BIVALVE Try the filter
0 open0 closed

Closes before your agent acts.

An input firewall for AI agents. Bivalve checks what your AI agent reads, and stops it from acting when something in there is trying to take control.

Try the filter See how it decides

Feed it something.

Pick an example or paste your own text. Each example hides the test marker BIVALVE_TEST_CLOSE in a different form. This demo runs in your browser and blocks only that marker, wherever its decoders find it; the real detectors read what the text means. Nothing leaves this page.

Next action
waiting for input
// POST /v1/filter response appears here

Eight mussels guard a city’s water.

0 of 8 closed supply on

At the waterworks in Warsaw and Poznań, river water passes a tank of freshwater mussels before it reaches anyone’s tap. Each mussel has a small sensor glued to its shell. When something toxic arrives, they clamp shut within seconds. If four of the eight close at once, the plant shuts off the supply.

AI agents drink from open water too. They read tweets, inboxes, web pages and token metadata, and they act on what they read. In May 2026 a trading bot lost about $175,000 to an instruction hidden in Morse code inside a tweet.

Six detectors vote on every input.

Two votes close the shell, for every action. One vote narrows it. Scroll to run an example through. It hides Bivalve’s test marker, BIVALVE_TEST_CLOSE, in Morse code; every detector treats the marker as an attack.

x.postagent rh:0x7c1e…f815next action: transfer

gm frens, big week for the chain. -... .. ...- .- .-.. ...- . ..--.- - . ... - ..--.- -.-. .-.. --- ... . see you at the mint

decoded morse 
0/6
closes at 2 for every action
  1. DecodersMorse found, unpacked to plain text
  2. Pattern matchNot on the shared list yet
  3. ClassifierInjection model votes closed
  4. Instruction checkAn order sitting inside data
  5. Action contextNext step moves money: strict
  6. JudgeSecond model agrees
closed, 5 of 6

Transfer blocked. The wallet gets receipt 0x91af…c2d0. If an admin confirms the input as a new attack, its fingerprint joins the shared list for every Bivalve user.

Three verdicts

Open

Clean. The agent acts normally.

Narrow

Suspicious. Low-risk actions only, like reading or posting.

Closed

Blocked, with a signed receipt saying why.

It reads what your agent reads.

Built for crypto inputs.

SourceWhat it readsWhy it matters
x.postPosts, replies, DMs, quoted posts and link previews on X and Farcaster.Social feeds are where most public attacks on trading agents start.
token.metadataToken and NFT names, descriptions, attributes and URIs on Robinhood Chain.Anyone can write metadata, and agents read it to decide what to buy.
emailInbox messages and attachments as text.Nine of ten models raised their own spending limits after reading a passcode from the owner’s inbox.
web.pagePages the agent browses, including hidden elements and comments.Text a human never sees still reaches the model.
mcp.outputWhatever an MCP tool returns, checked before the agent sees it.A compromised tool can talk to the agent directly.
erc8004.agentAgent registration files and agent cards.Agents are starting to hire agents they have never met.
Decodes the tricks used against wallets:
  • morse
  • base64
  • hex
  • zero-width
  • homoglyphs
  • right-to-left
  • hidden html
  • markdown comments

One call before every action.

Send the input, where it came from, and what the agent is about to do. Bivalve answers open, narrow or closed. The TypeScript and Python SDKs wrap any input in one line, with retries, caching and a local fail-safe.

import { bivalve } from "@bivalve/sdk"

const v = await bivalve.filter({
  source:  "x.post",
  content: reply.text,
  agent:   "rh:0x7c1e…f815",
  action:  "transfer",
})

if (v.state === "closed") return halt(v.receipt)

A verdict your wallet can check.

Other tools return a score and leave the decision to you. Bivalve signs each verdict, and a Leash wallet can refuse to sign a transfer unless the input behind it came back open.

agentreads a reply
quorum votes
receiptsigned verdict
leash walletwaiting

One catch protects everyone

When a new attack is confirmed, its fingerprint goes into a shared pattern list. Hashes of confirmed patterns are posted on Robinhood Chain, so anyone can check when a pattern was known.

Keeps nothing it reads

Bivalve stores hashes and verdicts, never the content, the same rule eyebrow holds itself to. Content leaves Bivalve in three cases. When the other detectors disagree, the judge sends the text to Anthropic’s Claude model to decide. For priority and network keys, the judge sees every request. For a key that opts in to third-party operators, each request also goes to up to three of them. Images stay on Bivalve’s servers, where OCR reads their text. Bivalve keeps neither the text nor any answer.

Pairs with eyebrow

eyebrow checks the code an agent runs, and Bivalve checks what the agent is told. Each verdict shows the agent’s eyebrow status next to it.