Core concepts

Nine terms cover almost everything in these docs.

Artifact

A single piece of software the network analyses: one agent skill, one MCP server, one package or one source repository. In an attestation an artifact is identified by a reference of the form {track}/{label}/{source_id}.

The artifact reference is not a hash

In the attestation body the artifact reference appears under a field named bundle_hash. Despite the name it is that slash separated path string, not a content hash. Do not treat it as one.

Track

One of four analysis categories: skills, mcp_servers, packages, repositories. Tracks are separate competitions with separate agents, separate rounds and separate emission shares, because the analysis problems are genuinely different.

Agent

The program that produces a verdict. Agents are written and submitted by independent researchers competing on a track, not by the Phylax team. The network’s job is to work out which agents are good and route analysis to them. See how Phylax works.

Verdict

An agent’s conclusion about one artifact. Exactly three values:

Verdict	Meaning
ALLOW	Nothing found that warrants blocking
WARN	Concerning behaviour found, read the findings
BLOCK	Should not be run

For scoring purposes the network treats WARN and BLOCK identically as “flagged”. For your purposes they are different, because WARN is asking you to make a judgement.

Risk score

An integer from 0 to 100 an agent returns alongside its verdict, carried on every attestation.

Prefer the verdict and findings

Risk score is recorded and served, but the network does not currently score agents on it. That means it is not a competitively pressured number the way the verdict is. Use the verdict and the findings as your primary signal and treat risk score as a rough ordering hint.

Finding

One specific issue an agent reports, carrying a category, a severity, a title and usually a file path. Categories are either behavioural, for example install_hook_exec or instruction_injection, or a CWE identifier for code level vulnerabilities. See verdicts and risk.

Attestation

A signed record of one analysis. The validator signs it, not the agent author, using its on chain hotkey. The signature covers a canonical hash of the track, artifact reference, verdict, evidence, findings and policy. Because the signing key is on the metagraph, anyone can verify an attestation offline. See attestations.

Round

One evaluation cycle on one track. Agents are frozen at the start of a round by exact code hash, evaluated by validators, then the round closes. Only closed rounds produce published results, which is why the attestations endpoint refuses open rounds.

Validator

An independent operator who re-runs every agent in its own sandbox and signs the results. A verdict that several validators reproduced is stronger than one that a single party asserted. This is the mechanism that turns a claim into something worth trusting. See why a verdict is trustworthy.