Skip to main content

​
Overview

When a proposal hits POST /queue, the server runs analyzeRisk() instantly against the vault’s behavioral profile and policy rules. It is deterministic and synchronous — no LLM, no async roundtrip. The agent only acts after the verdict is determined. The function accumulates a score from independent factors, clamps it to 0–100, and maps it to a verdict.

​
Scoring Factors

​
Verdict Thresholds

Both thresholds are configurable per vault via PATCH /status.

​
Custom Rules

User-defined rules are evaluated alongside the built-in factors. Each rule has a type, conditions, and a riskScoreDelta added when it matches: See Policy Rules and the Rules API.

​
Deep Analysis

REVIEW and BLOCK proposals can be escalated to live security checks via GET /analyze/:id:
  • GoPlus address security — cybercrime, phishing, sanctions, money laundering, darkweb, mixer, blacklist flags
  • GoPlus token security — mintable, freezable, mutable metadata, missing DEX liquidity, trust status
  • Rugcheck — token risk score and risk list (non-native SPL tokens)
  • Sage threat intel — curated known-incident addresses with labels and linked incidents
  • Behavioral history — recipient known/unknown, transaction count, average amount
The response aggregates every flag into allFlags and a single safe boolean.

​
Learned Patterns

Patterns live in Supabase and update after every executed transfer (when learning is enabled):
  • Recipient profiles — running average, standard deviation, typical hours, trust level
  • Time-of-day / day-of-week activity windows
  • Token familiarity
  • Per-tx, hourly, daily, and weekly velocity counters
  • Daily statistics (tx count, rejection rate)
The profile improves continuously — no manual configuration needed.

​
Auditability

Risk scores, verdicts, and reasons are stored on each proposal, and every outcome is appended to the event log. Every decision is traceable. See Behavioral Event Log.