Limits and roadmap

Not audited, not on mainnet

• No security audit and no threat-model sign-off. Both block a launch.
• Test networks only. Production is not deployed: no mainnet secrets, no production database, no production domains.
• No payment privacy. Payer, payee, amounts and times are public on Cardano, and an enterprise address carries its whole history.

Known gaps in the security model

• The review comes from the API. The app does not decode the transaction on the device, so a compromised ZyroPay API could describe one payment and ask your passkey to sign another. On-device decoding is the fix. Not built
• The proof trusts the MCP worker’s measurement of the body your agent received.
• Registry identity is checked at quote time, not again at approval.
• Blockfrost is the only view of the chain for confirmations and escrow state.
• The Masumi admins (2 of 3) can settle a disputed escrow after the dispute time.
• Turnkey is the custody root of trust. ZyroPay verifies the signatures it returns, which detects a wrong signature, not a malicious one.

Not yet proven live Awaiting live run

Built and tested offline, waiting for a run on preprod:

• a refund (SetRefundRequested and WithdrawRefund signed with the passkey);
• a dishonest seller caught (mismatch, not_delivered);
• the sub-hire receipt chain with a live sub-payment;
• a paid Sokosumi task (the registration is live; the task waits on an interactive Sokosumi login);
• push notifications (staging has none; the app polls);
• the native iOS and Android apps on a device (the web app is live);
• wallet import against a real Turnkey org.

Not built Not built

• Autonomy on Cardano. Every Cardano payment needs the passkey. An on-chain allowance is the way to bound an agent there; it is not built. See Autonomous mode.
• x402 delivery on EVM and Solana. Payments are signed but not handed to the resource.
• Concurrent Cardano sends from one address. Without UTxO reservation the second one fails with inputs_spent; retry it.
• Pre-registered OAuth clients (needed if a client such as Grok wants a manually entered client id).
• The 2026-07-28 MCP transport. The server speaks the stateless 2025-11-25 transport, which overlaps; the upgrade path is documented in the MCP reference.

Measured, not optimized

Every live payment so far was in ADA; none used a Cardano native token.

• A direct x402 payment took about 160 s from request to CONFIRMED and the escrow lock about 130 s, most of it the human approval. The seller’s SubmitResult landed 21 s after the lock.
• Fees: 0.167349 ADA for a plain payment, 0.187589 ADA for an escrow lock (with the inline datum), 0.688128 ADA for the seller’s SubmitResult and 0.642366 ADA for its Withdraw (a 10 KB Plutus script inline in each). A reference script would make seller spends cheaper; not done.
• The seller’s Withdraw landed 39 s after unlockTime, inside one cron period.

Next

1. The pending live runs above, each added to Evidence with its hash.
2. On-device decoding of what you sign.
3. An on-chain allowance for bounded Cardano autonomy.
4. Audit, then production.