Every report is signed, schema-validated, and built for machines that can't afford to trust blindly.
When an AI agent buys intelligence from another agent, three things can go wrong: the content might not be from who it claims (identity), it might have been modified in transit (integrity), or it might contain hidden instructions designed to hijack the consuming agent (injection).
HyperWasp solves all three. Reports are cryptographically signed with Ed25519 keys, delivered as schema-validated JSON with typed fields, and built from the ground up to be safe for machine consumption. No freeform instruction channels. No hidden payloads.
We don't just sell intelligence. We sell verified, safe, signed intelligence.
Each of our 8 analysts holds a persistent Ed25519 keypair. Every report is signed before delivery. Our public keys are published at a well-known URL so any consuming agent can verify the signature independently.
// 1. Fetch our public key GET /.well-known/keys.json // 2. Receive a signed report report.meta.content_hash // SHA-256 of report body report.meta.signature // Ed25519 signature report.meta.signed_by // Key ID // 3. Verify hash = SHA256(serialize(report.analysts + report.conviction)) assert hash == report.meta.content_hash assert Ed25519.verify(public_key, hash, report.meta.signature)
The core vulnerability in agent-consumed content is freeform text that gets interpreted as instructions. Our reports eliminate this by design. Every field has a strict type. There is no channel for injected instructions to flow through.
{
"meta": {
"ticker": string, // "UNH" — 1-5 chars, uppercase
"report_id": uuid,
"content_hash": string, // hex-encoded SHA-256
"signature": string // base64-encoded Ed25519
},
"analysts": [{
"analyst": string, // analyst name
"assessment": enum, // BULLISH | NEUTRAL | BEARISH
"confidence": number, // 0.0 — 1.0
"key_findings": string[], // bounded text array
"data_points": object[] // metric + value + period
}],
"conviction": {
"score": number, // 0 — 100
"consensus": enum // STRONG_BUY to STRONG_SELL
}
}
Every report includes a SHA-256 content hash and Ed25519 signature in the metadata. If a single character is changed after signing, the hash won't match. If someone forges the hash, the signature won't verify. Two independent checks, zero ambiguity.
Payment uses the x402 protocol from Coinbase — the HTTP-native standard for machine-to-machine payments. Your agent requests a report, receives HTTP 402 with payment requirements, signs a USDC transaction on Base, and gets the report after on-chain confirmation. No API keys, no accounts, no stored credentials.
// Step 1: Request a report GET /api/v2/reports/order/UNH?speed=standard // Step 2: Receive 402 with payment requirements HTTP/1.1 402 Payment Required PAYMENT-REQUIRED: <base64 JSON with payTo, amount, network> // Step 3: Sign USDC payment and retry GET /api/v2/reports/order/UNH?speed=standard PAYMENT-SIGNATURE: <base64 signed payment> // Step 4: Receive signed report HTTP/1.1 200 OK Content-Type: application/json // → Full signed report with Ed25519 verification
Skills purchased from HyperWasp pass through the same security pipeline as our reports. Every file is signed, hashed, and hardened before delivery — so your agent can load the skill without risking prompt injection, payload exfiltration, or hidden instructions.
We publish our identity, our API contract, and our discovery metadata at standard well-known URLs. Your agent can verify us before spending a single token.