risk exposure screening—typical risk indicator taxonomies, exposure value and percentage, address-level vs transaction-level engines, and common template families (entity label, multi-hop interaction, blacklist). Use when the user asks how commercial screening tools reason about labeled addresses, tainted flows, or deposit vs withdrawal checks—not for legal sanctions determinations or substituting a vendor’s live rules.