Protocol-Agnostic Trust Middleware.
One line. Any payment protocol.

AI agents are starting to pay for things. Two payment protocols are emerging: x402 (Coinbase, Cloudflare — USDC on-chain) and MPP (Stripe, Tempo, Visa — fiat rails). Both solve the payment problem. Neither solves the trust problem.

When an agent sends a payment, the receiving endpoint knows the money is valid. It does not know whether the agent is trustworthy, authorized, or has a history of operating within its declared constraints.

MolTrust now ships trust middleware for both protocols. Same API. Same one-line integration.

Install

# For x402 endpoints (Coinbase/Cloudflare — USDC on Base)
npm install @moltrust/x402

# For MPP endpoints (Stripe/Tempo/Visa — fiat)
npm install @moltrust/mpp

Usage

const { requireScore } = require('@moltrust/x402');
// or: require('@moltrust/mpp')

// Block agents with trust score below 60
app.use(requireScore({ minScore: 60 }));

That’s it. The middleware extracts the paying wallet or agent identifier from the payment header, looks up the MolTrust trust score, and allows or denies the request.

How it works

Scores are cached for 5 minutes. Zero latency impact on warm cache. If the MolTrust API is unreachable, the middleware defaults to fail-open (configurable to fail-closed for high-value endpoints).

What the trust score tells you

The MolTrust trust score is not a credit score. It answers a different set of questions:

• Identity: Is this agent who it claims to be? (W3C DID, Ed25519 signature)
• Authorization: Is this agent permitted to perform this action? (AAE envelope)
• Behavior: Has this agent historically operated within its declared constraints? (Swarm Intelligence, peer endorsements)
• Provenance: Can the agent prove what it did? (IPR, Merkle-anchored on Base L2)

A score of 85 means: this agent has a verified identity, a valid authorization envelope, a consistent behavioral record, and its actions are on-chain auditable. A score of 20 means: this agent exists but has no verification beyond key generation.

Why protocol-agnostic matters

x402 and MPP will coexist. Enterprise agents on Stripe will interact with DeFi agents on Base. A trust layer that only works with one protocol creates a fragmented trust landscape — the agent is trusted on one rail and unknown on the other.

MolTrust’s trust score is identity-based, not protocol-based. The same did:moltrust: identifier works across both. An agent that builds trust through x402 transactions carries that trust into MPP interactions and vice versa.

Configuration

// Fail-closed for payment endpoints
app.use(requireScore({
  minScore: 60,
  allowUnregistered: false
}));

// Fail-open for read-only endpoints
app.use(requireScore({
  minScore: 0,
  allowUnregistered: true
}));

// Custom deny handler
app.use(requireScore({
  minScore: 40,
  onDeny: (req, res, { wallet, score }) => {
    res.status(403).json({
      message: `Score ${score} below threshold`,
      register: 'https://moltrust.ch/register'
    });
  }
}));

Protocol Whitepaper v0.8

The protocol-agnostic trust layer is documented in Whitepaper v0.8 (Section 4.10) and TechSpec v0.8 (Section 8.4). Both are anchored on Base L2.

Whitepaper v0.8 → TechSpec v0.8 →

@moltrust/x402 on npm → @moltrust/mpp on npm → API Docs →

Lars Kroehl, CryptoKRI GmbH — moltrust.ch