Coal — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Coal (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
0G APAC Hackathon 2026 — Track 3: Agentic Economy
>
Payments for humans and AI agents — one checkout, real USDC on Base, verifiable receipts on 0G.
| Surface | URL |
|---|---|
| Marketing site | usecoal.xyz |
| Public API | api.usecoal.xyz |
| Hosted checkout | usecoal.xyz/pay/... |
| Live AI-agent demo (Claude buying ebooks) | agent.usecoal.xyz |
| Demo merchant store (with download flow) | store.usecoal.xyz |
| MCP server (multi-tenant) | mcp.usecoal.xyz/api/mcp |
| x402 oracle paywall demo | oracle.usecoal.xyz/api/price/ETH |
| Live 0G health (all 5 components) | api.usecoal.xyz/api/0g/health |
| Docs site | usecoal.xyz/docs |
| React SDK on npm | coal-react v0.4.1 |
| Video | Length | Link |
|---|---|---|
| Pitch video (for judges) | ~5 min | https://youtu.be/FOieBgJ3j4A |
| Launch / demo video (for users) | ~2 min | https://youtu.be/fnlcOIcK-yk |
| Pitch deck (PDF) | 12 slides | https://www.usecoal.xyz/coal-pitch-deck.pdf |
Coal is a programmable commerce platform for hosted checkout, merchant APIs, payment links, paywalls, recurring billing, and agentic commerce flows.
Coal is built around a simple split:
Coal handles checkout orchestration, merchant operations, payer-info capture, recurring billing, and dual-protocol agent settlement flows on Base.0G adds the sidecar layer for artifact storage, receipt proof anchoring, merchant memory, and AI commerce endpoints.This repo is an active product branch, not a tiny demo. The current codebase includes:
/verify endpointcoal-react SDK on npmCoal uses five 0G network components. All live on 0G mainnet. Full setup walkthrough lives on the docs site at usecoal.xyz/docs.
Every payment receipt, merchant profile, and encrypted memory snapshot is published to 0G Storage as an immutable, content-addressed artifact. AI agents and apps can discover merchants and verify payments by reading these artifacts directly from the decentralized storage network.
After publishing a receipt to 0G Storage, Coal anchors a SHA-256 hash of the receipt payload on-chain via the CoalReceiptAnchor V2 smart contract. Creates a tamper-proof, independently verifiable proof that a specific payment happened at a specific time. V2 calls the DASigners precompile (epochNumber()) and embeds the current DA epoch into every anchor event.
0x24a80A3Bb16d26D4063Ecd4B2fD64C6856E25E8bCoal's agent-facing APIs use 0G Compute for AI inference on the decentralized GPU network:
broker.inference.verifyService(). Responses from sealed queries carry a verification signature from the Intel TDX + NVIDIA H100/H200 enclave they ran inside.KV writes keep merchant profiles, memory pointers, and paywall manifests always-current on top of the 0G log layer, so agent discovery returns fresh data without walking the full log history.
merchant:profile:latest — merchant profile bundlemerchant:memory:latest — memory pointer (storage URI + root hash + timestamp)paywall:{id}:manifest:latest — x402 paywall manifestEvery confirmed payment, subscription lifecycle event, and webhook delivery is posted as a DA blob to the 0G Data Availability layer via a gRPC sidecar. External systems monitoring the DA stream see events in real time.
payment_confirmed, subscription_created, subscription_renewed, webhook_delivered, paywall_access_granted, receipt_anchoredflowchart TB
subgraph Actors
M["Merchant<br/><small>Console Dashboard</small>"]
C["Customer<br/><small>Browser / Wallet</small>"]
AG["AI Agent<br/><small>AgentKit / x402</small>"]
end
subgraph Coal["Coal Platform"]
direction TB
API["Console API<br/><small>Products, Links, Keys, Settings</small>"]
CHK["Checkout Engine<br/><small>Sessions, Payments, Verification</small>"]
PW["Paywall Gateway<br/><small>x402, Access Control, Manifests</small>"]
RP["Receipt Publisher<br/><small>Proof Generation, Anchoring</small>"]
ACI["Agent Commerce API<br/><small>Memory, Routing, Policy Eval</small>"]
SUB["Subscription Engine<br/><small>Recurring Billing, Renewals</small>"]
WH["Webhook Delivery<br/><small>Events, Retries, HMAC Signing</small>"]
DB[("Neon Postgres")]
AUTH["Privy Auth"]
end
subgraph ZG["0G Network — 5 Components Live on Mainnet"]
direction TB
ZGS["<b>1. 0G Storage</b><br/><small>Immutable receipt logs<br/>Merchant profiles<br/>Encrypted memory snapshots</small>"]
ZGC["<b>2. 0G Chain</b><br/><small>CoalReceiptAnchor V2<br/>Calls DASigners precompile<br/>SHA-256 proof anchors</small>"]
ZGX["<b>3. 0G Compute</b><br/><small>AI commerce inference<br/>Sealed Inference with TEE<br/>Per-response attestation</small>"]
ZGK["<b>4. 0G KV</b><br/><small>Mutable merchant mirror<br/>Per-merchant stream IDs<br/>Live agent discovery</small>"]
ZGD["<b>5. 0G DA</b><br/><small>Payment event streaming<br/>gRPC sidecar<br/>6 event types</small>"]
end
BASE["<b>Base (Coinbase L2)</b><br/><small>USDC settlement<br/>RPC fallback: Alchemy → mainnet.base.org</small>"]
M -->|API| API
C -->|Checkout| CHK
AG -->|x402 / API| PW
AG -->|Commerce| ACI
RP -->|publish| ZGS
RP -->|anchor| ZGC
ACI -->|infer| ZGX
API -->|mirror| ZGK
RP -->|DA events| ZGD
CHK --> BASE
API --> DB
API --> AUTH
style Coal fill:#1a1a2e,stroke:#334155,color:#e2e8f0
style ZG fill:#115e59,stroke:#2dd4bf,color:#ccfbf1
style BASE fill:#1d4ed8,stroke:#60a5fa,color:#bfdbfe
style Actors fill:#f8fafc,stroke:#cbd5e1,color:#1e293bCoal's paywall /verify endpoint accepts both payment envelopes on the same URL — Coinbase's x402 (v1) and OKX's APP (v2). The dispatch picks the right settlement path based on the header version:
transferWithAuthorization on Base USDC. Gasless for the agent.Implementation:
backend/lib/x402-settle.ts — x402 v1 settlementbackend/lib/app-settle.ts — OKX APP v2 settlementbackend/app/api/paywalls/[id]/verify/route.ts](./backend/app/api/paywalls/[id]/verify/route.ts) — version dispatchTry the live x402 paywall on the oracle demo:
curl -i https://oracle.usecoal.xyz/api/price/ETH
# returns 402 Payment Required with the X-PAYMENT challengeCoal ships a multi-tenant MCP server at mcp.usecoal.xyz/api/mcp. 13 tools cover the full agent-commerce loop:
discover_merchants, search_products, get_merchant_profilequery_merchant_memory (TEE-backed natural-language Q&A)check_paywall, create_checkout, get_checkout_statusverify_receipt (3-step proof trail: Base TX → 0G Storage → 0G Chain)get_0g_health, agent_wallet_statuspay_merchant (USDC on Base via EIP-3009, gasless)download_product (verifies on-chain payment, returns signed download URL)setup_instructionsThe server holds no long-lived secrets — every user passes their own wallet key via X-Coal-Agent-Key and their own Coal API key via X-Coal-Api-Key on each request.
// Claude Desktop config
{
"mcpServers": {
"coal": {
"command": "npx",
"args": [
"mcp-remote",
"https://mcp.usecoal.xyz/api/mcp",
"--header",
"X-Coal-Agent-Key:0xYOUR_WALLET_PRIVATE_KEY"
]
}
}
}Source: examples/coal-mcp-server/. Docs: frontend/app/docs/sdk/mcp/.
/pay/[slug] and /pay/checkout/[id]/console/0gDistribution:
coal-react v0.4.1 shipped on npmEngagement beyond code:
Inbound signal:
"x402 + APP wire compat actually working is a real one… happy to point the mapper crawler at agent.usecoal.xyz for endpoint stability data in our public catalog." — CDP-verified Coinbase Developer Platform builder
Live proof anyone can check right now:
0x24a80A3Bb16d26D4063Ecd4B2fD64C6856E25E8b| Metric | Value |
|---|---|
| Test suite | 500+ tests across 35 files |
| 0G components live on mainnet | 5 — Storage, Chain, Compute, KV, DA |
| 0G receipt anchor (mainnet) | 0x24a80A3Bb16d26D4063Ecd4B2fD64C6856E25E8b |
| Base USDC (mainnet) | 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913 |
| Networks | Base mainnet (USDC) + 0G mainnet (chain ID 16661) |
| Agent-payment protocols supported | Coinbase x402 (v1) + OKX APP (v2) |
| MCP tools | 13 |
| React SDK | coal-react v0.4.1 |
| Live demo (Claude buying ebooks) | agent.usecoal.xyz |
| Live 0G health | api.usecoal.xyz/api/0g/health |
curl -s https://api.usecoal.xyz/api/0g/health | python3 -m json.toolExpect status: "ok" with storage, chain, compute, kv, and da all ok: true.
/verify/[session-id] on any paid checkout — shows Base TX → 0G Storage root → 0G Chain anchor with explorer links to each.curl -i https://oracle.usecoal.xyz/api/price/ETH returns a 402 with the X-PAYMENT challenge, then resubmit with an x402 v1 OR an OKX APP v2 payment header and the same endpoint settles it.cd examples/coal-react-checkout, cp .env.example .env.local, fill in your API key, npm install && npm run dev. See also examples/demo-store/ for the merchant-side flow with verified downloads.Coal is not being replaced by 0G.
Coal is the payment execution and merchant operations layer.0G is the storage, proof, memory, and AI layer around it.That is the correct mental model for the repo.
coal/
├── backend/ # Next.js API app, Prisma, on-chain verification, 0G logic
│ └── lib/0g/ # All 5 0G component implementations (Storage, Chain, Compute, KV, DA)
├── frontend/ # Next.js UI app, docs site, dashboard, checkout surfaces
├── contracts/ # CoalReceiptAnchor V2 Solidity contract + Foundry project
├── coal-mini-app/ # World App mini-app frontend (separate deploy)
├── packages/ # JS + React SDK surfaces
├── examples/ # Runnable integrations:
│ ├── coal-react-checkout/ # React checkout demo
│ ├── coal-agent/ # Live AI-agent demo (Claude → Coal merchants)
│ ├── coal-mcp-server/ # Multi-tenant MCP server
│ ├── coal-oracle-agent/ # x402 oracle paywall demo
│ ├── demo-store/ # Storefront with verified-payment download flow
│ └── agentkit-action/ # AgentKit action provider
├── scripts/ # Deploy + sync scripts
└── README.md # You are hereTwo separate Next.js apps are deployed from the same repo:
The repo also includes runnable integration examples under examples:
A full Next.js checkout demo built on @coal/react, including hosted checkout launch, success handling, receipt verification, and an agent-style simulation flow.
A Coal action provider for AgentKit with checkout, receipt verification, paywall, merchant-memory, and policy-evaluation actions.
A storefront-style example that creates Coal sessions, receives webhooks, and now verifies receipts against the 0G proof trail.
If you want the quickest demo path, start with coal-react-checkout and examples/coal-react-checkout/README.md.
Coal has three auth surfaces:
x-api-key with coal_live_* keysX-Coal-Agent-Key (wallet private key, used by pay_merchant / agent_wallet_status) and X-Coal-Api-Key (Coal API key, used by create_checkout / query_merchant_memory). The server holds no long-lived secrets.Legacy Better Auth has been retired from runtime use.
Coal settles to the configured Base settlement token.
USDC is the fallback defaultMNEE_* environment aliases remain only as compatibility helpers24+cd backend && npm install
cd ../frontend && npm install
cd ..cp backend/.env.example backend/.env
cp frontend/.env.example frontend/.envThen fill in the required values in:
Important backend values:
DATABASE_URLALCHEMY_API_KEY (optional — see RPC fallback note below)BASE_RPC_FALLBACK_URL (optional — second-tier RPC, e.g. Coinbase Developer Platform or QuickNode)PRIVY_APP_IDPRIVY_APP_SECRETNEXT_PUBLIC_FRONTEND_URLNEXT_PUBLIC_API_URLCRON_SECRETBase RPC fallback chain. Coal wraps the Base RPC in a viem fallback() transport so a single provider outage cannot stop payments. Priority order: ALCHEMY_API_KEY (if set) → BASE_RPC_FALLBACK_URL (if set) → https://mainnet.base.org (always). The local public node is the floor so the app boots even without an Alchemy key. See backend/lib/chain.ts.
Important frontend values:
NEXT_PUBLIC_API_URLNEXT_PUBLIC_PRIVY_APP_IDNEXT_PUBLIC_CHAIN_ENVNEXT_PUBLIC_COINBASE_BUNDLER_KEYcd backend
npx prisma db pushOpen two terminals:
# Terminal 1
cd backend
npm run dev# Terminal 2
cd frontend
npm run devDefault local URLs:
http://localhost:3000http://localhost:3001cd backend
npm run typecheck
npm test
npm run buildcd frontend
npm run typecheck
npm run buildcd backend
npm run 0g:storage:benchmark0G is opt-in. Coal still works without it.
For complete setup instructions for all 5 components (Storage, Chain, Compute, KV, DA), see the docs site at usecoal.xyz/docs.
Minimum environment variables to enable 0G:
# Storage + Chain
ZERO_G_ENABLED=true
ZERO_G_CHAIN_RPC_URL=https://evmrpc.0g.ai
ZERO_G_CHAIN_PRIVATE_KEY=0x...
ZERO_G_RECEIPT_ANCHOR_ADDRESS=0x24a80A3Bb16d26D4063Ecd4B2fD64C6856E25E8b
ZERO_G_STORAGE_INDEXER_URL=https://indexer-storage-turbo.0g.ai
ZERO_G_STORAGE_ENCRYPTION_KEY=<32-byte hex>
# Compute
ZERO_G_COMPUTE_ENABLED=true
ZERO_G_COMPUTE_PROVIDER=<provider_address>
ZERO_G_COMPUTE_BASE_URL=<provider_base_url>
ZERO_G_COMPUTE_API_KEY=<api_key>
ZERO_G_COMPUTE_MODEL=<model_name>
ZERO_G_SEALED_INFERENCE_ENABLED=true
# KV
ZERO_G_STORAGE_STREAM_ID=0x<64-hex-chars>
# DA (requires running a sidecar — see 0G-SETUP.md)
ZERO_G_DA_ENABLED=true
ZERO_G_DA_GRPC_URL=<sidecar_host>:51001
ZERO_G_DA_GRPC_TLS=falseThe main implementation lives in:
backend/lib/0g/storage.ts — Storage + KVbackend/lib/0g/chain.ts — Chain anchor writesbackend/lib/0g/compute.ts — AI inference + TEE attestationbackend/lib/0g/da.ts — DA event streaming via gRPCbackend/lib/0g/merchant.ts — merchant profile + memory publishingbackend/lib/receipts/proof.ts — receipt proof pipelinecontracts/0g-receipt-anchor/src/CoalReceiptAnchor.sol — V2 contract with DASigners precompile callCanonical package surfaces:
Coal ships a docs site and a live docs playground:
http://localhost:3000/docshttp://localhost:3001/api/docs/uiKey files:
Coal deploys as six Vercel projects from the same monorepo, each with its own rootDirectory:
| Vercel project | Domain | Root |
|---|---|---|
coal | www.usecoal.xyz | frontend/ |
coal-backend | api.usecoal.xyz | backend/ |
coal-agent | agent.usecoal.xyz | examples/coal-agent/ |
coal-mcp-server | mcp.usecoal.xyz | examples/coal-mcp-server/ |
coal-oracle-agent | oracle.usecoal.xyz | examples/coal-oracle-agent/ |
coal-demo-store | store.usecoal.xyz | examples/demo-store/ |
Helper scripts:
scripts/check-all.sh — backend + frontend typecheck + tests + build sweep.scripts/deploy.sh — local prebuild + push to Vercel for any subset of the six projects.main is the only branch on the public repo. Vercel production targets main.main (PRs merge there).Three co-founders, friends for years. Shipping consumer products, payments, and AI tools together.
| Role | Name | |
|---|---|---|
| Co-founder · Engineering | Emmanuel Haankwenda | linkedin.com/in/emmanuelhaankwenda |
| Co-founder · Engineering | Bernard Namangala | linkedin.com/in/bernard-namangala |
| Co-founder · Product & Design | Andre Haankwenda | linkedin.com/in/andrehaankwenda |
Coal went from zero to mainnet in six weeks. None of that happens without this team.
MIT — Copyright (c) 2026 Coal.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.