What Touchmark checks, and why
An agent that holds a Stellar key will do whatever its code lets a request make it do. Touchmark reads that code and asks one question: can something a user, a web page or another server says reach the key, the payment or the network in a way nobody intended?
Keys and signing
Where the secret comes from, and what the agent signs with it: payments, contract calls, account changes, trustlines, transactions built by someone else, messages. Envelopes and Soroban auth entries signed without being read.
Money and limits
Who picks the destination, amount, asset and memo. Whether caps, daily totals, allow-lists and approvals are enforced in the code that pays, not just written in a prompt. Retries that can pay twice.
Network and input
Whether a tool argument or a paid server's challenge can switch testnet to mainnet. Hosts chosen by input. Reworded, split, role-played and planted requests that steer a tool.
A touchmark means no actionable risk was found in the reviewed code. It is not a guarantee of safety, and it is bound to the exact commit that was read.
Run an audit from a GitHub URL
- 1
Open the ticket
On the home page, the input card is labelled Nº 01 · Agent to test.
- 2
Paste a reference
Public GitHub repositories work best, because the code is what gets read.
You paste Touchmark reads https://github.com/owner/repoThe default branch, pinned to its latest commit. …/tree/<commit>/<folder>Exactly that commit and folder. Use this for results you can reproduce and compare. agent id · C…contract ·G…accountWhat the ledger says. With no source linked there is nothing to score: the stamp shows a dash and the decision is needs evidence. - 3
Press Test it →
Or pick one of the two examples under Try one:, an Unsafe treasury agent and a Safe treasury agent. They make a good first pair to compare.
What happens during an audit
Under the ticket, Punch takes the agent to the desk. A timeline shows each stage as it happens, from Pin the source to Seal the report, with the files read so far, the findings re-checked and a running clock. A pulse beats with every signal from the server, so a long review never looks like a hung page.
-
Fetch and pin
The reference is resolved and the source is pinned to one commit. Touchmark selects the files that make up the agent: tests, examples, demos and docs are not the agent and are not held against it. A
.tmarkat the repository root is read here. -
Rules and data flow
Deterministic analysers for Python, JavaScript, TypeScript, Rust/Soroban and WASM trace each path from untrusted input to what the agent signs, pays or fetches, and check every claim in the
.tmarkagainst the code. Rules propose; evidence decides. -
Deep model review
A model reads every source file of the agent, those that hold its authority first (keys, signing, payments, tool and route handlers, network access), and looks for what rules miss: replayable payment proofs, unauthenticated pay endpoints, budgets keyed on an address an attacker can rotate. Every finding must quote a line that exists; a quote that does not match the source is rejected.
No clock stops the review. A large repository needs more than one request, so the audit runs as a job: when a request nears the platform's limit the review saves its place and the page opens the next request at once, on the same commit, with the same timeline and one clock. A reload picks it up again, and Cancel the audit stops it. The only stop is a spend cap: per audit on the tokens the model processes, their cost and the files it reads, and a daily limit across the demo. Once the demo reaches its daily limit, audits run on the rules until the next UTC day, and the consent box says when model reviews return. If a cap is reached, the review ends, keeps every finding, and the report lists each file it did not read with the cap that stopped it.
This is the only stage that sends code to a model provider, and it runs only when you tick Deep review by a model on the ticket. Each connection has a small hourly allowance, shown next to the box; when it is used up, or the model review is not enabled, the box is greyed out and says why. Without it the audit runs on the rules alone, and the report says so. A rules-only audit can reach needs evidence at best: it cannot pass or be stamped.
-
Independent verification
A second model re-checks each finding at the cited line and labels it: Verified Partly verified Disputed Not verified. A high pattern-rule finding blocks a pass only once it is verified.
-
Decide and seal
One decision rule turns the evidence into a verdict, and the report is sealed with its SHA-256. That hash is what a credential points to.
Read the report
A report has one verdict, one score, and two kinds of finding. Here is a real result from the Safe treasury agent example, with the parts named.
pass
No actionable risk found. Eligible for a Stellar credential.
Source pinned to furkan3152/Touchmark_agent/examples/demo/safe-treasury-agent @ 9e31161d4b
1 file analysed · 4 risks (0 critical, 0 high) · 19 evidence gaps
Declaration: repository .tmark, checked against the code · Model review: completed, read 1 of 1 files; verifier re-checked 2
What can go wrong
- lowIdempotency key is chosen by the model and not bound to supplier, amount or invoiceAI reviewPartly verified
- lowRetry of a payment that never reached the network is reported as "already paid"AI review
▸ Why this score? (2.8 risk points → 97.3)
▸ Evidence not yet provided (19)
- 1The stamp. Score out of 100 and the stamp word: Touchmarked, Not yet or Show more.
- 2The decision. One of three verdicts, explained below.
- 3Source pinned to the commit that was read. Click through to see exactly that code.
- 4The count line: files analysed, risks by severity and evidence gaps.
- 5What the audit read: under the verdict, three cells. Declaration: which
.tmarkwas used (yours, the repository's, or none) and where a pasted one differs from the committed one. Scope: how many files were read and which folders were left out as tests, examples or builds. Model review: whether it ran, how much it read and what the verifier made of it, or plainly why it did not run. - 6What can go wrong: risks, worst first, each with the cited code and a fix.
- 7Why this score? Every point lost, finding by finding. Try it below.
- 8Evidence not yet provided: what could not be checked. Not a vulnerability.
Three verdicts
pass
No actionable risk, the full core surface reviewed, and the deep review complete. Eligible for a credential.
needs fixes
An actionable risk: a critical or high finding backed by evidence, a verified bypass of a payment control, or enough smaller risks to pull the score under 65. Do not give this agent the keys yet.
needs evidence
No actionable risk, but part of the agent could not be reviewed: the deep review did not read every file that holds authority, or a payment bypass was never verified.
Risks
Something in the code can go wrong. Risks cost points and can block a pass. Each comes with its evidence grade (confirmed or inferred), the places it was found, and a fix.
Evidence gaps
Something Touchmark could not establish: an owner not verified, an agent wallet not supplied, an attack class with no code to test it against. Gaps cost nothing; they only limit how far the verdict can go.
Why this score? Try it.
Toggle the fixes on this sample report. The arithmetic is the one the audit uses.
–
Each finding costs severity (critical 30, high 14, medium 6, low 2) × evidence (confirmed 1, inferred 0.6) × confidence × spread (more affected places, up to ×1.75). Further findings of one severity count a little less, and a restated root cause counts 30%. Score = 100 × e−risk points / 100. An actionable risk caps the score at 64; a confirmed critical at 39.
Compare two runs
Fixed something? Under the report, Fixed it? Test again takes the fixed commit or folder. Both versions are re-checked with the deterministic rules only, so the comparison is quick and like for like, and compared finding by finding. Its scores are rules-only scores, and a finding only the model review reported is never shown as closed.
rules onlyneeds_fixes 41.8pass 96.1(+54.3)
Closed
- highThe model chooses the payment destination
- highA limit the .tmark declares is not enforced by the code
Still open
- lowAutonomous authority over funds
New
- lowNone
Illustrative numbers. Paste a /tree/<commit> link for each version so the comparison is exact: Closed is what the fix removed, Still open what it did not touch, and New anything the fix introduced.
Stamp a testnet credential
A passing report can be written to Stellar testnet. The validator records the report's hash and score in the Touchmark registry, and the credential contract issues a non-transferable token bound to it: the touchmark.
Eligible when
- the decision is pass;
- the full review ran: model review and independent verification;
- the audit is bound to a source repository at a commit;
- the score is 65 or more. The contract enforces it.
- 1
Name the owner
Put your
G…account inowner.stellar_accountin the repository's .tmark. Without it, the credential goes to the demo operator and says ownership not verified. - 2
Sign in Freighter
Press Sign with Freighter and issue to my account. Freighter must be on Testnet and on the account the repository names. You sign the registration; you never share a key.
- 3
Read it back
Stamped, and read back from the ledger: token, owner, score on chain, report hash match, Valid until, the contract and each transaction. Download the card (SVG) and the token metadata.
Private code and uploads: the Studio
The home page reads public repositories. The Studio is the workspace for everything else: private files, a project folder, a capsule you keep, and the official review.
Agent intake
Three ways in: Stellar address, GitHub or Upload files: up to 12 files, 32 KB each, 64 KB of source in total. A .tmcapsule brings source, intent and limits together.
Intended behavior
Name the agent, say what it is allowed to do, and tick what it can actually do. A declared permission is not proof that a limit is enforced.
Design your audit
Choose the depth and the reviewers, then Run Preview review. No wallet connection, no payment, no transaction.
Go further, by consent
Add an AI second opinion, run isolated runtime probes in a disposable microVM, or order an official Testnet review funded with test XLM.
What leaves your hands
The rules
Run on Touchmark's server against the public repository at the pinned commit. No model is involved.
The report
Comes back to your browser. Download report JSON to keep it; its SHA-256 is printed under it.
The ledger
If you stamp, Stellar testnet records the report hash, the score, the repository and commit, and the owner account. Never the source.
The Studio
An immediate review of uploaded files stays in memory. Official orders store the submitted source only with your explicit consent, and an AI second opinion is a separate consent.
A .tmark you paste
Checked, used for that one audit instead of the repository's own, and answered. Nothing is stored. An audit with a pasted .tmark is not credentialed: commit the file to be stamped.
The allowance
To keep the model review within its budget, each audit that uses it claims a slot named with a keyed hash of your connection's address, never the address itself. A slot stops counting when its hour or day ends, and is deleted two days later.
Declare it: the .tmark file
Ready when your agent is.
Paste a repository, read what comes back, fix what it finds, and stamp the version that passes.