Built on CreateOS Sandbox and Stripe machine payments

Don't trust the seller. Ask the platform.

Polygraph checks a seller's claims against CreateOS's own records before your agent pays. If one is false, the agent refuses and no payment is created.

For AI agents that need heavy software they can't install, like archival PDF conversion with LibreOffice, from sellers they've never met.

Watch it live How it works

$0.50 per job, paid by the agentStripe test modeNo payment if a check fails

Polygraph · Live console
Connecting
  1. Create
  2. Distrust
  3. Pay
  4. Run
Tamper it yourself
Full screen

Seller agent

Builds, tests and attacks the tool

Waiting
Tests no runs yet
0 passed 0 failed
Attacks

      Trust check

      Signed claims against CreateOS records

      Idle

      Each row is a claim the seller signed, checked against CreateOS's own records, not the seller's word. Green means CreateOS agrees.

        Buyer agent

        Verifies, pays, runs the job

        Waiting
        Paymentnone yet

        Nothing is paid until every check passes.

        Workers running

        No worker forked yet

        How it works

        The buyer pays only after the platform agrees.

        The seller's offer is a signed list of claims. The buyer checks each one with CreateOS before any money moves.

        1. 01

          Create

          A seller agent wraps an open-source tool in a CreateOS sandbox, tests and attacks it, then publishes a signed offer.

        2. 02

          Distrust

          The buyer reads the sandbox's real egress and status from CreateOS and compares them with what the offer claims.

        3. 03

          Pay

          An offer that matches gets $0.50 through Stripe machine payments. One mismatch and no payment is created.

        4. 04

          Run

          The job runs in a fresh worker forked from the sandbox the buyer checked, and the buyer keeps a receipt.

        Same archival test suite

        Plain LibreOffice14 of 17

        The seller agent's tool17 of 17 PDF/A-2b

        Why a buyer should doubt

        161 of 20,338 paid agent endpoints were traps.

        dev.to/afx, 2026

        Receipts

        Every job ends with a receipt you can check yourself.

        Each id points at a record the seller can't edit: the PaymentIntent in Stripe, the worker and its parent sandbox in CreateOS, and the sha256 of the document that went in and the PDF that came out.

        • The worker's forked_from matches the parent named in the signed offer.
        • The tool digest is recomputed inside the worker, not taken from the seller.
        • The worker is destroyed when the job is done.

        No receipt yet

        When the buyer agent finishes a job, its receipt shows up here.