feat: Add Vaultfire action provider — on-chain trust for AI agents

[Ghostkey316]

Summary

Adds a Vaultfire action provider that gives AgentKit agents on-chain trust infrastructure through the Vaultfire Protocol (ERC-8004 implementation).

AgentKit gives agents a wallet. Vaultfire gives them an identity and trust.

Actions Added

Write Actions

• register_agent — Register an ERC-8004 agent identity on-chain
• create_accountability_bond — Stake native tokens as accountability guarantee
• create_partnership_bond — Create mutual trust bond between two agents

Read Actions

• get_trust_profile — Full trust profile (identity + reputation + VNS)
• get_reputation — On-chain reputation score and ratings
• resolve_vns — Vaultfire Name Service name ↔ address resolution
• get_bond — Bond details by ID

Networks Supported

• Base (base-mainnet) — primary
• Arbitrum (arbitrum-mainnet)
• Polygon (polygon-mainnet)
• Avalanche (avalanche-mainnet)

Why This Matters

Every AI agent using AgentKit gets a wallet, but currently has no way to:

• Prove its identity to other agents or protocols
• Demonstrate accountability through stake-backed commitments
• Build verifiable reputation over time
• Discover and verify other agents before transacting

Vaultfire fills this gap using ERC-8004, the Ethereum standard for AI agent identity.

Implementation Details

• Follows the exact same patterns as Compound, Pyth, and other built-in providers
• Uses ActionProvider[EvmWalletProvider], @create_action, Pydantic schemas
• Contracts: 76 verified across 4 chains
• Security: 5 audit rounds, 0 critical/high/medium/low findings remaining

Testing

Tests under python/coinbase-agentkit/tests/action_providers/vaultfire/:

• test_vaultfire_provider.py — Provider creation, action discovery, network support
• test_vaultfire_schemas.py — Schema validation for all 7 actions
• test_vaultfire_register.py — Registration flow with mocked wallet
• test_vaultfire_bonds.py — Accountability and partnership bond creation
• test_vaultfire_constants.py — Contract address checksum verification, security scan

Protocol Info

• Website: https://theloopbreaker.com
• Standalone package: https://github.com/Ghostkey316/vaultfire-agentkit
• Contracts: 76 verified across Base, Arbitrum, Polygon, Avalanche
• Audit: 5 rounds, 0C/0H/0M/0L remaining

cc @John-peterson-coinbase @stat @rohan-agarwal-coinbase @0xRAG @yuga-cb

[cb-heimdall]

🟡 Heimdall Review Status

Requirement	Status	More Info
Reviews	🟡 0/1	Denominator calculation Show calculation 1 if user is bot 0 1 if user is external 0 2 if repo is sensitive 0 From .codeflow.yml 1 Additional review requirements Show calculation Max 0 0 From CODEOWNERS 0 Global minimum 0 Max 1 1 1 if commit is unverified 1 Sum 2

[Ghostkey316]

Update: Vaultfire has expanded from 76 to 103 verified contracts across 4 chains (Base: 26, Avalanche: 25, Arbitrum: 26, Polygon: 26). The PR description references 76 — the correct count is now 103. Protocol is also now listed on DefiLlama with live TVL tracking across all chains.

[Ghostkey316]

Update — April 2026 milestones

A few significant updates to share since the last comment:

Contract count: 134 verified (up from 103)

Live API: https://theloopbreaker.com/api/contracts

Chain	Contracts
Base	36
Avalanche	32
Arbitrum	33
Polygon	33
Total	134

22 agent identities, 36 active partnership bonds, all verified on-chain.

Now indexed by DefiLlama

Vaultfire was added to DefiLlama (PR #18806 merged): https://defillama.com/protocol/vaultfire

This gives the integration external TVL/usage validation that wasn't available when this PR was first opened.

Sister-framework integrations now live

For AgentKit users who also use other agent frameworks, Vaultfire now ships official packages:

• LangChain (JS): @vaultfire/langchain — docs PR langchain-ai/docs#3801
• CrewAI (Python): vaultfire-crewai — PR crewAIInc/crewAI#5659
• Google A2A: @vaultfire/a2a — proposal a2aproject/A2A#1804
• MCP Registry: io.github.Ghostkey316/vaultfire@1.0.2 (live)

The AgentKit action provider in this PR is the canonical Coinbase-stack entry point for the same trust infrastructure.

Production contract addresses (current as of this comment)

Base (8453)

• identity: 0xa7BD20bf5De63df949cA5Be2F20835978eCba81A
• partnership: 0x01C479F0c039fEC40c0Cf1c5C921bab457d57441
• accountability: 0x6750D28865434344e04e1D0a6044394b726C3dfE
• reputation: 0x98afd1440B2238D73c1394720277a6d031fCbbD0
• bridge: 0x62edf0cBc8Fa3d98B6A07197DFE9cb1c128a7eC7
• vns: 0xA9e6c2c0a731F1f56F6720Dfac2eB1440Ab9453a

Avalanche (43114)

• identity: 0x7448057C95Fb8a8B974a566cdcc9Cd042166A3f8
• partnership: 0xDC8447c66fE9D9c7D54607A98346A15324b7985D
• accountability: 0x376831fB2457E34559891c32bEb61c442053C066
• reputation: 0x5DB1B4b412b80d03819395794fCcF5A73BF30656
• bridge: 0x1762e484A48558Ea5Cd056ac2CDf43FBbA52ba58

Arbitrum (42161)

• identity: 0x83dd216449B3F0574E39043ECFE275946fa492e9
• partnership: 0xdB54B8925664816187646174bdBb6Ac658A55a5F
• accountability: 0xef3A944f4d7bb376699C83A29d7Cb42C90D9B6F0
• reputation: 0x8B8Ba34F8AAB800F0Ba8391fb1388c6EFb911F92
• bridge: 0x7b9293B05Bd0fcb7458d06A364078761B8E8848e
• vns: 0x7448057C95Fb8a8B974a566cdcc9Cd042166A3f8

Polygon (137)

• identity: 0xD9bF6D92a1D9ee44a48c38481c046a819CBdf2ba
• partnership: 0x83dd216449B3F0574E39043ECFE275946fa492e9
• accountability: 0xdB54B8925664816187646174bdBb6Ac658A55a5F
• reputation: 0x54e00081978eE2C8d9Ada8e9975B0Bb543D06A55
• bridge: 0x7b9293B05Bd0fcb7458d06A364078761B8E8848e
• vns: 0x7448057C95Fb8a8B974a566cdcc9Cd042166A3f8

Happy to refresh the PR with any of these updates baked into the codebase if maintainers prefer that over a comment summary. PR is currently mergeable with no conflicts.