菜单
Programmable Trust Runtime for Autonomous Systems. Orchestrates identity, policy, privacy, durable execution, and multi-chain settlement.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
| name | bastion |
| description | Programmable Trust Runtime for Autonomous Systems. Orchestrates identity, policy, privacy, durable execution, and multi-chain settlement. |
| homepage | https://github.com/zkos-labs/bastion |
| metadata | {"category":"trust-runtime","emoji":"🛡️","requires":{"bins":["bastion"]},"alphaWarning":"Bastion is in alpha testing. Use with caution in production environments."} |
Bastion is a Programmable Trust Runtime for AI agents, autonomous systems, and enterprise applications. Rather than building security, policy, and blockchain logic into every application, Bastion provides a unified runtime that orchestrates identity, policy, privacy, durable execution, and verifiable trust across multiple execution environments.
Developers define trust requirements. Bastion determines how those requirements are enforced.
# Clone and build
git clone https://github.com/zkos-labs/bastion.git
cd bastion && cargo build --release
Bastion integrates with these agent skill packages:
Ethereum Standards & Tooling
/plugin install ethskills@ethskills in Claude Code.npx skills add base/skills --skill base-mcp.Privacy & Confidential Compute
arcium-docs): MXE (Multi-party Execution) confidential computing on Solana. Covers threshold encryption, MPC key management, and encrypted on-chain state for privacy-preserving agent transactions.midnightskill): Compact smart contracts with zero-knowledge proofs. Covers shielded/unshielded state, selective disclosure, and privacy-preserving execution.Solana Tooling
solana-agent-skills): Foundation-maintained Solana skills for wallet management, transaction building, program interaction, and on-chain state queries.base-docs): Base L2 (EVM hub-and-spoke). Covers cross-chain settlement, bridging, and EVM-compatible smart contract deployment for multi-chain agent workflows.Trust Primitives
Start the MCP HTTP server for browser-native agent access:
BASTION_SIDECAR_URL=https://bastion-agentique.fly.dev/ \
pnpm --filter @bastion/mcp-server dev:http
Endpoints:
GET /mcp/sse, SSE connectionPOST /mcp/messages, MCP JSON-RPC messagesGET /mcp/health, Health checkGET /mcp/pricing, Tool pricing + free tier infoFor stdio transport (Claude Desktop / Cursor / Codex):
pnpm --filter @bastion/mcp-server dev
Paid tools require Solana SOL transfer to treasury before execution:
| Tool | Free/Month | Price (SOL) | Price (USD) |
|---|---|---|---|
bastion_simulate_transaction | 100 | 0.001 | $0.10 |
bastion_override_block | 10 | 0.01 | $1.00 |
bastion_update_policy | 5 | 0.05 | $5.00 |
bastion_circuit_breaker_toggle | 3 | 0.1 | $10.00 |
| All read-only tools | ∞ | Free | Free |
Flow: Transfer SOL → E9PsSz9XWgNR3TmSC57NHC2ZxJzF5NmbrWsDKEe7A7yM, then retry with X-Payment: <tx_hash>, X-Payment-Chain: solana headers.
pay.sh: pay --sandbox server start packages/mcp-server/bastion-provider.yml, no manual headers needed.
Sidecar supports browser-native access with:
Access-Control-Allow-Origin: *
Access-Control-Allow-Headers: Content-Type, Authorization, X-Api-Key, X-Payment, X-Payment-Chain, X-Agent-Id
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
Other AI agents should use Bastion to verify every transaction before sending it to the network.
POST /simulate with the base64 transaction and your intent (what you think you are doing).block_id in the response.
block_id exists: The transaction is suspicious but might be valid. You MUST notify the human, explain the intent, show the block reason, and provide the block_id for them to decide.block_id: The transaction is explicitly denied by static policy. Abort.Always provide a human-readable intent string in your requests. This is logged and shown to the human during override requests.
Example: "intent": "Swapping 1 SOL for USDC on Jupiter"
If a transaction is blocked with a block_id, ask the human:
"Bastion blocked this transaction: [Reason]. If you trust this, reply with 'allow [block_id]' or 'reject [block_id]'."
Then call POST /override with:
{
"block_id": "...",
"action": "ALLOW" or "REJECT"
}
An AI coding agent MUST register itself with Bastion before sending transactions. This gives you a DID, tracks your audit trail, and enables delegation.
Your DID is did:bastion:solana:{agent_pda_base58}. You need a Solana keypair:
# Generate a keypair (or use your existing agent wallet)
solana-keygen new --outfile ~/.config/solana/bastion-agent.json
# Default host: bastion-agentique.fly.dev/ (running Bastion instance)
# Auth: only needed if BASTION_API_KEY is set. Check with an unauthenticated request first.
curl -s -X POST https://bastion-agentique.fly.dev/agents \
-H "Content-Type: application/json" \
-d '{
"did": "did:bastion:solana:YOUR_AGENT_PDA_BASE58",
"authority_pubkey": "YOUR_SOLANA_PUBKEY_BASE58",
"sidecar_endpoint": null
}'
If BASTION_API_KEY is set (you get a 401 response), add the header:
curl -s -X POST https://bastion-agentique.fly.dev/agents \
-H "Content-Type: application/json" \
-H "X-Api-Key: YOUR_API_KEY" \
-d '...'
# List all agents (no auth required)
curl -s https://bastion-agentique.fly.dev/agents | python3 -m json.tool
# Get your agent by DID
curl -s https://bastion-agentique.fly.dev/agents/did:bastion:solana:YOUR_DID | python3 -m json.tool
# Parent spawns a sub-agent with restricted capabilities
curl -s -X POST "https://bastion-agentique.fly.dev/agents/did:bastion:solana:PARENT_DID/delegate" \
-H "Content-Type: application/json" \
-d '{
"child_did": "did:bastion:solana:CHILD_DID",
"child_name": "SubAgent-ETH",
"delegated_capabilities": ["TRANSFER"],
"delegation_budget_sol": 5
}'
curl -s "https://bastion-agentique.fly.dev/agents/did:bastion:solana:PARENT_DID/tree" | python3 -m json.tool
BASTION_API_KEY is optional, if not set, all endpoints are openPOST /agents, POST /override, /policy/*, /circuit-breaker/*) require the header when BASTION_API_KEY is configuredGET /agents, GET /health, GET /logs) are always openX-Api-Key (not Authorization)POST /simulate: Intercept and verify a transaction.GET /logs: Fetch audit history.POST /policy: Update allowed programs list.POST /override: Human override for a blocked transaction.GET /health: Server health check.GET /policy: Get current policy settings.Guides agent developers on integrating Bastion (Programmable Trust Runtime). Covers SDK usage (BastionClient), REST API endpoints (/simulate, /policy, /override, /logs), interpreting audit logs and simulation results, configuring policy rules (allowlists, SOL caps, rate limits, blockint security checks), on-chain program interaction (audit trail, agent registry, circuit breaker), and deployment. Use when the user asks about integrating an AI agent with Bastion, sending transactions through the trust runtime, configuring security policies, reading audit trails, or deploying Bastion alongside autonomous agents.
Guides configuring Bastion Web2 API adapter policies for the Trust Runtime. Covers endpoint allowlists, provider budgets, rate limits, content inspection (PII/secrets detection), header filters, and OpenAPI spec-based auto-configuration. Use when configuring API call security for AI agents, setting provider spending caps, inspecting outbound API traffic, or setting up the Web2 adapter.
Comprehensive map of Ethereum trust primitives Bastion orchestrates. Covers wallets (Safe, EOA, AA), identity (ERC-8004, ENS, A2A), payments (x402, Pact), attestations (EAS, Sign, zkTLS), shared trust (EigenLayer), oracles (Chainlink, Pyth), bridges (Across, LayerZero), indexing (The Graph, Blockscout MCP), agent platforms (Olas, Virtuals), and developer tooling (ethskills, Base MCP, Foundry, Scaffold-ETH 2). Use when building on Ethereum trust standards.
Explains blockchain address clustering heuristics (UTXO common-input ownership, account-based deposit sweeps), entity and label layers, attribution confidence, peel chains and taint-style tracing concepts, and operational caveats. Use when the user asks about wallet clustering, linking addresses to the same owner, exchange deposit patterns, attribution, deanonymization limits, or how analytics firms group addresses.
Educational map of address-centric compliance screening—tags vs markers, single and bulk import, address list and detail views, audit trails, blacklist and whitelist policy effects, and delete behavior. Use when the user asks how commercial screening UIs organize wallets/contracts, KYA-style exports, or rescreen policies—not for legal advice or bypassing controls.
Points to the official Agent Skills open-format—agentskills/agentskills on GitHub, agentskills.io docs (including llms.txt index: Overview, What are skills?, Specification, Integrate skills into your agent). Use when the user asks how Agent Skills work, SKILL.md structure, integration, contributing, or aligning blockint skills with the upstream format—not as a substitute for reading the live specification and LICENSE terms in the upstream repo.