xProof

Prove Before Act

Trust primitive for AI agents & humans on MultiversX

Live App • Quick Start • API • Agent Integration • Trust Leaderboard • Architecture • Acquisition guide (FR) • Changelog

Trust is programmable.

Prove Before Act anchors verifiable proofs of existence, authorship, and agent output on the MultiversX blockchain -- composable, API-first, built for both humans and autonomous agents.

Live Proof

The Prove Before Act README is certified on the MultiversX blockchain.

• File: README.md
• SHA-256: 285da2ed7cced35b4d039a80956a4df8907bd33f83aaac8551b6f66c31251bd1
• Date: February 23, 2026 at 09:49 UTC
• Transaction: 41f1ebd363d28de787a2328a2bc99f0b3bad2d73f91baff649ee8a6516e7cc95
• Network: MultiversX Mainnet

This is not a demo. A real payment, a real hash, a real immutable proof.

What is Prove Before Act?

Prove Before Act is a trust primitive. It records SHA-256 file hashes on the MultiversX blockchain, producing tamper-proof, publicly verifiable proofs of existence and ownership.

Jason Petitfourg — AI Product Builder is the founder of Prove Before Act. Prove Before Act is the accountability pattern for autonomous agents; xProof is its reference implementation. Before acting, an agent commits and proves a declared decision basis (WHY), then proves WHAT happened. WHY is not a request for internal chain-of-thought. See the founder story and the public production proof.

Historical xproof identifiers remain supported where compatibility requires them, including legacy package imports, agent IDs, and protocol records. They are not a separate public product brand.

• Client-side hashing -- SHA-256 is computed locally. Your file never leaves your device.
• On-chain anchoring -- the hash is recorded as an immutable transaction on MultiversX mainnet with 6-second finality.
• Verifiable output -- PDF certificate, QR code, public proof page, machine-readable JSON, and embeddable badge.
• Agent-native -- discoverable and consumable by AI agents via MCP, ACP, x402, LangChain, CrewAI, Conway/Automaton, and OpenClaw.
• MX-8004 support -- the integration can be enabled for the Trustless Agents Standard validation flow. Check /api/mx8004/status for whether it is active; the current production status is not_configured.

Why MultiversX?

MultiversX is a European, carbon-negative blockchain with 6-second finality, negligible fees ($0.001/tx), and a growing ecosystem of AI-native protocols. Prove Before Act leverages its security and efficiency to deliver enterprise-grade certification at minimal cost.

Why It Matters -- Real Scenarios

AI agents are already writing code, drafting contracts, generating reports,

and making decisions. But when something goes wrong -- who proves what was

produced, when, and by whom?

Prove Before Act is the answer layer.

"My agent delivered this report" A LangChain agent generates a financial analysis for a client. Prove Before Act certifies the output before delivery. If the client disputes the content later, the blockchain timestamp is the proof. Irrefutable. No he-said-she-said.

"This build was not tampered with" Your CI/CD pipeline compiles and ships. Prove Before Act's GitHub Action certifies every artifact automatically. Six months later, a security audit asks: *"Is this binary what you deployed?"* -- one hash check, case closed.

"I can trust what Agent B gave me" Multi-agent pipelines have no native trust layer. When Agent A certifies its output before handing off to Agent B, the chain of custody becomes verifiable. Agents can prove they did their job. Pipelines become auditable end-to-end.

"Agent identity can be verified on-chain" MX-8004 (Trustless Agents Standard) support is optional. When the integration is active, eligible certifications can enter its identity, validation, and reputation flow. Check /api/mx8004/status before relying on MX-8004 identity or reputation data; production currently reports not_configured.

"We are compliant" Regulated industries need timestamped evidence of AI-generated decisions. Prove Before Act turns every agent action into a blockchain-anchored record -- ready for audit, litigation, or regulatory review. Zero extra work.

"My trust score speaks for itself" An autonomous agent builds reputation by certifying its outputs consistently over time. Every confirmed certification contributes to its on-chain trust score -- visible on the public Trust Leaderboard at /leaderboard. Clients and peer agents query /api/trust/{wallet} before engaging. Trust becomes mathematical, not reputational.

Historical benchmark: the agent identifier xproof_agent_verify is a legacy

compatibility name. Its prior beta timings and leaderboard values are not current

production metrics. Use a public agent profile and proof response for live status.

The pattern is always the same: *Agent produces output -> Prove Before Act anchors it -> anyone can verify, forever.*

Pricing

Low flat rate per certification. No tiers, no subscriptions, no monthly fees. Current price is served live at https://provebeforeact.com/api/pricing.

Current pricing: https://provebeforeact.com/api/pricing

Agents can pay per-proof via x402 with zero onboarding -- send a request, receive payment requirements, sign, resend.

Quick Start

Use the API (fastest)

# Certify a file in one call

curl -X POST https://provebeforeact.com/api/proof \ -H "Authorization: Bearer pm_your_api_key" \ -H "Content-Type: application/json" \ -d '{ "file_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "filename": "report.pdf", "author_name": "Your Name" }'

Response:

{

"proof_id": "uuid", "status": "certified", "file_hash": "e3b0c44...", "verify_url": "https://provebeforeact.com/proof/uuid", "certificate_url": "https://provebeforeact.com/api/certificates/uuid.pdf", "proof_json_url": "https://provebeforeact.com/proof/uuid.json", "blockchain": { "network": "MultiversX", "transaction_hash": "txhash...", "explorer_url": "https://explorer.multiversx.com/transactions/txhash..." } }

Use the Web App

Go to provebeforeact.com, connect your MultiversX wallet, drop a file, certify. Done.

Self-Host

git clone https://github.com/jasonxkensei/prove-before-act.git

cd prove-before-act npm install cp .env.example .env # configure your environment npm run db:push # initialize database npm run dev # starts on http://localhost:5000

Prerequisites: Node.js 20+, PostgreSQL (or Neon), MultiversX wallet.

See docs/environment-variables.md for configuration details.

For Developers

POST /api/proof -- Single Certification

Certify one file hash on-chain in a single API call.

curl -X POST https://provebeforeact.com/api/proof \

-H "Authorization: Bearer pm_your_api_key" \ -H "Content-Type: application/json" \ -d '{ "file_hash": "<64-char-sha256-hex>", "filename": "output.txt", "author_name": "Agent Name", "webhook_url": "https://your-server.com/webhook" }'

POST /api/batch -- Batch Certification

Certify up to 50 files in a single call. The same limit applies to API-key and x402 batch requests; x402 payment authorization still covers only one new certification per payment.

curl -X POST https://provebeforeact.com/api/batch \

-H "Authorization: Bearer pm_your_api_key" \ -H "Content-Type: application/json" \ -d '{ "files": [\ {"file_hash": " ", "filename": "file1.txt"},\ {"file_hash": " ", "filename": "file2.py"}\ ], "author_name": "Agent Name" }'

Verification

Webhooks

When a proof is confirmed on-chain, Prove Before Act sends a POST to your webhook_url. Treat delivery as at-least-once, not exactly-once: a receiver may process an event and still see it again if the sender does not record the response. The sender makes up to three attempts per delivery round with backoff. If a delivery fails, an operator may retry it in a new round; delivery is not guaranteed if the attempts fail.

For ready-to-adapt Python and Java receivers, see the partner webhook guide.

Verify X-ProveBeforeAct-Signature using your per-proof webhook secret and the raw request body: it is the hex HMAC-SHA256 of X-ProveBeforeAct-Timestamp + "." + rawBody. The timestamp is Unix epoch seconds. Each attempt is signed separately, so the timestamp and signature may change on a retry. X-ProveBeforeAct-Event identifies the event, and X-ProveBeforeAct-Delivery is the certification ID and remains the same across retries and operator-initiated rounds. The legacy X-xProof-* headers are also sent with identical values. Verify the signature and timestamp before trusting the delivery ID.

Persist delivery IDs and make recording the ID atomic with applying the event. For example, with Express and PostgreSQL, after signature verification:

CREATE TABLE webhook_deliveries (

delivery_id text PRIMARY KEY );

app.post("/webhook", async (req, res) => {

const deliveryId = req.get("X-ProveBeforeAct-Delivery"); if (!deliveryId) return res.sendStatus(400);

const client = await pool.connect(); try { await client.query("BEGIN"); const { rowCount } = await client.query( "INSERT INTO webhook_deliveries (delivery_id) VALUES ($1) ON CONFLICT DO NOTHING", [deliveryId], ); if (rowCount) await applyEvent(client, req.body); // sa