The problem Farol solves

An AI agent that can transact has to answer a question no chain answers for it: is this address the contract it claims to be? Today the agent guesses from a name, and the human is asked to approve calldata they cannot read.

Name collisions are not hypothetical. On HashKey Chain two verified contracts share the name "HyperIndex V3 SwapRouter". A contract whose verified source calls itself "Mock USDC" reports its symbol() as exactly USDC. An agent resolving "USDC" by name can route funds or an unlimited allowance to it and nothing today stops that.

Farol is an MCP server that gives the agent a curator-signed catalog of contracts and turns an intent into a transaction plan a human reviews on a local page before signing. The server process never holds a private key, and there is no send, sign or broadcast tool on the surface an agent can reach.

Challenges I ran into

The hard part was deciding what the catalog must never say. A registry that carries a yield figure or a recommendation becomes a thing worth spoofing, so Farol carries only the trust model - who can upgrade the code, how funds exit, who can pause it - and reads the pause switch live, because a state cannot be signed in advance.

The second was binding an audit to what is actually deployed. An audit report scopes to a git commit; what a human signs is bytecode at an address, and nothing in the industry closes that gap today. ERC-7512 specified this exact shape and has sat Draft since 2023 with no signed instances. Farol keys on (chainId, address, codehash) and re-reads the codehash live, so an attestation says on every read whether it still describes the code that is there. The shipped catalog carries zero audit attestations, because nobody has audited these contracts, and every entry says so.

The third was T3 - a catalogued address whose deployed code no longer matches the signed codehash. It is the only hard refusal in the system and a live chain will not produce one on demand, so it was untestable by hand. The fix is a demo script that copies the catalog to a temp directory, rewrites one codehash to a value the chain does not have, re-signs it with the real curator key, and runs the server against that. The refusal then happens for real, naming both hashes, and the repo's catalog is never touched.

A smaller one that changed the design: the signer's address used to be an argument the agent passed. It is now server configuration (FAROL_FROM), because an address that travels through the model is an address the model can get wrong.