B — Some risk signals Graded October 16, 2026Minor concerns worth a quick check.Based on public adoption and transparency signals as of October 16, 2026. Our opinion, not a code audit or security guarantee.

AI agent skill · Developer tools, Finance & business

internet-court-skill

The trust layer for agent-to-agent commerce — natural-language mandates, ERC-7710 delegated permissions, x402 payments, escrow, and dispute resolution as one open, catch-all Agent Skill / Claude Code plugin.

Bottom line: Signal-based grade (4/7 points): very widely starred on GitHub, public source code. This reflects adoption and transparency, not a code audit.

Popularity score: 43/100
Rank: #240 of 500
GitHub stars: 6.7k

What it does

Internet Court provides a trust and settlement layer for AI agents to conduct commerce with each other through natural-language mandates, ERC-7710 delegated permissions, x402 payment integration, escrow, and dispute resolution. It packages these capabilities as a single Claude Code plugin or agent skill, enabling agents to negotiate, execute, and arbitrate transactions autonomously.

Who it’s for

Builders deploying multi-agent systems that need to settle value transfer, liability, or disputes between autonomous actors. Executives evaluating infrastructure for agent-to-agent marketplaces or B2B automation platforms.

Copy-paste setup

Check these steps against the project’s own instructions before running anything.

Verify against the repo README at https://github.com/internet-court/internet-court-skill (opens external site) for exact installation steps. Likely approaches include:

For Claude Desktop MCP:

json

"mcpServers": {
  "internet-court": {
    "command": "npx",
    "args": ["internet-court-skill"]
  }
}

For npm/Node agents:

bash

npm install internet-court-skill

Then configure wallet/escrow signer keys and RPC endpoint per repo documentation.

Risks

Private key exposure: Agents holding delegated ERC-7710 permissions or x402 payment signing keys face wallet compromise if keys are leaked or over-scoped.
Prompt injection: Natural-language mandate parsing could allow attackers to craft adversarial inputs that trick agents into authorizing unintended transactions or dispute claims.
Escrow fund loss: Bugs in escrow logic or settlement arbitration could lock funds or cause permanent loss if dispute resolution is misconfigured or biased.
Third-party oracle/arbitration risk: Dependency on external dispute resolvers or payment oracles introduces counterparty and censorship risks.
Supply chain: Early-stage GitHub project (6.7k stars, 0 npm downloads) signals limited production deployment; no visible security audit trail.

How to stay secure

Least-privilege permissions

Scope delegated signing authority narrowly. Each agent should only receive permission to sign transactions up to a specific dollar amount, for specific types of transactions (e.g., payments only, no dispute claims), and for a limited time window. Avoid giving agents blanket authority.
Rotate and revoke keys regularly. Treat agent signing keys like passwords—rotate them monthly and revoke old keys immediately when an agent is decommissioned or suspected of compromise.
Separate payment keys from dispute keys. Use different cryptographic keys for making payments (x402) versus submitting dispute claims. If one key leaks, the other remains safe.
Require multi-signature approval for high-value escrow. For transactions above a threshold (e.g., $10k), mandate that two independent agents or human reviewers must approve before funds are released from escrow.

Network isolation

Run agents in sandboxed environments. Deploy each agent in a containerized or isolated network segment with no direct internet access except to approved payment processors and arbitration services. Block outbound connections to unknown endpoints.
Use allowlisting for external services. Hard-code (don't configure dynamically) the URLs and IP addresses of trusted payment oracles, dispute resolvers, and escrow custodians. Reject any requests to unknown third parties.
Encrypt all inter-agent communication. When agents exchange natural-language mandates or transaction details, use TLS encryption and cryptographic signatures to prevent tampering or eavesdropping.

Monitoring

Log all mandate parsing and transaction authorization. Record every natural-language instruction received, how it was interpreted, and what transaction it triggered. Store logs immutably (e.g., write-once storage) and review them daily for anomalies.
Alert on unusual escrow activity. Set up automated alerts if escrow funds are released outside normal patterns, if disputes are filed excessively, or if settlement arbitrators behave unexpectedly (e.g., always ruling in one direction).
Track key usage and failed authentication attempts. Monitor which agents use signing keys, how often, and for what amounts. Flag repeated failed transaction attempts or keys being used from unexpected locations.

Red flags to watch for

Prompt injection attacks in mandates. Be suspicious of natural-language instructions that contain unusual syntax, hidden commands, or requests that contradict your known business rules. Require human review if an instruction seems ambiguous or tries to override previous limits.
Rapid fund movement or circular payments. Watch for agents suddenly authorizing large transactions, moving money between escrow accounts quickly, or creating circular payment loops designed to obscure the true recipient.
Unaudited or untrusted arbitrators. Do not rely on dispute resolvers you have not independently verified. Avoid using new or obscure arbitration services; stick to established, regulated providers with a public track record.
Mismatches between mandate intent and transaction outcome. If an agent receives an instruction to pay Vendor A but the actual payment goes to Vendor B, or if the amount differs significantly, escalate immediately—

Alternatives

Openzeppelin Governor contracts — on-chain governance and escrow for multi-sig decisions; requires solidity expertise and doesn't include agent runtime.
Chainlink Functions + VRF — verifiable off-chain computation for dispute arbitration; more modular but less integrated for agent orchestration.
Safe (formerly Gnosis Safe) — multi-sig wallet with plugin architecture for conditional transactions; mature but requires custom agent adapters.
Stripe Escrow / traditional payment processors — centralized, battle-tested trust layer; incompatible with agent autonomy and decentralized settlement.

Sources

github.com/internet-court/internet-court-skill