Three.Ws — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Three.Ws (Plugin) and scored it 45/100 (orange). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 4 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 5 flagged
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Website · X / Twitter · GitHub · $THREE on pump.fun
https://github.com/user-attachments/assets/d52515d1-cb04-4dd6-98bd-fef233312dc4
Give your AI a body. three.ws is an open-source, browser-native 3D AI agent platform. Type a prompt and Forge generates a textured 3D model — or drop a GLB you already have. Add an LLM brain, register on-chain, and embed anywhere — no plugins, no server uploads, no installs required.
Try it in 60 seconds: open three.ws/forge, type "a brass steampunk owl, full body", and download the GLB. Text→3D, image→3D, and sketch→3D — free draft tier, no account. Jump to the Forge section ↓
$THREE is the native token of the three.ws ecosystem — the one and only coin of the platform.
| Token | $THREE |
| Contract Address (CA) | FeMbDoX7R1Psc4GEcvJdsbNbZA3bfztcyDCatJVJpump |
| Network | Solana |
| Trade | pump.fun |
Always verify the contract address above before trading. $THREE is the only token associated with three.ws.three.ws is a full-stack system for creating, deploying, and embedding 3D AI agents. It combines a WebGL model viewer, an LLM-driven agent runtime, on-chain identity contracts, and a distributable web component into one cohesive platform.
At its core, it does five things:
<agent-3d> web component that anyone can drop into a page, or as one of five purpose-built widget types (turntable, animation gallery, talking agent, passport card, hotspot tour) with Open Graph and oEmbed support built in.The backend is a set of Vercel serverless functions backed by Neon Postgres for metadata, Cloudflare R2 for model storage, and Upstash Redis for rate limiting. It exposes a full OAuth 2.1 authorization server and an MCP (Model Context Protocol) endpoint so external AI systems can drive avatars programmatically.
three.ws is production-ready and serves three.ws live. The entire stack — viewer, agent runtime, contracts, backend, and web component — is open source under Apache 2.0.
One day, creating your agent should be as simple as taking a selfie.
Point your camera at yourself — or anyone — and watch a fully realized 3D avatar emerge: your face, your voice, your personality, alive in the browser. That avatar becomes an agent with memory and skills, registered onchain — as an ERC-8004 token on EVM or a Metaplex Core asset on Solana — permanent and verifiable by anyone forever. No 3D software. No wallet setup. No uploads. Just a photo and a name.
This is the direction three.ws is heading: photo → avatar → agent → onchain identity, in a single flow. The infrastructure is already here — the viewer, the runtime, the contracts, the embedding layer. What comes next is closing the gap between a picture of a person and a living, ownable, embeddable piece of them that exists on the internet permanently.
three.ws ships in four phases. Each phase closes a specific gap between the current platform and the end-state vision: anyone can mint a 3D agent of themselves, own it onchain, and embed it anywhere on the internet.
| Phase | Theme | Status |
|---|---|---|
| 0 | Platform foundations (viewer, runtime, ERC-8004 + Metaplex Core identity, embed layer) | ✅ Shipped |
| 1 | Selfie → Avatar engine (3-photo capture, hosted inference) | 🟡 In progress — capture UX + quality gates shipped; GPU reconstruction backend wiring |
| 2 | Agent personalization + voice cloning | 🟡 In progress — voice clone, persona, memory seeds shipped behind /demos; main-flow integration next |
| 3 | Onchain economy (agent tokens, reputation markets, royalties) | 🟡 Scaffolding — bonding-curve sim, EAS-reputation viewer, 0xsplits + EAS SDKs landed; contracts + audits next |
| 4 | Open inference network (decentralized GPU layer) | 🔮 Future — livepeer dep landed for early experimentation |
The full stack is live at three.ws: WebGL viewer, LLM agent runtime, ERC-8004 identity contracts (EVM) and Metaplex Core mints (Solana), OAuth 2.1 server, MCP endpoint, and the <agent-3d> web component. Anyone can register an agent today — but the avatar still has to come from a 3D artist or a third-party tool.
What works: model upload, agent runtime, onchain registration, embedding, signed action history, reputation scores. What doesn't: there is no automated path from a real human face to a usable 3D avatar.
Goal: any user takes 3 selfies (left, center, right) and receives a rigged, animatable 3D avatar in under 60 seconds.
Deliverables
Compute requirements
Verification: 1,000 test users complete capture and mint an onchain agent of themselves end-to-end with ≥4/5 likeness score.
Goal: the avatar isn't just _you_ — the agent _acts_ like you.
Deliverables
Verification: users return to converse with their own agent; ≥30% week-2 retention on minted agents.
Goal: agents are real economic objects on EVM and Solana, not just collectibles.
Deliverables
ReputationRegistry.sol)Funding requirements
Verification: ≥1,000 agents minted with active onchain reputation; ≥$X in cumulative skill royalties paid out.
Goal: decouple agent inference from any single provider. Anyone can run a node; agents pay nodes onchain for compute.
Deliverables
Compute requirements
Verification: ≥50% of production agent traffic served by independent node operators; latency parity with centralized inference.
| Resource | Used for | Phase |
|---|---|---|
| Inference GPUs | Avatar generation, agent conversations | 1, 2 |
| Training compute | Fine-tuned face-fitter, voice models | 1, 2 |
| Smart contract audits | Reputation, royalty, delegation contracts | 3 |
| Token launch liquidity | Agent token markets | 3 |
| Indexer infrastructure | Multi-chain crawl + reputation aggregation | 3 |
| Node operator credits | Bootstrap the open inference network | 4 |
| Engineering headcount | Capture pipeline, contracts, indexer, ops | 1–4 |
Phases 1 and 2 unblock the consumer story — _anyone gets an agent of themselves_. Phases 3 and 4 unblock the onchain story — _those agents are real economic actors that don't depend on any one company to keep running_. Both are required for the vision; neither is funded yet.
If you want to support the project — compute credits, grants, partnerships, or contributions — open an issue or reach out via three.ws.
Text → 3D Generation (Forge)
3D Viewer
Agent Runtime
wave, lookAt, play_clip, setExpression, speak, rememberx402 Payments & Bazaar
/api/x402/pay-by-name resolves @username, *.sol (incl. subdomains), or raw base58 to a recipient and builds an unsigned USDC transfer for the payer's wallet. Every 402 manifest emitted by a named agent advertises recipient_name next to the wallet, so payers verify a human-readable name before signing/dashboard/x402; receipts ledger with admin tooling*SNS / `.threews.sol` subdomains**
/threews/claim lets any signed-in user mint [username].threews.sol in a single atomic Solana transaction — createSubdomain → URL record → transferSubdomain to the user's wallet, with three.ws absorbing gas/u/[username] showcase via the SNS URL record.sol name (theirs or a fresh registration) via /api/agents/:id/sns; once bound, every public surface — agent page, x402 manifest, MCP listing, marketplace card — displays the name in place of the raw walletA2A — Agent-to-Agent Protocol
Identity & On-Chain
agentId, owner wallet, delegated signer (EIP-712), and IPFS-pinned manifestspeak, remember, skill-done, and validate event is recorded on-chain-optionally or in the database with a cryptographic signatureEmbedding & Distribution
<agent-3d> custom element — drop it anywhere with no framework dependency/embed-editor — pick an avatar, animation, framing, and background, copy the snippet/launchpad — hosted public launch pages at /p/[slug] for tokens, agents, and drops/agent-3d/x.y.z/agent-3d.jsSocial & Multiplayer 3D
/communities + /play — every Solana token gets a live 3D world; pick the same coin and land together, with peer avatars, chat, emotes, voxel building, and a live market-cap screen/city — free-roam walkable 3D city scene/club — multiplayer venue with rigged dancers, audio tracks, tips, leaderboard, payouts cron, perf-aware renderer that auto-downgrades on slow frames/walk — authoritative multiplayer walk scene backed by a Colyseus server in multiplayer/ (deployable on Fly.io)/pose-studio, Voice Lab at /voice, Mocap Studio at /mocap-studio — author poses, bind voices, and capture/retarget motion into reusable clipsBackend & Integrations
/admin/news with multi-destination syndication (WebSub, Dev.to, Medium, HackerNoon, CMC handoff)/openapi.jsonType a sentence, get a 3D model. Forge turns a text prompt, one to four photos, or a rough sketch into a textured, downloadable GLB — in the browser, with a free draft tier and no account required.
| Input | How it works | Typical time |
|---|---|---|
| Text | Describe the object — "a brass steampunk owl, full body" | ~30–90 s |
| Image | Upload 1–4 reference views (front/back/left/right); multi-view removes back-of-object hallucination | ~30–90 s |
| Sketch | Draw it and name it — TripoSG-scribble reconstructs the geometry | ~30–90 s |
Three quality tiers — draft (~12k polygons), standard (~30k, default), high (~200k + PBR textures) — and two generation paths: the platform-keyed image pipeline (FLUX → TRELLIS) that works with no key at all, and bring-your-own-key native geometry via Meshy or Tripo for the cleanest quad topology (your key stays in your browser).
Forge is not a dead end. Every generated model carries straight into the rest of the platform: open it in Scene Studio, auto-rig it into an animatable character, restyle it (voxel / brick / voronoi / low-poly), retexture it from a prompt, embed it with <agent-3d>, give it an LLM brain, or deploy it on-chain. Prompt-to-avatar lives at three.ws/create/prompt — a description becomes a rigged, animatable agent body.
The same engine is one HTTP call, free and auth-free:
# Submit a text→3D job
curl -X POST https://three.ws/api/forge \
-H 'content-type: application/json' \
-d '{"prompt": "a brass steampunk owl, full body", "tier": "standard"}'
# → { "job_id": "…", … }
# Poll until done
curl 'https://three.ws/api/forge?job=<job_id>'
# → { "status": "done", "glb_url": "https://…/model.glb", … }Image→3D is the same endpoint with image_urls: ["https://…/front.png", …] (1–4 views) instead of a prompt. GET /api/forge?catalog returns the live tier/backend/cost matrix.
The 3D Studio MCP server at https://three.ws/api/mcp-3d exposes the full pipeline as 15 tools — text_to_3d, image_to_3d, auto_rig_model, apply_animation, stylize_model, retexture_model, segment_model, and more — so an AI assistant can generate, rig, and animate a model mid-conversation and render it as an inline interactive artifact. See docs/mcp-3d-studio.md.
POST /api/x402/forge is the monetized twin: agents pay per generation in USDC on Base or Solana — no API key, no account. Draft $0.05, standard $0.15, high $0.50; polling is free; retried payments are idempotent and never double-charge. See docs/api/forge-x402.md.
A map of every user-facing route. Full detail (source files, feature descriptions, hash-routes) is in docs/internal/PAGES.md.
| Section | Key URLs | What it does |
|---|---|---|
| Landing | /, /features, /discover | Marketing, public agent directory |
| Forge (Text→3D) | /forge, /create/prompt | Prompt / photo / sketch → textured GLB; prompt → rigged, animatable avatar |
| App / Core | /app, /create, /first-meet | 3D viewer, agent creation wizard, onboarding |
| Marketplace | /marketplace, /marketplace/agents/[id] | Browsable agent marketplace |
| Chat SPA | /chat | Full Svelte AI chat with model selector, tools, artifacts, wallet |
| Chat — Marketing | /chat#solutions/*, /chat#business/* | Per-team and enterprise landing pages |
| Chat — Features | /chat#features/* | Feature detail pages (web-app, mobile-app, ai-design, ai-slides, browser-operator, wide-research, mail, skills) |
| Chat — Resources | /chat#resources/* | Blog, docs, trust center, updates, use cases |
| Auth | /login, /register, /forgot-password, /reset-password | Email + wallet sign-in/up |
| Agent (Platform) | /agent/[id], /agent/[id]/embed, /agent/[id]/edit | Agent chat, chromeless embed, manifest editor |
| Agent (On-Chain) | /a/[chain]/[id], /a/sol/[asset] | ERC-8004 and Metaplex Core passports |
| Profile | /profile, /u/[username], /avatars/[id] | User and avatar public pages — SNS badge + pay-by-name modal when [username].threews.sol is claimed |
| SNS Subdomain | /threews/claim | Mint [label].threews.sol, set the URL record to your showcase, transfer ownership — single tx, platform pays |
| Dashboard | /dashboard, /dashboard/actions, /dashboard/wallets, /dashboard/usage, /dashboard/x402 | Account management, settings, and x402 receipts/payouts |
| Studio / Tools | /studio, /embed-editor, /pose-studio, /voice, /mocap-studio, /hydrate, /validation, /strategy-lab | Widget Studio, WYSIWYG embed editor, pose authoring, Voice Lab, Mocap Studio, on-chain import, glTF validator, DCA |
| Widgets | /widgets, /w/[id] | Widget gallery and public widget pages (OG + oEmbed) |
| Launchpad | /launchpad, /p/[slug] | Launchpad Studio + hosted launch pages (token, agent, drop campaigns) |
| Club | /club | Multiplayer 3D venue — tips, leaderboard, audio tracks, perf-aware renderer |
| Walk | /walk | Authoritative multiplayer walk scene (Colyseus on Fly.io) |
| Coin Communities | /communities, /communities/[mint], /worlds, /play | Live 3D world per Solana token — lobby, coin profile, and the shared coin-keyed world |
| City | /city | Free-roam walkable 3D city scene |
| Bazaar (x402) | /x402, /x402-discover, /x402-pay | Paid-API marketplace, discovery, Stripe-style checkout |
| Artifacts | /artifact, /artifact/snippet, /artifact-example | Claude Artifact viewer |
| Solana / DeFi | /pumpfun, /pump-visualizer, /vanity-wallet | pump.fun launcher, live token visualizer, WASM vanity grinder |
| Mobile (Seeker) | Solana Mobile dApp Store | MWA wallet wired into the web app + Seeker release pipeline |
| News / Blog | /news, /admin/news | News feed + local-only CMS, syndicated via WebSub / Dev.to / Medium / HackerNoon |
| Admin / Rep | /admin, /reputation | Staff admin, reputation registry |
| Experiments | /rider | A-Frame WebVR music visualization |
| Integrations | /cz, /lobehub/iframe | CZ demo, LobeHub plugin |
| IBM Showcase | /ibm, /ibm/galaxy, /ibm/oracle, /ibm/twin, /ibm/trust-layer, /ibm/proof, /ibm/vision | Granite on watsonx.ai — semantic galaxy, TimeSeries oracle, digital twin, Guardian trust layer, on-chain proof, vision |
| Docs | /docs, /docs/widgets | Developer documentation |
| Legal | /legal/privacy, /legal/tos | Privacy policy and terms |
three.ws is available on major cloud marketplaces and open to infrastructure partnerships.
| Cloud | Status |
|---|---|
| AWS | AWS Partner (APN Software Path). AWS Marketplace SaaS listing in review — see docs/aws-marketplace.md and the public partner page at three.ws/aws. Production runs on AWS us-east-1, registered in AWS MyApplications under account 155407237916. |
| Alibaba Cloud | Live: product listing → · storefront → |
| Google Cloud | three.ws runs on WebGL, Vercel edge, EVM (15+ chains), and Solana (Metaplex Core) — a natural fit for GCP's AI infrastructure, Vertex AI, and global CDN. Open to co-listing, credits, and joint GTM. |
three.ws is indexed in chain-ecosystem dApp directories so the community can discover, vet, and rank it.
| Directory | Status |
|---|---|
| BNB Chain · Dappbay | Live: dappbay.bnbchain.org/detail/three → — categories: AI Agent Launchpad · AI Data · AI Infra |
three.ws is an IBM Business Partner, and the agent runtime runs on IBM Granite foundation models served through IBM watsonx.ai. One IBM Cloud API key + project unlocks the whole suite; every call is real inference (no mock path — endpoints return 503 when unconfigured). Full docs: [docs/ibm.md](docs/ibm.md). Live showcase: [three.ws/ibm/galaxy](https://three.ws/ibm/galaxy).
The public showcase is not the partnership. The demos under /ibm/* are independent tools three.ws built for developers to explore Granite on watsonx.ai and build their own integrations — they are not official IBM partnership deliverables, not IBM products, and not endorsed by IBM. Our formal partnership work with IBM is being built on the IBM platform and is not yet public.| Granite model | Where it runs |
|---|---|
granite-3-8b-instruct | Selectable avatar brain + all narration |
granite-guardian-3-8b | Trust Layer — allow/review/block governance gate, inline in /api/chat before an avatar moves value |
granite-ttm-512/1024/1536-96-r2 | TimeSeries forecasting (Oracle, Twin, Proof) |
granite-embedding-278m-multilingual | Semantic agent map + /api/watsonx/embed |
granite-vision-3-2-2b | Vision — reads an avatar into a full agent identity |
Six showcase surfaces put it on screen, cross-linked by an in-page suite switcher: the Agent Galaxy (semantic 3D star-map), the Granite Oracle (narrated forecast), the Digital Twin (back-test + what-if), the Trust Layer (Guardian + hash-chained audit ledger), Granite Proof (a Guardian-governed forecast notarized on Solana), and Granite Vision. The standalone connector @three-ws/ibm-watsonx-mcp exposes watsonx.ai to any MCP host — it is community-built and not an IBM product; the hosted platform integration is what runs on IBM watsonx.ai.
The world's first x402-enabled MCP server on IBM Cloud: @three-ws/ibm-x402-mcp turns IBM Granite into a metered utility any AI agent can call. The operator holds the IBM credentials and funds inference; the caller pays a few cents of USDC per call — no IBM Cloud account, no subscription, no API-key signup. Full guide: [docs/ibm-x402-mcp.md](docs/ibm-x402-mcp.md).
| Tool | What it does | Price |
|---|---|---|
ibm_granite_chat | Conversational AI — Q&A, drafting, reasoning | $0.02 |
ibm_granite_code | Generate / review / refactor / explain / test / document code | $0.025 |
ibm_granite_embed | Batch text embeddings (1–64) for RAG, search, clustering | $0.005 |
ibm_granite_analyze | Structured doc analysis — entities, sentiment, risk, next steps | $0.04 |
ibm_granite_forecast | Zero-shot time-series forecasting via Granite TTM | $0.05 |
The same five tools ship over two transports: stdio (npx @three-ws/ibm-x402-mcp, for Claude Desktop / Code / Cursor, paid on Solana) and Streamable HTTP (https://three.ws/api/ibm-mcp, for hosted clients and watsonx Orchestrate, paid on Base or Solana). An unpaid tools/call returns a 402 quoting the exact USDC price; x402-capable clients pay and retry automatically, settling on-chain only after the tool succeeds. Independent project integrating IBM Granite via watsonx.ai — not an IBM product.
| Viewer | Widget Studio |
|---|---|
| Viewer | Widget Studio |
| Agent Discovery | Avatar Creation |
|---|---|
| Discover | Create |
The platform is organized into four layers. All layers communicate through a single event bus (agent-protocol) rather than direct calls.
┌────────────────────────────────────────────────────────────┐
│ Layer 4: Embed & Distribution │
│ <agent-3d> web component · CDN library · 5 widget types │
│ Widget Studio · oEmbed · Open Graph cards │
└────────────────────────────────────────────────────────────┘
↓ protocol events
┌────────────────────────────────────────────────────────────┐
│ Layer 3: Identity & Persistence │
│ Agent passport · ERC-8004 (EVM) + Metaplex Core (Solana) │
│ Signed action log · Memory store · Cross-chain SIWX │
└────────────────────────────────────────────────────────────┘
↓ protocol events
┌────────────────────────────────────────────────────────────┐
│ Layer 2: Agent Runtime │
│ LLM tool-loop · Built-in tools · Skill registry │
│ Empathy Layer (emotion blending) · TTS/STT │
└────────────────────────────────────────────────────────────┘
↓ protocol events
┌────────────────────────────────────────────────────────────┐
│ Layer 1: Viewer │
│ three.js r184 · glTF / GLB · Draco / KTX2 / Meshopt │
│ Animations · Morph targets · HDR · Validation │
└────────────────────────────────────────────────────────────┘The event bus decouples every component. The avatar emotion system reacts to speak events without knowing the runtime exists. The identity module records actions without knowing the UI exists. This makes the system testable, embeddable in isolation, and composable across pages.
The backend is stateless serverless functions. All persistent state lives in Postgres (Neon), object storage (Cloudflare R2), or on-chain. Cron jobs handle scheduled blockchain operations (ERC-8004 crawl, DCA execution, subscription execution).
The architecture above is the bird's-eye view; each load-bearing surface has a dedicated spec that defines its wire format, invariants, and extension points. New contributors should skim the spec for any subsystem they're about to change.
| Spec | What it covers |
|---|---|
| specs/AGENT_MANIFEST.md | Agent manifest JSON schema — body, brain, voice, memory, skills, signing. The contract every <agent-3d> reads. |
| specs/3D_AGENT_CARD.md | The on-chain passport card layout — fields, signing, and rendering rules. |
| specs/SKILL_SPEC.md | Skill bundle layout (SKILL.md, tools.json, handlers.js), trust modes, and distribution. |
| specs/PERMISSIONS_SPEC.md | EIP-7710 delegated permissions model — capability scopes, redemption, revocation. |
| specs/MEMORY_SPEC.md | Memory file format, types, salience model, and storage modes. |
| specs/STAGE_SPEC.md | Scene/stage configuration: camera presets, lighting, environment maps, hotspots. |
| specs/EDITOR_SPEC.md | Widget Studio + Embed Editor configuration surface and persistence shape. |
| specs/EMBED_SPEC.md | The <agent-3d> element and chromeless iframe — attributes, JS API, and lifecycle. |
| specs/EMBED_HOST_PROTOCOL.md | postMessage wire protocol between the iframe and its host page (origin lock, message kinds, RTT). |
| specs/CLAUDE_ARTIFACT.md | Claude Artifact viewer integration — snippet loading and sandbox boundaries. |
| specs/ENS_AGENT_CLAIM.md | ENS-based agent claim flow for verifiable owner ↔ agent binding. |
| specs/VALIDATORS.md | Validator attestation rules — what gets signed, who can sign, how to read attestations. |
| specs/SECURITY.md | Threat model, trust boundaries, and the hardening checklist for production deployments. |
Longer-form architecture and how-to documentation lives under docs/: docs/architecture.md, docs/agent-system.md, docs/3d-asset-pipeline.md, docs/animations.md, docs/web-component.md, docs/api-reference.md, docs/mcp.md, docs/permissions.md, docs/security.md, docs/smart-contracts.md, and more.
Every avatar the site renders is a GLB (binary glTF 2.0 — the body, rig, and textures in one file); every shared gesture and dance is a format-light clip JSON (a serialized THREE.AnimationClip — motion only, retargeted onto any rig at runtime); and both originate as FBX source from Mixamo or a DCC tool. Two conversions come off one FBX — npm run convert:fbx for a full character GLB, npm run build:animations for a reusable library clip — then npm run optimize:glb makes it web-ready (~90% smaller). The full explainer, format specs, runtime modules, and the generate→rig→animate→export capability chain are in [docs/3d-asset-pipeline.md](docs/3d-asset-pipeline.md).
Frontend
chat/ directory.Backend (Vercel Serverless)
Smart Contracts
The viewer targets every browser that ships WebGL 2.0 on a desktop or modern mobile device. Concrete support matrix:
| Browser | Minimum | Notes |
|---|---|---|
| Chrome / Edge (Chromium) | 113+ | Full feature set including WebGPU experiments behind a flag. Recommended for development. |
| Safari (macOS / iOS) | 16.4+ | WebGL 2.0, Web Speech recognition (iOS 16.4 added support behind a permission prompt). Voice input requires HTTPS. |
| Firefox | 115+ | KTX2 / Meshopt decoders all supported. Web Speech recognition is feature-gated by user-locale. |
| Mobile Safari | iOS 16.4+ | Touch controls and gyroscope mapped through OrbitControls. |
| Android Chrome | 113+ | Full feature set; AR button surfaces a Scene Viewer intent when present. |
Capabilities and graceful degradation
public/three/draco/, public/three/basis/, and node_modules/three/examples/jsm/libs/."engines.node": "24.x" in package.json; earlier majors are not tested) git clone https://github.com/nirholas/three.ws.git
cd three.ws npm installCopy the .env.example file to .env.local and fill in the required values. See the Environment Variables section for more details.
cp .env.example .env.localThe schema is idempotent. Run it against your Postgres instance to create all tables:
psql $DATABASE_URL < api/_lib/schema.sql npm run devThe application will be available at http://localhost:3000.
Copy-paste ready snippets for the most common use cases. Swap in your own GLB URL and go.
The simplest possible setup — one script tag, one element, zero build step.
<!doctype html>
<html lang="en">
<head>
<meta charset="utf-8" />
<title>3D Viewer</title>
<style>
body {
margin: 0;
background: #0a0a0a;
display: flex;
align-items: center;
justify-content: center;
height: 100vh;
}
agent-3d {
width: 400px;
height: 560px;
display: block;
}
</style>
</head>
<body>
<script type="module" src="https://three.ws/agent-3d/1.5.2/agent-3d.js"></script>
<agent-3d body="https://cdn.three.ws/models/sample-avatar.glb"></agent-3d>
</body>
</html>Drag-to-rotate, scroll-to-zoom, full PBR rendering — no API key, no account required. Swap body= for any publicly accessible .glb URL.
Add brain= and instructions= to turn the viewer into a conversational agent.
<script type="module" src="https://three.ws/agent-3d/1.5.2/agent-3d.js"></script>
<agent-3d
body="https://cdn.three.ws/models/sample-avatar.glb"
brain="claude-sonnet-4-6"
name="Aria"
instructions="You are Aria, a friendly AI guide. Be warm, concise, and occasionally playful.
When someone greets you, wave at them. Keep replies to 2–3 sentences."
mode="inline"
width="400px"
height="560px"
></agent-3d>The chat input and mic button appear automatically when brain is set. No UI to build.
Pin the agent to a corner of the page so it persists as users scroll.
<script type="module" src="https://three.ws/agent-3d/1.5.2/agent-3d.js"></script>
<agent-3d
body="https://cdn.three.ws/models/sample-avatar.glb"
brain="claude-sonnet-4-6"
instructions="You are a helpful product assistant. Answer questions about our features."
mode="floating"
position="bottom-right"
width="320px"
height="420px"
></agent-3d>position accepts bottom-right, bottom-left, top-right, or top-left.
If you've registered an agent on the platform, load it entirely from its manifest — no inline attributes needed.
<!-- By platform agent ID -->
<agent-3d agent-id="a_abc123def456"></agent-3d>
<!-- By on-chain ERC-8004 ID -->
<agent-3d agent-id="42" chain-id="8453"></agent-3d>The element fetches the manifest (model URL, instructions, skills, memory config) automatically.
Hide the built-in chrome and wire in your own input using the element's JS API.
<script type="module" src="https://three.ws/agent-3d/1.5.2/agent-3d.js"></script>
<agent-3d
id="agent"
body="./avatar.glb"
brain="claude-sonnet-4-6"
kiosk
style="width:400px;height:560px;display:block"
></agent-3d>
<input id="msg" type="text" placeholder="Ask something…" />
<button onclick="send()">Send</button>
<script>
const agent = document.getElementById('agent');
const input = document.getElementById('msg');
async function send() {
const text = input.value.trim();
if (!text) return;
input.value = '';
await agent.say(text);
}
input.addEventListener('keydown', (e) => {
if (e.key === 'Enter') send();
});
// Auto-greet on load
agent.addEventListener('agent:ready', () => {
setTimeout(() => agent.say('Hello! How can I help you today?'), 1200);
});
// Listen to replies
agent.addEventListener('brain:message', (e) => {
if (e.detail.role === 'assistant') console.log('Agent:', e.detail.content);
});
</script>Full JS API:
| Method | Description |
|---|---|
agent.say(text) | Send a message; agent speaks and animates the reply |
agent.ask(text) | Same as say(), returns reply text as a string |
agent.wave() | Trigger the wave gesture directly |
agent.lookAt(target) | 'camera', 'model', or 'user' |
agent.play(clipName) | Play a named animation clip |
agent.clearConversation() | Reset conversation history |
agent.expressEmotion(trigger, weight) | Manually inject an emotion blend |
Key events: agent:ready, brain:message, brain:thinking, skill:tool-called, voice:transcript
Use a widget URL directly — no script tag needed.
<iframe
src="https://three.ws/a/8453/42/embed"
width="400"
height="560"
frameborder="0"
allow="microphone"
style="border-radius:16px;"
></iframe>Generate the src URL from Widget Studio — pick an avatar, choose a widget type, and copy the snippet.
For anything beyond a quick one-liner, define the agent in a manifest file and reference it with manifest=.
agent.json:
{
"spec": "agent-manifest/0.2",
"name": "Aria",
"description": "A friendly AI guide",
"body": {
"uri": "./avatar.glb",
"format": "gltf-binary"
},
"brain": {
"provider": "anthropic",
"model": "claude-sonnet-4-6",
"instructions": "You are Aria, a warm and curious AI guide. Wave when greeted.",
"temperature": 0.8,
"maxTokens": 1024
},
"voice": {
"tts": { "provider": "browser", "rate": 1.05 },
"stt": { "provider": "browser", "language": "en-US" }
},
"memory": { "mode": "local" },
"skills": [{ "uri": "https://cdn.three.ws/skills/wave/" }]
}<agent-3d manifest="./agent.json" width="400px" height="560px"></agent-3d>For the absolute simplest way to embed an agent, use this snippet. It requires no build tools or imports. Just copy and paste it into your HTML.
<div
class="threews-widget"
data-agent-id="YOUR_AGENT_ID"
data-background="transparent"
data-nameplate="true"
style="width: 400px; height: 500px;"
></div>
<script src="https://three.ws/dist/widget.js" defer></script>You can find your agent ID in the agent's settings page. This method is great for quick integrations on platforms like WordPress, Ghost, or any static HTML site. Customize the appearance with data-background and data-nameplate.
Step-by-step guides in docs/tutorials/:
| Tutorial | What you'll build | Time |
|---|---|---|
| Turn a Text Prompt into a 3D Model | A real, textured, downloadable 3D model from a one-line description | ~5 min |
| Turn Photos into a 3D Model | A GLB reconstructed from 1–4 photos of a real object | ~10 min |
| Build Your First Agent | A talking 3D character on a shareable page, from zero | ~20 min |
| Embed on Your Website | Add an agent to any page — plain HTML, React, Webflow, WordPress | ~15 min |
| Write a Custom Skill | A new tool the agent can call (e.g., fetch live weather data) | ~30 min |
| Register On-Chain | Mint your agent onchain — ERC-8004 on EVM or Metaplex Core on Solana | ~20 min |
| Build a Personal AI Site | A full personal site with an embedded AI version of yourself | ~45 min |
CORS — if your GLB is hosted on a different domain, the server must send Access-Control-Allow-Origin: *. Without it the fetch is blocked and the canvas stays blank. Uploading via the platform's storage sets this automatically.
File size — models over ~50 MB load slowly. Compress with Draco:
npx gltf-transform draco input.glb output.glbVoice on HTTPS — getUserMedia (microphone) requires HTTPS. Localhost is exempt; any remote deployment needs TLS. Vercel and Netlify both provide it automatically.
CSP — if your page has a strict Content Security Policy, add:
script-src 'self' https://three.ws;For sandboxed iframes use the widget embed path instead — it runs in its own browsing context.
src/: The core frontend JavaScript for the main application, including the 3D viewer, agent protocol, custom element, and feature modules (club-*.js, walk*.js, pose-*.js, voice/, selfie-*.js). Social/gameplay surfaces live in game/ (Coin Communities: coincommunities*, spin-wheel-ui, cosmetics-visual, avatar-rig), city/ (the /city world), social/ (sentiment, X-post impact), community/ (coin lobby/town), plus friends.js, communities.js, marketplace*.js, and token-pay.js.api/: Vercel serverless functions that form the backend API. Subdirectories include x402/, a2a/, club/, pump/, persona/, news/, admin/, agents/, auth/, oauth/, cron/, plus the social/game surfaces play/, token/, three-token/, friends/, social/, community/, marketplace/, and mocap/.public/: Static assets and various sub-applications (club/, seeker/, news/, persona/, vanity-wallet.html, pumpfun.html).chat/: A standalone Svelte application for the chat interface.character-studio/: A sub-project for in-browser character creation; also serves the rebranded Avatar Studio marketplace.rider/: A-Frame WebVR music visualization experiment.contracts/: Solidity smart contracts for on-chain identity (ERC-8004) and the multichain payment factory.multiplayer/: Colyseus WebSocket server for /walk and /play (WalkRoom); deployable on Fly.io. Holds the authoritative world logic and single sources of truth — items.js, playerStore.js, game-token.js, play-pass.js, holder-pass.js, and the per-account social-hub.js.sdk/: @three-ws/sdk (the AgentKit SDK; the legacy avatar helpers live in sdk/agent-sdk/).agent-payments-sdk/: EVM agent payments SDK (Base / BSC / other EVM chains).solana-agent-sdk/: SDK for Solana blockchain interactions (Metaplex Core mints, SIWS, attestations).pump-fun-skills/: Skills related to the pump.fun integration.scripts/: Node.js scripts for development, build, deployment, and pump.fun launch automation.workers/: Code for background workers — includes the Cloudflare Worker mirror of the pump.fun MCP read API in workers/pump-fun-mcp/.docs/: Public-facing developer docs.docs/internal/: Working docs (PLAN, STATUS, TODO, NEXT, PROGRESS, RELEASE_CHECKLIST, club venue notes) — not part of the published docs surface.tests/: Vitest unit tests (tests/api/, tests/src/, tests/workers/) and Playwright end-to-end smokes (tests/e2e/).src/agent-protocol.js implements a lightweight EventTarget subclass that is the nervous system of the platform. Every component — avatar, runtime, identity, UI — communicates exclusively through this bus. There are no direct method calls between layers.
The bus maintains a 200-action ring buffer for debugging and replay. Embed variants expose a filtered subset of events through postMessage to the host page.
Core event types:
| Event | Payload | Who emits | Who listens | ||
|---|---|---|---|---|---|
speak | { text, sentiment: -1..1 } | runtime, skills | avatar (emotion), identity (log), chat UI | ||
think | { thought } | runtime | home (timeline), avatar | ||
gesture | { name, duration } | avatar, skills | avatar (one-shot clip) | ||
emote | { trigger, weight: 0..1 } | avatar | avatar (emotion inject) | ||
look-at | `{ target: 'user'\ | 'camera'\ | 'center' }` | skills | scene controller |
perform-skill | { skill, args, animationHint } | runtime | skill registry | ||
skill-done | { skill, result } | skills | avatar, identity | ||
skill-error | { skill, error } | skills | avatar, identity | ||
remember | { type, content, ... } | skills, runtime | memory, identity | ||
load-start / load-end | { uri, error? } | viewer | avatar (emotion) | ||
validate | { errors, warnings } | validator | avatar, identity | ||
presence | { state } | element | home UI |
Identity-relevant events (speak, remember, sign, skill-done, validate, load-end) are fire-and-forwarded to POST /api/agent-actions for durable logging.
src/runtime/index.js implements the Runtime class, which drives the agent's LLM-powered brain.
Tool-loop flow:
{
viewer,
memory,
llm,
speak,
listen,
fetch,
loadGLB,
loadClip,
loadJSON,
call,
stage,
agentId;
}tool_result messagesProviders (src/runtime/providers.js):
AnthropicProvider — connects to the Anthropic API, supports streamingNullProvider — no-op fo~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.