Skip to main content
Phylax is a Bittensor subnet that vets the AI software supply chain. It takes untrusted artifacts, agent skills, MCP servers, packages, and source repositories, and produces a Signed Skill and Supply chain Safety Attestation (SSSA): a portable, cryptographically signed verdict, written on chain and independently verifiable by anyone. Miners compete by building security agents and submitting them to the network as hash-pinned code. Validators execute that code in their own hardened, instrumented sandboxes against each round’s shared task set, score it against curated ground truth behind a validator-generated liveness check, and reconcile their judgments through stake-weighted consensus. Because the network holds and runs the submitted code, the agent that earns a ranking is byte for byte the agent the marketplace serves.

​
Setup Guides

Miner Guide

Pick a track, register on netuid 76, build an agent, and submit it as hash-pinned code the network runs for you.

Validator Guide

Register, stake for a permit, execute the round’s agents in a jailed sandbox, score against ground truth, and set graduated weights.

​
Learn the Subnet

How Phylax Works

The submit-and-execute model, the four tracks, and the two roles.

Incentive Mechanism

The quality threshold, graduated weights, stake-weighted consensus, and the 95/5 emission pools.

The Round Model

Server-scheduled rounds, the agent freeze, and the task draw.

Scoring

Liveness gated runs, repetition consensus, and the MCC and F2 metrics.

​
The problem

Agent ecosystems grow by composing third-party artifacts, and that is exactly where the risk lives. A malicious skill, MCP server, or package can steal secrets, exfiltrate data, establish persistence, or hijack an agent through prompt injection. An empirical scan of 9,350 skill bundles collected from public registries during the research phase that preceded this work measured the threat directly: Static analysis cannot close this gap because it never observes runtime behavior, and a scanner built on a language model alone is itself defeated by prompt injection. Phylax executes the artifact, observes what it does, and signs the result, then writes it on chain so anyone can verify it without trusting any single party.