The problem Puffer solves

AI agents can make valid on-chain transactions that are still unsafe.

For example, a trading agent may receive a convincing message to “claim a limited-time airdrop,” then send funds to an unfamiliar address. Nothing needs to hack the wallet or steal a private key—the agent simply misuses the authority it was given.

Puffer makes agent wallet automation safer without forcing a human to approve every routine action.

What people can use it for

• Let an AI agent check balances and wallet status
• Retrieve live market data
• Dry-run transfers and trades before executing them
• Send SUI transfers
• Trade SUI/DBUSDC through DeepBook
• Review past wallet decisions and understand why an action was allowed, blocked, or escalated

How it keeps those actions safe

Puffer gives agents a constrained MCP tool interface. They can request a transfer or swap, but they cannot submit arbitrary transaction code, change their own safety rules, add recipients, or approve a held transaction.

For each request, Puffer:

1. Builds and simulates the real Sui transaction before signing.
2. Inspects predicted effects—balance changes, recipients, invoked packages, object transfers, capability transfers, and failures.
3. Applies hard guardrails such as transaction limits, weekly spending caps, and recipient/package allowlists.
4. Runs independent AI risk reviews that can add caution, but can never bypass a safety rule.
5. Routes risky actions to a human for Ledger-backed approval.

Why it matters

Puffer replaces the false choice between:

The result is practical autonomy: agents can handle normal wallet tasks quickly, while the owner keeps hardware-backed control over actions that could put funds at risk.

Currently built for MCP-compatible AI agents on Sui testnet.

Challenges we ran into

Making AI risk checks reliable enough for wallet decisions

We use multiple AI models to review transaction risk, but inference was sometimes slow, timed out, or returned inconsistent responses. That was a problem because a wallet cannot safely treat an unavailable model as an approval.

We solved this by making AI reviews fail closed:

• Hard safety rules—such as spending caps, allowlists, and failed transaction simulations—always run independently of AI.
• Two separate low-risk model reviews are needed before an action can proceed automatically.
• If a review fails, times out, disagrees, or flags risk, the transaction is escalated to Ledger-backed human approval.

This means model instability reduces automation, not security.

Enforcing human approval beyond a dashboard button

A major challenge was making sure a “human review required” decision could not be bypassed by the backend. If the server could still sign and submit the transaction on its own, the approval flow would only be a UI promise.

We addressed this using native Sui multisig wallets. Routine actions can use the spending wallet, while escalated actions are rebuilt from a protected wallet that requires both the platform signature and the owner’s Ledger signature. The human approval is therefore enforced directly by the wallet’s on-chain signing rule.