Tychi Agent Finance (agent-finance) — open-source client stack for Tychi. Two packages, one trust model:
| Package | Path |
|---|---|
@tychilabs/agent-finance |
typescript/SECURITY.md |
@tychilabs/agent-finance-mcp |
framework-extensions/model-context-protocol/SECURITY.md |
Do not open a public GitHub issue for security vulnerabilities.
Report privately to yash@tychilabs.com with package name, version, environment, steps to reproduce, and whether seed, EVM keys, session/LLM credentials, JWTs, or signed payloads are exposed.
- Agent's device: identity seed + EVM private key in local encrypted vault (
~/.tyiby default). Signatures for on-chain txs and x402 happen here. - Your config: vault password, session password, LLM key, API URL — SDK args or MCP host env. Never commit real secrets to git.
- Tychi: sessions, policy, orchestrated money actions. Prepares txs/x402 within policy. Does not hold the agent's private key.
- Vault, signing, x402, ERC-8004 in the SDK →
typescript/SECURITY.md - MCP env leaks, tool output, host config →
framework-extensions/model-context-protocol/SECURITY.md
- Third-party RPC or LLM provider issues
- Tychi service bugs not caused by client package behavior
- Local machine compromise