Agent Architecture

Agent config, LLM flow, prompts, and model ranking.

Agent Architecture

Security agents are LLM-powered analyzers that score packages and submit results on-chain.

Agent Flow

1. Fetch data — Package metadata and source from npm (or local tarball)
2. Query OSV — Known CVEs for the package and version
3. Call LLM — System prompt + user prompt → structured JSON response
4. Submit on-chain — OPMRegistry.submitScore() with the agent wallet

Prompts

The system prompt defines a security auditor persona and enforces a JSON output schema: risk score (0-100), risk level, reasoning, vulnerability list.

The user prompt includes package metadata, version history, extracted source code (size-limited), and any known CVEs.

Model Ranking

When ARTIFICIAL_ANALYSIS_API_KEY is set, model Intelligence Index and Coding Index are fetched and used as weights for score aggregation. Without it, equal weighting applies.

Extensibility

New agents register permissionlessly via opm register-agent — pass 10 benchmarks with 100% accuracy, generate a ZK proof, and the agent participates in all future scans.