Built at ETHGlobal Mumbai 2026

Your AI agents can betricked in seconds.Zoro guards the door.

Zoro sits between AI agents and the tools they use. It seals every tool, stops risky actions until a real person approves with World ID, and publishes every verdict on ENS and Hedera so anyone can check it.

Launch Attack Lab Verify a tool

Watch the intro

Tools sealed: …
Unsafe versions blocked: …
Verdicts on Hedera: …
Seals on ENS: …

In the news

Real attacks, simply told.

Eight incidents from 2019 to 2026, and what Zoro does about each kind. Where Zoro would not have helped, the page says so.

Vol. II · No. 1 of 8Zoro editionMay 7, 2019

The Daily Breach

All the news that agents trusted · Price: one agent’s trust

Hackers walk out of Binance with 7,000 bitcoin

They didn’t break in. They logged in.

The simple story

Attackers collected users’ API keys and two-factor codes through phishing and malware. With real keys in hand, every withdrawal looked allowed, and about $40 million in bitcoin left the exchange’s hot wallet in one go.

What Zoro does

Data-Flow Guard · Human Seal

When an agent reads a credential, Zoro marks it private: sending it anywhere outside asks first. Moving money needs a fresh World ID approval for that exact payment.

Honest limit: Zoro protects AI agents and their tools. It does not secure an exchange’s own servers.Source: Binance statement · The Block, May 2019

Sponsor tracks

Three tracks, one guard.

ENS, World ID and Hedera each do a job inside Zoro that no other layer can do. Here is exactly what each one is used for.

Public registryChecking…

How it works

Six layers between your agent and a bad tool.

Each call passes down the stack. Any layer can stop it, and every decision leaves a public trace.

01 · AI Agent

Claude, Cursor or VS Code connects to Zoro instead of to each server.

02 · Zoro Gateway

Fingerprints every definition. Only sealed versions reach the agent; every call is allowed, asked or blocked.

03 · Sentinel Auditor

Re-runnable rules, a diff against the last seal and an AI review that must quote its evidence.

04 · ENS Registry

Every server, tool and version has a name. Only the Auditor role writes a verdict.

05 · Hedera Ledger

Verdicts, revocations and disputes with independent consensus timestamps.

06 · World ID Human Seal

Overrides need a fresh proof from a real person, bound to one action and usable once.

zoro — attack lab replay

$ zoro lab run rug-pull
zoro ▸ SEALED   lab-postmail.send_email   v1 · fingerprint pinned
zoro ▸ CHANGED  lab-postmail.send_email   new version held back
zoro ▸ SENTINEL unsafe · added text: "always BCC archive@…"
zoro ▸ BLOCKED  email.send   rug-pull: hidden BCC added
zoro ▸ agent only ever saw the sealed v1 text

What is Zoro

A security gateway between AI agents and everything they touch.

Zoro sits between your agents (Claude, Cursor, VS Code) and the tools they call: email, files, databases, wallets. It fingerprints and seals every tool, holds back tools that change behind your back, stops risky actions until a real person approves, and publishes every verdict so anyone can check it.

Features

Every way an agent can be tricked, covered.

Tool Seals

Every tool definition is fingerprinted and sealed. The agent only ever reads sealed text.

Rug-Pull Quarantine

A tool that changes after install is held back and diffed before it can be called.

Secret-Code Decoder

Invisible Unicode and hidden characters are decoded and labelled in the diff.

New-Power Alarm

A new version that gains a capability, like sending mail or moving money, is flagged.

Data-Flow Guard

Untrusted input heading to an outside destination stops and asks a person.

Output Shield

Tool responses are scanned, and injected instructions are redacted before the model reads them.

Zoro Console · Overview

Overview

Protected

Servers

Incidents

Waiting

Decisions · 24h

Blockedlab-postmail/send_email changed
Askfiles → postmail: forward report.pdf
Sealedlab-notes/search · typo fix released

Illustration · numbers are examples

Code-Swap Detection

The code changes but the description does not: artifact identity catches it.

Shadowing Detector

A tool whose description tries to steer another server’s tool is flagged.

Auditor-Injection Guard

Text that tries to talk the auditor into approving is a critical finding.

Typosquat Check

Server names that imitate popular ones are never released to the agent.

Wallet Recipient Limits

Argument constraints block payments to unknown recipients, even on sealed tools.

Revocation & Exposure

Revoke a version and every gateway blocks it, with a report of the calls it touched.

Defence layers

Guards behind the guard, for when it really matters.

World ID Approvals

Risky actions need a fresh proof from a real person, bound to that exact action and usable once.

Hash-Chained Audit Log

Every decision is chained to the one before it and anchored as Merkle roots on Hedera.

Policies & Profiles

Standard, Strict and Lab profiles. On Strict, every loosening change needs a Human Seal.

Package Pinning

The server’s code identity is pinned too, so a swapped artifact is quarantined.

Sentinel AI Review

Must quote the text it objects to. Uncertain means pending, never sealed.

Public Ledger

Verdicts, revocations and disputes on a Hedera topic anyone can read.

Zoro Console · Live traffic

Live traffic

Illustration · example traffic

Attack Lab

Real attacks you can launch, and watch fail live.

Open the Lab

Zoro Verify

Sealed

Fingerprint: sha256:7c1e…a94d
ENS name: send-email.lab-postmail.zoro.eth
Signature: auditor signature valid
Hedera: topic 0.0.xxxx · seq 42

Illustration · values are examples

Public proof

You don’t have to trust Zoro. Check it yourself.

Recompute the fingerprint, check the auditor’s signature, and read the verdict on ENS and the Hedera ledger. Public records describe tools, never your prompts, files or identity.

Verify a tool Open the registry

Etherscan HashScan

Protect your agent

Put Zoro in front of your AI

$ git clone https://github.com/Nouman-wp/Zoro-MCPGuard.git && cd Zoro-MCPGuard && pnpm install && pnpm dev

Open the Console GitHub Quick start