The State of Agent Trust

We built an index of ERC-8004ERC-8004An Ethereum standard for on-chain agent identity and reputation. Three registries (Identity, Reputation, Validation) give agents a portable, verifiable presence. Identity and Reputation are live; Validation is not deployed.A business register plus a review site for AI agents. Identity is the incorporation record (who the agent is and where to reach it), Reputation is the review feed, and Validation is meant to be the independent auditor. The auditor has not opened yet.Read more →, the on-chain standard for agent identity and reputation, and pulled the record for every agent on the two live registries. As of 9 July 2026 that is 95,142 agents across Ethereum mainnet and Base.

The identity layer works. The reputation layer mostly hasn’t. Most agents carry no reputation, most of the reputation that exists has no on-chain settlement behind it, and one in six points at a registration file we can’t even read.

Every count below comes from the raw logs of the two registries, decoded and reconciled against USDC settlement on Base. None of it is a verdict on any single agent. It’s what the chain says when you read all of it at once, with the coverage limits stated as we go.

What ERC-8004 is meant to do

ERC-8004 gives an autonomous agentAI AgentAn AI system that takes a goal and acts on it across multiple steps, calling tools, APIs, or other models to get there, rather than just answering one prompt. In crypto, agents often hold a wallet and transact on-chain.Less like a calculator you punch a sum into, more like a contractor you hand a brief. You say what you want done; it plans the steps, picks the tools, and comes back with a result, occasionally making a mess if the brief was vague.Read more → an identity and a reputation that anyone can look up without trusting a central directory. It has three registries:

1. Identity. An NFTNFTNon-Fungible Token. A unique blockchain-tracked asset where each token is distinguishable from every other. Where regular tokens are interchangeable, NFTs represent unique items like art, collectibles, in-game assets, or domain names.Like the difference between a $20 note and a signed first-edition novel. The notes are interchangeable, any $20 buys the same thing as any other. The book is one of a kind, and its value depends entirely on which specific book it is.Read more → per agent. Its metadata points at an off-chain registration file that declares the agent’s endpoints and capabilities.
2. Reputation. Client feedback, written on-chain as attestationsAttestationA cryptographic proof that a piece of code is running on a specific hardware enclave in an unmodified state. Attestation lets remote users verify that a service is genuinely running what it claims to be running.Like a tamper-evident seal on a medicine bottle. The seal itself doesn't make the medicine safe, but it gives you a way to verify that nobody opened the bottle and swapped the contents before you bought it.Read more →.
3. Validation. Independent checks of what an agent actually did.

Only two are live. Identity and Reputation deployed at matching addresses on mainnet and Base in late January and early February 2026. Validation isn’t deployed on any chain, and the spec is still being revised. So the standard today is an identity layer and a feedback layer with the audit layer missing. That gap sets the ceiling on how far the other two can be trusted.

The identity layer shipped

Registration works. 95,142 agents exist on-chain, 36,482 on mainnet and 58,660 on Base, each a token with an owner and a metadata pointer. The contractSmart ContractA program stored on a blockchain that runs automatically when its conditions are met. Smart contracts are how blockchains do anything beyond just transferring tokens — DeFi, NFTs, DAOs, and DeAI infrastructure all run on smart contracts.Like a vending machine. You put in the right input and it produces the expected output, no human operator required. The rules are fixed in the machine itself, anyone can use it, and nobody can stop a transaction in the middle.Read more → enforces its core rule: an agent’s owner can’t post feedback on its own agent. We checked that against the spec and in the data.

Registration is front-loaded. Mainnet took 22,695 registrations in its launch month of January 2026; Base took 21,641 in February. Both taper after the opening rush, the usual shape for a standard that early adopters pile into and then explore.

Ownership is concentrated. One mainnet owner holds 2,663 agents, one Base owner holds 2,289, and several hundred owners on each chain hold more than five. Most owners hold one. A single wallet minting thousands of identities is the standard working as designed, but it makes agent count a weak proxy for how many people are actually here.

Fifteen percent have no registration you can read

We fetched the off-chain registration file for every agent that declared one. 14,953 agents, 15.7% of the total, have no valid file on record.

Fetch result	Agents
Valid file stored	43,147
Host unreachable	6,030
Invalid or unparseable JSON	4,619
URI scheme we don’t fetch	3,284
Timed out	519
Blocked by the SSRF guard	432
Above the 256 KB cap	69

About 11,669 agents (12%) point at a file that is unreachable, times out, or won’t parse. Another 3,284 use a URI scheme our fetcher doesn’t cover, like DID, ENS or Arweave, so that slice is a limit of our reach rather than a dead agent. The other 43,147 are valid files we retrieved and stored.

Fact: 11,669 ERC-8004 agents point at a registration file that’s unreachable or unparseable; another 3,284 use a scheme our fetcher doesn’t cover. Together, 14,953 (15.7%) have no valid registration on record as of 9 July 2026.

Take: This is the cost of putting a pointer on-chain and the payload off it. The identity token is permanent; the registration it references decays on the ordinary schedule of dead links, lapsed hosts and dropped IPFS pins. An agent you can’t fetch is an agent you can’t evaluate, and one in eight of them has already gone quiet.

Reputation is thin, and it clusters

Reputation is where the standard is supposed to earn trust, and it’s mostly empty. The population thins fast as you raise the bar:

• Any feedback at all: 32.6% of agents. On mainnet it’s 4.5%; on Base, where most activity sits, 50%.
• Five or more entries: 9,169 agents.
• Twenty or more: 357.

The feedback that does exist tends to cluster, in two patterns:

• Circular feedback, 409 agents. Raters and rated are entangled, through reciprocal ratings or a shared funding source. One agent alone carries 112,534 reciprocal feedback entries from nine wallets.
• Burst feedback, 387 agents. Most of the feedback lands inside a single hour, on an agent older than a day.

The contract blocks an owner from rating its own agent, so this isn’t crude self-rating. The rings route around the one rule it enforces.

Flag	Agents	What it marks
No settlement behind reputation	6,925	5+ feedback, no observed Base USDC settlement
No valid registration file	14,953	latest registration fetch failed
Declares x402, no inbound USDC	1,317	claims a paid endpoint, none observed
Circular feedback	409	reciprocal rings or shared funding
Burst feedback	387	most feedback inside one hour
Single-purpose raters	46	raters that rate only this agent

None of these flags is an accusation. Circular feedback has honest explanations, and the thresholds are deliberately conservative. The structural point stands, though: a reputation you can’t reconcile against anything tells you nothing, and a meaningful share of the reputation here sits inside patterns a buyer should discount.

The number that matters: reputation without settlement

Take the agents that carry reputation, five feedback entries or more, and ask whether money actually moved for them. On Base, the chain with settlement data, 6,925 of 9,083 show no observed on-chain settlement. That is 76.2%.

Fact: Of the 9,083 Base agents with five or more feedback entries, 6,925 (76.2%) show no observed native-USDC settlement on their owner wallet after registration.

Take: Reputation on this standard is largely decoupled from observed money. The scope is real, off-chain and undeclared-wallet payment is invisible to us, but even discounted heavily, a three-in-four gap says the feedback layer isn’t yet backed by activity you can see.

The scope carries weight here. We looked at native USDC settlement on Base, across each agent’s owner wallet, after it registered. An agent paid through an undeclared wallet, in another token, on another chain, or off-chain would look settlement-free here even when it isn’t. x402x402An open payment protocol from Coinbase that repurposes the long-dormant HTTP 402 status code. A server responds with a price, the client pays in stablecoins on-chain, and the request is fulfilled. No accounts, no API keys, no card details.Like a vending machine for HTTP. The endpoint says "pay 1 cent for this", the agent drops in a coin, and the document comes out. Settles on a blockchain underneath, but the payment layer is invisible to the caller.Read more → makes it harder again: on-chain, an x402 payment is close to indistinguishable from an ordinary USDC transfer, so we read observed USDC flow, not provable revenue. The 76.2% says as much about our coverage as about the agents.

The direction survives all of that. The feedback is on-chain; the money mostly isn’t visible beside it. For a standard selling verifiable agent trust, that is the headline.

Paid endpoints with no payments observed

1,317 agents declare in their registration file that they take x402 payments and show no observed inbound USDC on Base. Declaring a paid endpoint is cheap. Getting paid is an event. The spread between the two is one read on how much of the agent economy is live rather than staged.

The declared capabilities point the same way. Agents declare plenty of surface:

• Web endpoint: 9,397 agents
• MCPMCP (Model Context Protocol)An open standard that lets AI applications connect to external tools, data sources, and services through a common interface, so any compliant agent can use any compliant tool without custom integration work.Like a USB port for AI agents. Before a universal port, every device needed its own cable and driver. A shared standard means any tool that speaks the protocol plugs into any agent that speaks it, no bespoke wiring required.Read more → endpoint: 5,180
• Agent-to-agent: 4,309
• Agent wallet: 1,716

Barely any of it shows up as settled activity in the window we can see.

Position

ERC-8004 shipped the easy layer and hasn’t earned the hard one. Identity works: agents exist, they’re owned, they’re portable across two chains, and the contract holds its core rule. Reputation and validation are the parts that would make agent trust permissionlessPermissionlessA system anyone can use or build on without asking a gatekeeper. No application, no allowlist, no approval step. If you meet the protocol's on-chain rules, you are in. The opposite of permissioned.Like a public road versus a members' club. Anyone with a car can drive on the road; the club checks your name at the door. Permissionless protocols are the road.Read more →, and on the evidence they’re thin, clustered, unreconciled, or in validation’s case not deployed at all.

The owner-side takeaway is simple. Don’t trust an agent’s reputation because it sits on-chain. On-chain makes a claim auditable, which is a long way short of true. A reputation you can reconcile against settlement is worth something. One you can’t is a story with a hash on it.

We publish the method with the numbers, thresholds and all, because a trust index you can’t audit has the exact problem it’s meant to solve. This is v0.1, scoped to what’s observable on Base. Validation, when it deploys, could close the gap between what an agent claims and what it can prove. Until then, the identity holds and the trust is still mostly asserted.

The other side of this is constructive. The same on-chain record that exposes the fakes also picks out the agents that stand up, and four checks before you trust an agent sets out the short version you can run yourself.

The record is on-chain for anyone to check. Most people won’t. That’s what the index is for. Live figures are on the State of Agent Trust dashboard.