Robyn — Gasless Cross-Chain for AI Agents

Try Plus before paying: submit up to 20 BLINDED tokens (base64, from plus-sdk blindTokens()) and receive blind signatures — identical unlinkable passes to paid ones. One trial per day per caller. Unblind locally (plus-sdk trial() does all of this). This tool never sees an unblinded pass.

Run this before robyn_prepare/robyn_submit. Returns decision GO or NO_GO plus typed `blockers` (each with a `fix`) and `warnings`. It catches, for free, the failures that otherwise cost gas: a fixed corridor fee that would consume the whole amount so nothing arrives, a recipient in the wrong address family, a corridor that can price but not settle, and a transfer above the instant lane's capacity that would silently pay a dearer bridge. Read-only — signs nothing, moves nothing. Pass fromAddress so membership (free micro-transfers) is recognised.

ONE call combining serviceability, routing competitiveness, cheaper alternatives, delivery basis and mandate budget into a single go/no-go. Call this before executing rather than making five separate checks. BLOCKERS AND WARNINGS ARE DIFFERENT. `blockers` WILL fail — do not attempt the transfer. `warnings` are things to tell the user or act on first; they do not prevent execution. Never present a warning as a failure or a blocker as advice. Anything in `unavailable` means a check could NOT run: treat it as unknown, not fine. `proceed:true` means nothing known blocks it — it is not a guarantee of success.

Turn a plain-language or structured intent into a concrete plan plus the EXACT payload to sign. Costs nothing, moves nothing, needs no key. Returns status:"sign" with signRequest, or status:"quoted" if something is still missing.

ONE read that tells you, for a chain and for the lane you reached Robyn on, exactly what stays private (relay lane, PQ transport, private mempool / sequencer) and what is still public (on-chain settlement, stealth is not PQ), the live mode of every privacy feature (messaging v2, Plus, netting-set shadow/live, cover rows), and how to raise your quota WITHOUT an identity (a blind Plus pass instead of an API key). Call it first when planning; it reads live flags, never a brochure.

Best gasless route to move a token from one Robyn chain to another. Returns estimated output, the bridge used, duration, and the Robyn fee. Read-only — moves nothing. IMPORTANT: check `quoteOnly` on the response. If it is true the corridor can be PRICED but NOT settled — execute will refuse it with UNSUPPORTED_DIRECTION — so present that quote as a price comparison only and do not tell the user it can be sent. `quoteOnlyReason` says why. Absent/false means executable.

Hands a relayer-signed settlement receipt (from robyn_settle / a completed route) to the counterparty's sealed messaging-v2 mailbox, so they get verifiable proof (terms honored, authorized, clean provenance) WITHOUT ever contacting Robyn. Same wire shape as any message; content-hash idempotent. Only receipts signed by this relayer are accepted.

Checks digest + relayer signature + signed terms of a receipt you received (e.g. opened from your v2 mailbox). Read-only.

Ordered playbooks for real goals: pay-someone-safely, prove-what-i-spent, spend-within-a-budget, handle-failures-well, stay-current. CALL THIS BEFORE IMPROVISING A SEQUENCE. Each step says what it answers, what to do with the answer, whether it is optional, and what skipping it costs. Steps marked optional:false should not be skipped — `skippingCosts` explains the concrete harm, not a style preference.

Check a signed refusal receipt. Send header `x-anygas-receipt: 1` on any request and, IF Robyn refuses it, the error response carries a signed `refusalReceipt` recording what was asked, when, and why. This matters because when a provider says no, the AGENT gets the blame — a receipt lets you prove to your principal that you were blocked externally rather than simply failing. It proves the refusal HAPPENED; it does not claim the refusal was correct.

Status of an in-flight route by id (BRIDGING → DONE), with the destination tx once delivered.

Runs the identical path end to end against the sandbox: no key, no funds, no broadcast. Use this to prove an integration works before touching real money.

The one-verb primitive. Say where value should go; Robyn returns the best route (all rails compared), the gasless method (no native token needed), the privacy posture that will apply (API-relay + private mempool where available + uniform shape), and what the settlement receipt will prove — in a SINGLE call. It collapses quote + preflight + prepare. Planning only: it never broadcasts — sign + submit via robyn_submit. Add private:true to request private-mempool execution where an endpoint exists.

A statement of every transfer in a window with each fee broken down, SIGNED by Robyn's relayer key (EIP-191). Use this when you must PROVE to a principal what you spent — your own summary is a claim by the party being audited, but this is verifiable against a published address without trusting you or Robyn. Read `limitations` and repeat them: the statement covers the Robyn float lane only and excludes other rails and the custodial netting book, so it may not be a complete picture of activity.

Price or request an EIP-7702 sponsored transaction: Robyn submits your signed authorization as a type-4 transaction and PAYS THE GAS, so your account needs no native token. Over this HOSTED endpoint the call is a DRY price-check (returns estGas, priceUsd and the exact envelope) — paying the x402 invoice to broadcast requires calling POST /api/7702/sponsor directly with an X-PAYMENT header.

Relay an intent you already signed. The relayer broadcasts it and fronts all network gas; your account needs no native token. Build `permit2` from robyn_prepare: sign its signRequest.eip712 payload (canonical Permit2 domain + PermitTransferFrom/TokenPermissions types) and pass the OBJECT below - not a bare signature string. The signed spender must be the relayer from signRequest.spender, otherwise the permit cannot be redeemed. Supply idempotencyKey so a retry after a timeout cannot double-spend. TO REHEARSE WITHOUT BROADCASTING set dryRun:true — it returns {status:"DRY", broadcast:false, wouldSend} and moves nothing, on EVERY corridor. Do NOT assume that omitting a live flag means dry: that holds on the float lane and the non-EVM legs, but the EVM-to-EVM path ignores it and BROADCASTS.

Check what ACTUALLY happened to a settled transfer, against the destination chain rather than Robyn's own database. Optionally assert who should have been paid (`recipient`) and the minimum that should have arrived (`minAmount`); we decode the payout transaction's ERC-20 Transfer logs and report whether reality matches. Also cross-checks Robyn's own receipt against the chain and says so if the books disagree. THE VERDICT IS THREE-VALUED: `verified`, `failed`, or `undetermined`. Treat `undetermined` as UNKNOWN, never as success — it means the chain was unreachable, the tx is not mined, or the rail records completion as a balance delta that cannot be re-derived (Allbridge/Chainflip/Solana/Tron). Do not tell a user a transfer is confirmed on an undetermined result.

Check whether an address holds a recognised member NFT and what it gets. Members pay ZERO on cross-chain transfers of $0.10-$25 to low-cost chains, 15bps instead of 25bps routing, and 10% instead of 25% gas markup. Read-only. Call this before quoting for a user so you can tell them accurately what a transfer will cost — and, if they are not a member, what holding a recognised NFT would save them.

Returns the full routing decision: every rail that quoted, what each would deliver, the margin the winner won by, and which rails stayed SILENT and why. Signed, so you can archive the rationale. CHECK `wasCompetitive` BEFORE TELLING A USER THE PRICE IS GOOD. If it is false, exactly one rail answered and "best" means "only" — it did not beat anything. Rails in `silentRails` did NOT lose; they failed to answer (down, rate-limited, missing credentials). Never describe them as more expensive.

An agent's own Aave v3 / Moonwell position (aUSDC/mUSDC) per chain + the capped allowance it granted the relayer + live APY (best-yield auto-selected). Non-custodial: funds stay in the agent's wallet, Robyn holds no key and no pool.

Read-only JIT quote: how a spend would be fulfilled from an agent's Aave yield venue (draw <= your allowance -> Aave/Moonwell withdraw -> gasless deliver). Moves nothing.

Spend from your yield (Aave v3 or Moonwell) with ONE EIP-712 signature: Robyn pulls only up to your on-chain aUSDC/mUSDC allowance, unwinds exactly what is needed, and delivers gaslessly; the remainder keeps earning. This HOSTED endpoint is READ-ONLY: it returns the exact EIP-712 intent to sign + a live quote. To execute, sign it and POST {intent,signature,live:true} to /svc/api/ncaccount/spend, or run `npx anygas-mcp` locally with ROBYN_SIGNER_KEY. One-time setup: supply USDC to Aave v3 or Moonwell in your wallet + approve the relayer for your aUSDC/mUSDC up to your risk budget.