Machine productContract v1.0.0

One agent. One tool server. One compatibility verdict you can inspect.

The Agent Infrastructure Compatibility Pack exercises one A2A agent and one MCP server against caller-declared tool, task and payment policy. It returns source-linked, hashed findings—not a generic market report or a certification badge.

Machine contract ↗Sample JSON report ↗

Scope

Fixed price, bounded scope.

Fixed price

49.00 USDC

Base Mainnet, 49,000,000 base units. The live challenge will be authoritative once payment is promoted.

Bounded scope

1 A2A + 1 MCP

One declared non-mutating skill and tool. JSON-RPC only. No open-ended scanning.

Current status

Contract published

Payment remains withheld until durable delivery and automatic refund recovery pass Production E2E.

The report

What the report answers

Identity & protocol

Discovery bound

Agent Card, RPC URL, tools/list inventory, declared methods and schema evidence are captured with timestamps and hashes.

Policy

Allowlist enforced

The selected skill, tool, methods, timeout and per-call/task payment ceilings are evaluated without silently broadening policy.

Payment

Challenge inspected

Network, asset, payee and amount are compared with policy. Maha never holds the buyer key or settles an upstream payment.

Auditability

Evidence attached

Every finding carries a bounded observation, source URL, observed time and SHA-256 digest.

Worked example

Sample decision: conditionally compatible

2 passed1 failed1 not checkedHighest severity medium

identity — pass

The Agent Card was reachable, parseable and bound the declared skill to the tested RPC URL.

policy — pass

tools/list exposed the declared non-mutating tool and the allowlist admitted only that tool.

payment — fail

The upstream challenge fit the per-call ceiling but could not be proven against a durable multi-call task budget.

payment — not_checked

No upstream payment was signed or settled by this assessment.

Boundaries

Failure, refund, and limitations

Failure and refund behavior

  • No charge: invalid schema, unsafe target, unreachable preflight target, or unsupported authentication.
  • Report, no refund: incompatibility, policy rejection, target timeout/error, or payment terms outside policy. Those are the findings purchased.
  • Full automatic refund: Maha fails after settlement, cannot confirm durable report storage, or misses the delivery target.
  • No duplicate charge: retries bind clientRequestId to the input hash and return the original report.

Limitations

  • Point-in-time compatibility evidence, not continuous monitoring or certification.
  • JSON-RPC request/response only; SSE, push notifications, file parts and webhooks are not exercised.
  • One caller-declared non-mutating A2A skill and one caller-declared non-mutating MCP tool are exercised.
  • Upstream x402 challenges are inspected against policy, but Maha does not hold a buyer key, sign, or settle an upstream payment.
  • Not a penetration test, vulnerability assessment, legal opinion, compliance certification or uptime guarantee.
  • Version 1 supports public endpoints and bearer credentials supplied for the run; interactive OAuth and mTLS are out of scope.