Caps per account and per agent, an hourly rate limit, allow and deny lists, and a local AI guard that must agree before larger payments. All enforced by the smart account, outside the model.
per-agent limitshuman + AI 2-of-2allow / deny lists
Qameleon is a smart wallet for AI agents on Ethereum. Your agents pay for APIs on their own, but only within your caps, only to providers with a verified ERC-8004 identity, and from funds that stay shielded. The owner key can move to quantum-safe signatures without moving your money.
How a payment moves
An agent never signs with your key. It asks, the policy engine decides, and only then does money move.
The service answers 402 Payment Required through x402.
It signs an EIP-712 intent with a scoped session key, never the owner key.
Your allow and deny rules, ERC-8004 identity and reputation, account and per-agent caps, hourly rate, category, and a pre-flight scan.
Small payments go through. Larger ones also need your local AI guard to co-sign. Anything else waits for you.
The result feeds the provider's ERC-8004 reputation.
A low balance triggers a shielded top-up to a fresh account.
Product
Each layer covers a gap the others leave open. Together they make an agent useful without making it dangerous.
Caps per account and per agent, an hourly rate limit, allow and deny lists, and a local AI guard that must agree before larger payments. All enforced by the smart account, outside the model.
Money only goes to a provider's registered ERC-8004 wallet, and only when validators you choose score it above your threshold.
A shielded vault through Privacy Pools, one fresh account per service, reads through the Helios light client, and selective disclosure when an auditor asks.
Layer four
An agent cannot pay an address that is not a provider's registered wallet, so drainers are refused before any gas is spent. Your owner key can live in your phone's secure chip, guardians can recover it, and a hash-based key that signs up to 1,024 times waits offline. If ECDSA ever breaks, one signature switches the account to quantum-safe ownership in place, or bunker mode moves everything to a fresh account.
Network
Agent payments are recorded as they happen. Accounts appear as anonymous ids; owners are never shown.
For agents
Claude, ChatGPT, Codex, Cursor or your own code. The agent reads one file, creates a key that can only ask to pay, and sends you a link. You approve it with your wallet.
It reads SKILL.md, downloads a small helper and creates its own session key. The key stays on its machine and is never shown.
It sends you a claim link with the limits it asks for. Open it, connect your wallet, lower the limits if you like, and approve.
Chat in the app or in your own client. Every payment still passes your caps, lists, trust checks and the AI guard.
Developers
Claude, ChatGPT, LangChain or your own code. Qameleon is the wallet and the rules, not another agent.
import { QameleonAgent, HttpGuardClient } from "@qameleon/sdk";
const agent = new QameleonAgent({
account: "0xYourQameleonAccount",
sessionKey: process.env.SESSION_KEY,
relayerKey: process.env.RELAYER_KEY,
rpcUrl: process.env.RPC_URL,
chainId: 1,
});
const guard = new HttpGuardClient("http://127.0.0.1:8787/review");
const r = await agent.requestPayment(
{ providerAgentId: 23051n, payTo: "0xProviderWallet", amount: 12_000_000n },
{ guard, context: { task, service, reason } },
);
// r.result: "paid" | "pending_approval" | "blocked"Where it stands
Spend limits are now common in agent wallets. The rows below are what Qameleon adds.
| Capability | Typical agent wallet | Qameleon |
|---|---|---|
| Spend caps and human approval | Yes | Yes, enforced onchain |
| Balance hidden from the public | No, public balance | Shielded vault, rotating accounts |
| Who the agent may pay | Allowlist | ERC-8004 identity and reputation |
| Payee bound to a verified identity | Rarely | Every payment |
| Second opinion before larger payments | Rarely | Local AI guard co-signs, 2-of-2 with you |
| Lost owner key | Seed phrase only | Guardians, 3-day delay you can cancel |
| Show payments to an auditor | Hand over the whole wallet | Selective disclosure, signed per account |
| Quantum migration | Move funds to a new wallet | Swap to a hash-based signer in place, or bunker mode |
Roadmap
Each phase ships something usable on its own. Ethereum mainnet opens as a small, capped beta; the public launch follows independent audits.
Phase 1In progress
Phase 2Next
Phase 3Later
Phase 4Mainnet
FAQ
What Qameleon does today, and what it does not do yet.
Not yet. The contracts, SDK, MCP server and guard daemon are built and pass their tests, including on a copy of the chain. The next step is a small Ethereum mainnet beta with low caps; the public launch waits for two independent audits. Do not put real savings in it yet.
No. The agent holds a session key that can only ask to pay. The smart account checks your caps, the provider's identity and reputation, and the category before anything moves, and anything outside the rules waits for you.
Who owns an account and how much sits behind it. Deposits into the privacy pool and each agent payment are still visible onchain; nothing links them to you.
You commit a hash-based key now: a tree of 1,024 one-time WOTS+ keys, built offline from a seed you keep. If ECDSA ever becomes unsafe, one signature from that tree turns your ECDSA key off and keeps the same address. After that, every owner action is signed with the next key in the tree.
Hash-based signatures depend only on the hash function, the most conservative assumption there is. Lattice schemes are smaller and faster, but Vitalik Buterin has warned that AI-assisted maths could weaken them within a few years. Qameleon keeps the conservative option as the backstop.
It is a second model that runs on your own machine, separate from your agent, with its own key. For payments above the amount you choose, the account pays at once only if the guard agrees. It screens for prompt injection, checks the payment against your standing instruction, and fails closed: if it is unsure or offline, the payment waits for you.
Guardians you choose, such as friends' wallets or a ZK email verifier, can move ownership to a new key after a 3-day delay. Your phone or owner key can cancel during that time, so a group of guardians cannot take over quietly.
Any MCP client, such as Claude Desktop or Cursor, and any code that can use the TypeScript SDK.
The ticker $QMLN is reserved. No token has been issued, and any contract claiming to be $QMLN before an official announcement is not ours.
Ticker reserved, no token issued. Planned uses inside the app, after legal review: pay relay fees in $QMLN, stake it as an ERC-8004 validator (and lose it for false validations), and vote on the default trust modules. Nothing is for sale, and any token claiming to be $QMLN before an official announcement is not ours.
See how it fits the appGet started
Ethereum mainnet is required for this browser demo. Connecting does not create an on-chain account or move funds. Your keys never leave your wallet. On a phone, open this site in your wallet's built-in browser.
Connecting is free and sends no transaction. You sign one message to confirm this browser connection. Dashboard data is simulated.