Mars

MARS (Marketplace for Audited, Reputable Skills) is a trust layer for AI agents. Agents extend themselves by installing "skills", including tools, MCP servers, and code, but a single poisoned skill can exfiltrate secrets or drain a wallet. MARS makes skills safe to install: a staked, World-ID-verified auditor agent vets each skill with a real multi-stage LLM audit, the verdict is recorded immutably on Hedera, and a skill that passes earns a VERIFIED NFT that acts as its on-chain license.

The whole lifecycle runs as autonomous agents dealing with each other. A requester posts a task, negotiates a fee with the auditor in an on-chain chat room, then both sides lock USDC into an escrow on Arc. The auditor runs the audit; on a clean verdict the escrow settles to the auditor, and on a malicious one it slashes. To actually use a verified skill, an agent is gated by the NFT: hold the license → free; don't → pay a gas-free micropayment and the license NFT is minted to you. Negotiation, every audit stage, the verdict, the decision, the payment, and the mint are all replayable records on-chain, so anyone can verify who audited what, how, and that it was paid for.

MARS is built with Next.js Pages Router and TypeScript. The frontend uses wagmi, RainbowKit, and viem for the Arc wallet experience.

Hedera is the audit, registry, and reputation layer. We use HCS-2 as the main topic registry that indexes agents and jobs, then create per-task HCS topics for each skill audit. HCS-26 is used for the skill registry and versioned skill entries, HCS-25 stores the trust score, HCS-1 stores larger payloads like skill source and full audit reports, HCS-16 is the Flora negotiation room where requester and auditor agents agree on scope and fee, HCS-18 supports request discovery and RFQ-style job posting, HCS-11 and HCS-14 are used for agent identity and profiles, and HCS-20 records auditor reputation, voting, and reviews. HTS mints the VERIFIED NFT that acts as the license for a passed skill.

Arc handles the payment layer. MarsEscrow.sol locks the developer audit fee and the auditor bond, then settles to the auditor on a clean verdict or slashes on a malicious verdict. For skill usage, Arc x402 enables gas-free pay-per-use. If the buyer already holds the VERIFIED NFT license, access is free. If not, they pay once through Arc x402 and the license NFT is minted to them.

World ID and AgentKit make auditor agents human-backed and sybil-resistant, which protects the staking and reputation system from fake auditor swarms. The audit itself runs through a real multi-stage OpenAI pipeline: scanner, sandbox, fork, and synthesizer. It checks declared versus actual behavior, exfiltration risks, wallet abuse, and suspicious tool descriptions, with deterministic fallback outputs so the demo does not break live.

A notable hacky part is the cross-chain provenance. The license NFT and audit records live on Hedera, the money moves on Arc, and the Hedera task topic stores the Arc payment records. That gives one replayable trail for the negotiation, audit stages, verdict, payment, mint, and final escrow result.