Praxis is a conversational agent for Solana you can safely hand signing power to. An on-chain policy — not a backend promise — decides what it can do. Say what you want in plain English; every action is checked against your limits before you sign, and you can revoke it in one transaction.
Sends, pre-IPO stock buys, recurring orders, policy changes — all of it typed, all of it checked against an envelope the agent cannot cross. Here is the real thing, running.
A name, not an address. The proposal carries the fee, the simulation and the verdict before there is anything to sign.
And that's the whole problem. A bug, a bad parse, a prompt injection, a compromised backend — any one of them, and an agent holding your keys can drain you. So far the only answers have been bad ones.
Approve each one by hand. Safe — and now it's just a slower wallet. The agent was supposed to save you the clicks.
Let it sign whatever it wants. Useful — until the day a bug, a bad parse, or an attacker turns that power against you.
Ask it to send 50 SOL when your cap is 5, and the transaction simply fails. Not because our server said no — because the Solana program won't sign it.
The agent proposes. The chain disposes.
Praxis is built around one input field. Whatever you'd do on Solana, you can ask for in a sentence — and Praxis turns supported intents into signable actions, while blocking anything it cannot enforce.
Addresses resolve through an address book you build by saving them in chat. Two contacts with the same name is a question, not a coin flip.
Tokenized pre-IPO equity, priced live from PreStocks. The mints are Token-2022, so Aegis moves them with TransferChecked under a token envelope separate from your SOL one.
A cron job fires the schedule and emits a proposal through the same policy checks. It never signs for you — a recurring buy you have to approve is the only kind we will ship.
Price, 24h move, volume and liquidity from the live sources, plus what the token's issuer can still do to it. No buy, sell or hold calls — ever.
The agent can draft a policy change; only your wallet can apply one. Aegis takes the owner's signature for every cap, allow-list and expiry on the account.
Swaps are parsed, priced and previewed — then refused, because there is no Jupiter CPI and no way for the program to bound a route it never sees. We would rather show you the wall than route around it.
Natural language. Misspellings, slang, half-formed thoughts. Praxis parses intent the way a senior trader skims a Telegram message — not the way SQL parses a query. Ambiguity prompts a follow-up; certainty proceeds.
Every action is simulated against live chain state before you see it, and the proposal card shows the fee, the simulation result, and the Aegis verdict side by side. Anything the program cannot enforce — a swap, today — is previewed and blocked rather than quietly signed.
The scoped agent key can only sign Aegis instructions against your policy vault, and the program re-checks the whole envelope before any value moves. Owner actions — funding, caps, allow-lists, revoke — are wallet-signed by you. The agent never holds unrestricted authority over anything.
An Anchor program that checks signer, pause, expiry, per-transaction cap, rolling daily cap, recipient allow-list and configured mint — inside the instruction, before any value moves.
Plain language into a typed action, with misspellings, shorthand and multi-step requests. Two Tos in your contacts, or an amount it can't pin down, produces a question — never a guess.
Every action is simulated against live chain state before you see it. The card carries the fee, the simulation result and the Aegis verdict, so you sign something the chain has already agreed to.
Native transfers go through agent_transfer; tokens through agent_transfer_spl, which CPIs TransferChecked so the token program re-verifies mint and decimals. One token envelope at a time, with its own caps.
Tokenized pre-IPO equity through PreStocks, priced from the live API. Baskets split a USD total across constituents and are all-or-nothing: one blocked leg clarifies the whole basket rather than part-filling it.
Daily, weekly or monthly schedules fired by a cron job across every wallet with one due. Each fire emits a proposal through the same checks and waits for a signature — auto-signing is out by design.
Funding, withdrawal, caps, allow-lists, key rotation, revoke and teardown are wallet-signed by the owner. The backend can hold a scoped agent key; it never holds yours.
Allowed actions land in the program's own ActionLog, so the record is the chain's rather than ours. Refusals are surfaced with the typed on-chain reason code that produced them.
@usepraxis/sdk signs the wallet-ownership challenge, holds the session and drives the agent from Node. It never sees a model key or the agent's private key — those stay server-side behind Aegis.
Conversational interfaces in crypto are easy to build badly and dangerous when built carelessly. These are the lines we draw and won't cross — even when it would be convenient.
The demo uses a program-owned Aegis vault and a scoped agent key. Production owner actions must be wallet-signed, and any autonomous agent authority must stay inside an on-chain envelope it cannot cross.
If your intent is ambiguous, Praxis asks. Two Toms in your contacts? It asks which. Token symbol collides? It asks which. Better one extra question than one wrong transaction. The agent is the interpreter; you remain the decider.
Verified tokens only by default. Unverified mints require an eyes-open override and a second confirmation. The agent is conservative by construction. Memecoin sniping is not the product. Not yet, perhaps not ever.
Praxis surfaces data and executes verified actions. It does not tell you to buy, sell, or hold. Markets are markets; decisions remain yours. The product is a sharper tool, not a louder voice.
Network fees and product fees must be surfaced before you sign. No hidden spreads, no "convenience markups," and no pretend swap execution path until the program can enforce it.
Sends, token transfers and recurring buys already prove the thesis: an agent can hold signing power without being able to misuse it. Everything next widens what it can do — without ever widening the envelope it does it inside.
Live Jupiter routing — but only once mint, program, and value limits live inside the swap instruction itself. A swap that could slip outside the envelope would break the whole promise, so it ships when the program can bound it, not a day sooner. Until then the intent is parsed, priced, previewed and refused.
An allowed action lands in the program's own ActionLog; a refused one reverts, so its proof lives only in a failed transaction's logs. That asymmetry is backwards for a product whose argument is the refusal. An indexer that keeps rejections as permanently as the chain keeps approvals fixes it.
Open the same Aegis envelope to other autonomous agents. Anything that needs to pay, rebalance, or transact on-chain can borrow Praxis's scoped, revocable authority instead of a naked private key. Praxis becomes the safe hands the agent economy moves through.
One rule never changes: new power has to make the safety stronger — it never opens an escape hatch.
Connect a wallet, set your caps, and walk the whole thing: send SOL, move a token, schedule a recurring buy — then ask for more than your limit and watch the program refuse it. Devnet SOL, real enforcement.