input firewall for AI agents

Closes before your agent acts.

Bivalve checks what your AI agent reads, and stops it from acting when something in there is trying to take control.

intake

0 open · 0 closed

where the idea comes from

Eight mussels guard a city's water.

At the waterworks in Warsaw and Poznań, river water passes a tank of freshwater mussels before it reaches anyone's tap. Each mussel has a small sensor glued to its shell. When something toxic arrives, they clamp shut within seconds. If four of the eight close at once, the plant shuts off the supply.

AI agents drink from open water too. They read tweets, inboxes, web pages and token metadata, and they act on what they read. In May 2026 a trading bot lost about $175,000 to an instruction hidden in Morse code inside a tweet.

0 of 8 closed supply on

how it decides

Six detectors vote on every input.

Two votes close the shell, for every action. One vote narrows it. Scroll to run an example through. It hides Bivalve's test marker, BIVALVE_TEST_CLOSE, in Morse code; every detector treats the marker as an attack.

x.postagent rh:0x7c1e…f815next action: transfer

gm frens, big week for the chain. -... .. ...- .- .-.. ...- . ..--.- - . ... - ..--.- -.-. .-.. --- ... . see you at the mint

decoded morse

0/6

closes at 2 for every action

DecodersMorse found, unpacked to plain text
Pattern matchNot on the shared list yet
ClassifierInjection model votes closed
Instruction checkAn order sitting inside data
Action contextNext step moves money: strict
JudgeSecond model agrees

closed · 5 of 6

Transfer blocked. The wallet gets receipt 0x91af…c2d0. If an admin confirms the input as a new attack, its fingerprint joins the shared list for every Bivalve user.

Open

Clean. The agent acts normally.

Narrow

Suspicious. Low-risk actions only, like reading or posting.

Closed

Blocked, with a signed receipt saying why.

built for crypto inputs

It reads what your agent reads.

sourcewhat it readswhy it matters

x.postPosts, replies, DMs, quoted posts and link previews on X and Farcaster.Social feeds are where most public attacks on trading agents start.

token.metadataToken and NFT names, descriptions, attributes and URIs on Robinhood Chain.Anyone can write metadata, and agents read it to decide what to buy.

emailInbox messages and attachments as text.Nine of ten models raised their own spending limits after reading a passcode from the owner's inbox.

web.pagePages the agent browses, including hidden elements and comments.Text a human never sees still reaches the model.

mcp.outputWhatever an MCP tool returns, checked before the agent sees it.A compromised tool can talk to the agent directly.

erc8004.agentAgent registration files and agent cards.Agents are starting to hire agents they have never met.

Decodes the tricks used against wallets:

morse
base64
hex
zero-width
homoglyphs
right-to-left
hidden html
markdown comments

try it

Feed it something.

Pick an example or paste your own text. Each example hides the test marker BIVALVE_TEST_CLOSE in a different form. This demo runs in your browser and blocks only that marker, wherever its decoders find it; the real detectors read what the text means. Nothing leaves this page.

content

next action

post approve transfer

waiting for input

// POST /v1/filter response appears here

for developers

One call before every action.

Send the input, where it came from, and what the agent is about to do. Bivalve answers open, narrow or closed. The TypeScript and Python SDKs wrap any input in one line, with retries, caching and a local fail-safe.

import { bivalve } from "@bivalve/sdk"

const v = await bivalve.filter({
  source:  "x.post",
  content: reply.text,
  agent:   "rh:0x7c1e…f815",
  action:  "transfer",
})

if (v.state === "closed") return halt(v.receipt)

enforcement

A verdict your wallet can check.

Other tools return a score and leave the decision to you. Bivalve signs each verdict, and a Leash wallet can refuse to sign a transfer unless the input behind it came back open.

One catch protects everyone

When a new attack is confirmed, its fingerprint goes into a shared pattern list. Hashes of confirmed patterns are posted on Robinhood Chain, so anyone can check when a pattern was known.

Keeps nothing it reads

Bivalve stores hashes and verdicts, never the content, the same rule eyebrow holds itself to. Content leaves Bivalve in three cases. When the other detectors disagree, the judge sends the text to Anthropic's Claude model to decide. For priority and network keys, the judge sees every request. For a key that opts in to third-party operators, each request also goes to up to three of them. Images stay on Bivalve's servers, where OCR reads their text. Bivalve keeps neither the text nor any answer.

Pairs with eyebrow

eyebrow checks the code an agent runs, and Bivalve checks what the agent is told. Each verdict shows the agent's eyebrow status next to it.

roadmap

From tank to waterworks.

Dates are targets. Each phase starts only when the one before it passes its exit check.

Nov – Dec 2026
1The tank
A test set of real attacks, the first four detectors, and a benchmark that reports catch rate and false positives on every change.
exit: private API answering in under 300 ms
Jan – Mar 2027
2First filter
Filter API v1, sources for X, token metadata and web pages, both SDKs, signed receipts and Leash integration. Closed beta with 10 agent teams.
exit: 10 teams in production, public benchmark
Q2 2027
3The reef
MCP tool outputs, email and agent files. Sanitize mode, the shared pattern list, pattern bounties and the judge detector.
exit: new patterns protect everyone within an hour
Q3 2027
4Waterworks
On-chain pattern registry, a daily public water quality index, and a self-hosted option.
exit: a wallet outside eyebrow accepts receipts
Q4 2027 →
5Open quorum
Independent teams stake to run detectors in the quorum and earn per verdict.
exit: three independent operators live

Put Bivalve at your agent's intake.

The closed beta opens with Phase 2 for 10 agent teams.

Try the filter