Free · MIT-licensed · Safe{Core}
AI co-signers on your multisig.
Out of the box, they sign nothing.
SAGE puts two AI agents on a 2-of-3 Safe next to you. They read the real transaction, check it against your policy, and either co-sign, hold it for you, or refuse. The policy engine has no model in it. The model can propose and explain. It never decides.
Your agents. Your keys. Your rules.
No single key moves funds. An agent signature is never enough on its own.
How a signature happens
Ground truth, not caller claims.
When you ask SAGE to approve, it ignores whatever the caller says about the transaction and works from the chain's own record.
- Fetchthe real pending transaction from the Safe Transaction Service.
- Decodethe native value, plus any ERC-20 transfer hidden in the calldata.
- Evaluatea trusted context built only from those facts against the owner's policy.
- Verifyon AUTO_SIGN, rebuild the exact tx, re-derive the EIP-712 SafeTx hash, and refuse on any mismatch.
Where the agent's authority ends
Not in the prompt. In config you own.
Every pending transaction gets exactly one of three outcomes, and an unknown fact always resolves to hold.
AUTO_SIGNevery policy condition is met on the real transactionHOLD_HUMANover a limit, unknown value, off-hours, new address, KYC/AML not clearREJECTan AML flag on the address or amount
// sage-config.json · example policy
"auto_sign": {
"max_value_usd": 3000,
"allowed_tokens": ["USDT","USDC","ETH","BNB"],
"requires_kyc": true,
"requires_aml_clear": true,
"allowed_hours": { "start": 9, "end": 18 },
"allowed_days": [1,2,3,4,5]
},
"always_human": {
"above_usd": 10000,
"new_address": true,
"aml_flagged": true,
"outside_hours": true
}
Fail-closed by design
The default install feels useless. That is the point.
No oracle, no auto-sign
There is no price oracle in scope, so a transaction's USD value is unknown, and unknown can never slip under a limit.
Compliance starts closed
KYC/AML is treated as unverified until you wire a real provider. Until then every payment waits for you.
Loosen one rule at a time
You relax policy deliberately, and every decision lands in an append-only audit log.
Even a compromised agent can't steal
Three walls between an agent and your funds.
Keyless signing
The agent computes the EIP-712 hash and asks a vault (Warden, HashiCorp Vault Transit, a KMS) for a signature. The key never enters the agent's process, and a signature that doesn't recover to the expected owner is refused.
The threshold
2-of-3 means no agent reaches the threshold alone. The proposal agent can propose and never co-sign to threshold, and vice versa, each in its own container.
Hardware 2FA
Owner approval can require a Trezor or YubiKey touch, bound to the exact batch of transaction hashes, valid for a short TTL, with its nonce burned on use.
Two editions, one engine
SAGE is the foundation you can inspect.
CRIPTOGRAFIA PRIVATE is the private bank built on top of it, for families and companies.
Run it
Talk to your wallet from Claude.
SAGE is an MCP server (JSON-RPC over stdio) and a CLI. It runs as a single process or in Docker, on Ethereum Sepolia today.
Still unfinished, and said plainly: compliance is a stub until a real KYC/AML provider is wired in.
git clone https://github.com/criptografia-app/sage cd sage npm install npm test # offline suites, no funds needed node setup.js # agent keys, added as owners, 2-of-3 # then point Claude Desktop at the MCP server: # "command": "node", "args": ["/path/to/sage/sage.js"]