Security & Trust · Autonomous Intelligence

01 · Custody model

Non-custodial, end to end

A swap on Autonomous Intelligence is built by the server, signed by you, and broadcast only after you sign. There is no deposit account, no custodial wallet, and no balance the platform can move on your behalf.

No fund custody. The DEX never holds user assets. You connect your own wallet and approve each swap individually.
Server builds, you sign. build_swap returns an unsigned transaction and a build_id. Your wallet signs it locally; only then does submit_swap broadcast it.
Your key never leaves your environment. The API key authorises the request; it is not a wallet key and cannot move funds. Wallet signing happens in your wallet, not on our servers.
No "deposit to trade." If any interface claiming to be us asks you to deposit funds into its custody, it is not Autonomous Intelligence. Report it.

What this means in practice

If our infrastructure were fully compromised tomorrow, your funds would still be in your wallet. We cannot move them, because we never had them.

02 · Access & keys

API keys are scoped, not custodial

Access to the agent rail is controlled by an API key you create. Read-only tools (quote, safety, discovery, token info) work without a key; key-gated tools (build_swap, submit_swap) require it.

Read tools are open

Quote, rug-check, gem discovery and token info need no key — anyone can verify a token before buying.

Key = authorise, not custody

The API key authorises a swap build/broadcast. It is not a wallet key and cannot sign or move funds.

Per-request authentication

Each request authenticates as the caller; there is no shared operator key that can act on your behalf.

Rotate any time

Create and revoke keys from your account. Compromise of a key does not compromise your wallet.

03 · Fees, transparently

One disclosed fee, no hidden routing

The DEX applies a transparent platform fee that is baked into the quote and the unsigned transaction — you see it before you sign, in the same number you approve. There is no second hidden spread taken after the fact.

The fee is disclosed in every quote response, before you ever sign.
Best-price routing runs across available liquidity to reduce slippage; the fee is separate from routing.
A swap does not make a token safe. Always read the safety check before buying any new token.

04 · Token safety

Rug-gating before you buy

Every token can be rug-checked before purchase: honeypot detection, mint and freeze authority, liquidity lock status, and holder concentration. This is a safety read, not a guarantee.

A safety check flags known risk patterns. It cannot predict a new exploit, a delayed rug, or a team that abandons a token. Treat it as one signal, not as a green light. Always do your own research and verify the contract yourself.

05 · Responsible disclosure

Found a vulnerability?

If you believe you have found a security issue in Autonomous Intelligence — the DEX, the agent rail, the MCP server, or any hosted surface — please report it responsibly. Do not publish the issue publicly until we have had a chance to respond.

Report to

Email hello@autonomousintelligence.io with full reproduction steps. We acknowledge within 2 business days and aim to triage within 5. Please do not test against live user funds.

In scope: autonomousintelligence.io hosted surfaces, the /v1 and /mcp endpoints, the MCP server, and the swap/build flow.
Out of scope: third-party liquidity pools and chains we route over, wallet software you connect, and the underlying blockchains themselves.
Not a bounty programme: we are a small team and do not run a paid bounty, but we will credit responsible reporters and fix valid issues promptly.

This page describes our security posture in good faith and is not a warranty, audit, or financial advice. Crypto trading and token launches carry risk; always do your own research. Last reviewed 7 August 2026.