Don't trust software. Make it post bond.
Infrabond is a bond market for the APIs, MCP servers and feeds that software depends on. Operators put capital behind promises the protocol measures every minute. Backers add theirs for a premium. When a promise breaks, the customers who paid are compensated by formula, at a payout address the public record does not tie to the wallet that paid.
A promise that costs nothing to break is not a promise.
Bondedand measured
The boardQuotes feed
availability ≥ 99.5%
freshness ≤ 2 min
Every promise is a number
- From a fixed menuAvailability, p95 latency, freshness, deviation against Chainlink, and MCP tool stability. Each one has a target the operator writes into the bond.
- Probed every minuteHTTP and RPC answers, MCP handshakes, unpaid x402 requests. The prober never pays and never calls a tool.
- Checked against an oraclePrice feeds of tokenized stocks are compared with the Chainlink answer on this chain, read at the same block.
Window posted · block 92,780,316
25 services, 250 probes
root 0xc9d659...d20f
Measured every minute, posted every ten
- Proof of timeEach probe record carries the hash of the latest block seen just before it, and lands onchain within ten minutes. It was not made earlier, and not later.
- RecomputableEvery raw record is published as JSON under its Merkle root. Settlement reads only the aggregates onchain.
- The outage ruleIf half the watched services fail in the same window, the window is voided for everyone. Our own network can't slash anyone.
Settlement is a formula
10 bps per failed probe past the allowance
capped at 30% of a leg per epoch
Breaking it costs money by formula
- Operator firstThe operator's own capital is the junior tranche. Backers lose nothing until it is gone.
- Customers paid backSlashed USDG goes to the customers who paid the service onchain during the epoch, up to three times what each paid.
- $IBOND burnsThe slash on a $IBOND leg is sent to the dead address. Backing a flaky service costs its backers.
A compensation leaf
(payout, amount, paid)
the paying wallet is not in it
Measured in public, paid in private
- Unlinkable payoutsName a one-time payout address with each payment. Compensation goes there and the published leaves never show the wallet that paid. The relayer submits the claim, so the new address needs no gas.
- Sealed endpointsAn operator can bond a service without publishing its URL. The chain and the board show a commitment and the measurements. Only the prober holds the address.
- Minimal dataProbe records keep a hash of each response and its timing, never the body. Accounts are passkeys, with no email and no identity check.
Every service,
with its record.
The house bonds its own four services with real USDG. Third-party services are probed read-only and show 0 bonded until their operator claims them.
All 25 servicesavailability ≥ 99%
100%
Availability over the last 180 probes. 0.28 USDG behind it, 20% premium.
Bond what you can measure
A promise is a number from a fixed menu, measured the same way for every service, by kind.
Issue a bondAvailability
expected status and a body that matches its JSON schema
Latency
p95 of successful probes, per hour
Freshness
lag against a public reference
Built for agents
Where agents already are: an MCP server, an SDK, x402 endpoints, an HTTP API and one onchain view.
find_bonded, over MCP
An agent asks the MCP server for a dependency with money behind it: a kind, a promise, a minimum of capital. It gets back services with their records.
isBonded and bonded() in the SDK
One call checks a service before you pay it. The bonded() middleware serves your /.well-known/bond.json and tags every response with X-Bond.
Records over x402
Raw probe records with their Merkle proofs cost $0.001 a read. Adding any public endpoint to the watch costs $0.10 for 30 days.
isBonded onchain
A spending policy or a v4 hook can require bonded dependencies with one view call to BondBook: capital, promise mask, status.
Claim, issue,
get backed
Any service on the board can be claimed by its operator. A bond needs first-loss capital and a week of premium. Backers do the rest.
Issue a bond01
Claim
Publish /.well-known/bond.json signed by your operator address, or a DNS TXT record. The registrar records you as the operator.
02
Issue
Choose promises, face value, premium and epoch length. Post at least 20% of each leg as your junior tranche and seven days of premium.
03
Get backed
Backers fill the USDG leg and the $IBOND leg up to their caps. Your premium streams to them by the second.
Depend on it, run it,
or back it.
All three paths use the same contracts. Customers read records, operators post bonds, and backers take the premium along with the risk.
Pick a dependency with money behind it
DocsBond your API, feed or MCP server
Issue a bondPut USDG or $IBOND behind a record you trust
Back a service
A promise that costs nothing to break is not a promise.
Read a service's record and the capital behind it, then depend on the ones that put money behind their word.
Open the board