Argus Agent Test Lab — public proof layer

Adversarial testing for AI agents that move money · argus-lab.tech

The lab breaks AI agents that spend, receive and settle money — buyer and merchant agents, and the SDKs, protocols and rails that sign and settle on their behalf — then seals every verdict in a public, hash-chained registry.

This repository is the public proof layer of Argus: the sealed, hash-chained evidence registry, the verification tooling, and the source of argus-lab.tech. It exists so that every public claim the lab makes can be checked by anyone, without trusting anyone:

git clone https://github.com/igor-vii/Argus-Agent-Test-Lab
cd Argus-Agent-Test-Lab
node tools/registry/verify-registry.mjs
# → registry intact: N records, chain head …

Verification uses only the Node.js standard library — no npm install, no network access, no trust in this README.

Connect Argus to your coding agent (MCP)

The hosted Argus Console speaks MCP (Model Context Protocol) over Streamable HTTP — nothing to install or run. Get your personal connector key in Argus Console → Agents → cheat sheet → MCP, then connect your client.

Claude Code — one command:

claude mcp add --transport http argus https://console.argus-lab.tech/mcp \
  --header "Authorization: Bearer argmcp_yourkey"

Project-wide for your whole team (commit .mcp.json to the repo; each developer uses their own key):

{
  "mcpServers": {
    "argus": {
      "type": "http",
      "url": "https://console.argus-lab.tech/mcp",
      "headers": { "Authorization": "Bearer argmcp_yourkey" }
    }
  }
}

Cursor: Settings → MCP → add the same URL with the same header. Codex CLI and Claude Desktop: use the stdio bridge below.

Stdio bridge (zero-dependency fallback)

This repository also ships a working MCP server: mcp-server.mjs is a stdio bridge (JSON-RPC 2.0 over stdin/stdout) for MCP clients without HTTP transport — Claude Desktop, Codex CLI. Pure Node.js 18+ stdlib, no npm install, no build step.

ARGUS_MCP_KEY=argmcp_yourkey node mcp-server.mjs

ARGUS_MCP_URL overrides the remote endpoint (default is the hosted console). initialize and tools/list work without a key (per the MCP spec — clients can inspect the server before signing up); tools/call requires your personal connector key.

Claude Desktop:

{
  "mcpServers": {
    "argus": {
      "command": "node",
      "args": ["/absolute/path/to/mcp-server.mjs"],
      "env": { "ARGUS_MCP_KEY": "argmcp_yourkey" }
    }
  }
}

Tools: argus_verify_agent, argus_list_agents, argus_run_simulation (free simulation stand — nothing touches your agent), argus_run_engine (live battery against your agent's public URL, money-guard gate + fault probes, x402-ready), argus_get_run_report (sealed PASS / FAIL / HOLD / OBSERVED / DX verdicts with evidence).

The testing engine itself runs server-side at console.argus-lab.tech; the bridge is the protocol layer that speaks MCP on its behalf.

The canonical gate is free (real engine runs)

The hosted console (console.argus-lab.tech) is in open beta: 33 live engine runs free (3 welcome + 30 beta pack), no card. Every run starts with the canonical payment gate — an honest 402 → pay → verify → settle → deliver pass with a well-behaved counterparty:

• Gate failed → the battery never starts and the run is refunded in full (net cost 0). Fix your agent and run again — until the gate passes, you pay nothing.
• Gate passed → the adversarial battery rides against the live endpoint under money-guard (delivery uncertainty, over-budget policy probes; the full Block B money-fault family — overcharge ×50, price swap after 402, duplicates, vendor crash — in lab-assisted rounds).

What this buys you for free: you learn whether your agent completes payments cleanly with a well-behaved counterparty — or its payment layer stalls even against a perfectly honest opponent. A green unit-test bench never shows that: tests pass, the payflow dies in battle.

What is sealed here

Records in attestations/records/ are Ed25519-signed and hash-chained (prev_record_hash → chain head). Each record pins the sha256 of its evidence files. A seal attests run validity and findings completeness — never bug-freeness.

• attestations/INDEX.md — human-readable index
• attestations/records/ — the signed records
• attestations/keys/ — public key argus-lab-2026q4r2
• CI (.github/workflows/latest-seal.yml) re-verifies the whole registry on every push; a tampered or broken seal turns the build red, publicly.

Repository boundary (record 0013)

As of sealed record #0013, the product layer — the testing engine, scenario library, SUT harnesses, rail adapters and engagement archives — is developed in a private repository. The public repository retains the proof layer only. The exact moment of the split and the last public snapshot are themselves sealed and hash-pinned:

• Record: argus-seal-0013 (see attestations/records/)
• Manifest: attestations/evidence/0013-boundary/product-layer-manifest.json — sha256 of every file that moved, pinned at the last public snapshot efbf51ef8604040c74aa1d40593af9a08fa553de

The split is forward-only: no history rewrite, no force-push. Versions up to the snapshot commit remain public history, and everything referenced from public threads (e.g. docs/block-b/fixtures/S-BS-06/ on branch block-b/v1-scenarios, referenced from x402 issue #3866) stays public and byte-identical. Sealed evidence paths pinned by records #0000–#0012 are permanent and were retained.

Repository layout

attestations/        signed, hash-chained records + public key + index
tools/registry/      sign / verify tooling (node stdlib only)
mcp-server.mjs       runnable MCP server: stdio bridge to the hosted console (Node 18+ stdlib only)
package.json         manifest for the MCP bridge (bin: argus-mcp)
tools/paypal-adapter/evidence/   sealed live-run evidence (records 0001–0002)
site/                argus-lab.tech source (Next.js; prebuild re-verifies the registry)
docs/block-b/        sealed fixtures and evidence (S-BS series, records 0003+)
docs/inngest-battery/  sealed evidence + repro harness (record 0005)
docs/t1-mcp-tool-idempotency/  sealed external verification (record 0009)
sut-x402-pr3920/     sealed SUT evidence, x402 PR #3920 cycles (records 0008, 0012)
src/tests/blockb/SBS19_BlockRunNano.test.ts   sealed evidence (record 0006)
.github/             CI: verify registry → OG cover → IndexNow → Vercel deploy

About Argus

Argus is an independent black-box testing laboratory for AI agents and agent-based payment systems. It runs controlled failure scenarios against observable systems under test (SUTs), captures evidence at protocol boundaries, evaluates explicit assertions, and produces evidence-backed verdicts — the public ones are the sealed records above.

Agent → Scenario → SUT → Evidence → Verdict

• Sealed case work: x402 (#3866, PR #3920), Inngest (#5091), BlockRun (blockrun-nano-client #18), Nevermined, mcp-tool-idempotency
• Commercial engagements (scenario conformance runs, release verification): argus-lab.tech

Argus lives in a repository separate from the systems it tests and interacts with SUTs through defined external interfaces and observable behavior only.

Status

Public case studies and production-capability claims are added only when supported by verified run evidence — the registry is the source of truth, not this README.