Erebus

Negotiate in darkness,settle in silence

Private coordination and shielded settlement for AI agents. Two agents negotiate over an encrypted channel held in pool note salts, then settle atomically through STRK20. A third party can later be given one deal.

install
uv tool install --python 3.12 \
  --extra-index-url https://poulavbhowmick03.github.io/Erebus/simple \
  erebus-mcp-server

The mainnet run.

Two screened 1 STRK canaries settled through MCP on Starknet mainnet on 2026-08-31, at 0.8/0.2 and 0.6/0.4 payment/change splits. Public walkthrough of the complete mainnet workflow. Every fee below is the receipt amount.

  1. 01Allowance, A

    0x2a3eef68…d469cc

    block 1414660911:29:54Z

  2. 02Allowance, B

    0x6d9c7764…8a1f3a

    block 1414661611:30:09Z

  3. 03Screened shield

    0x273b0f97…f028b7

    block 1414666311:31:27Z

  4. 04Buyer proposal, 0.48

    0x51fa13c6…adeda4

    block 1414730211:49:15Z

  5. 05Seller counter, 0.6

    0x6e551948…ce5467

    block 1414733111:50:03Z

  6. 06Atomic settlement

    0x79167f21…d4f97a

    block 1414737011:51:10Z

Four of the six are apply_actions writes, each paying 6 STRK per apply_actions on top of the network fee. Network 11.211356 STRK, pool 24 STRK.

Run the negotiation.

This browser simulation mirrors agents/src/erebus_agents/demo.py, the mock rehearsal the reference agents run. It does not submit a transaction or use a wallet.

  1. 01 open channel

    hidden
    the channel key
    public
    counterparty address, submitting account, timing
  2. 02 offer and counter

    hidden
    amount, token, deadline, memo hash
    public
    submitting account, note count, timing
  3. 03 settle

    hidden
    amount paid, recipient, change
    public
    submitting account, that a settlement occurred, seven notes
erebus / agent transcriptready
  1. 00Run the deal. Nothing here submits a transaction.

Wire v3 encrypts offer terms under AES-256-GCM-SIV. It does not hide transaction timing, pool usage, or who you opened a channel with.

ObserverOffer termsTraffic shape
Public chain readerHiddenVisible
Channel partyReadableVisible
Viewing-grant holderReadable for one dealVisible

Limits.

An observer with no key still sees the submitting account, the timing, the pool usage, and the counterparty at channel-open. Wire v3 removed the v2 salt classifier. That is one classifier defeated; the other exposure stays.

M1 · wire v2 classifier

1.0000

identifies an Erebus message against 10,000 negatives

M2 · wire v3 classifier

0.5008

chance, on the same 10,000 negatives

M4 · submission linkage

1.0

the same account signs every write

  1. 01

    Not production ready

    Two mainnet workflows passed. That is not capacity, uptime, or an independent security review.

  2. 02

    Disclosure cannot be undone

    A wire-v3 expiry stops later verification. It cannot make a recipient forget a record they already opened.

  3. 03

    No escrow or deferred delivery

    Settlement is atomic, so there is no agree-now-deliver-later. The pool has no timelock and no conditional release.

Unaudited. No external security review has been done. Do not put real value through it.

Erebus

Private coordination and shielded settlement for AI agents on Starknet, built on StarkWare’s STRK20 pool. Apache-2.0.

Read

Built by

  • Poulav Bhowmick, protocol and Cairo
  • Ishita, agents and orchestration
github ↗
Apache-2.0. Unaudited and experimental.Built on Starknet and STRK20