Insumer Agent Skills

September 25, 2026 · View on GitHub

Wallet auth as agent skills. Install once, and every Claude Code, Cursor, Copilot, Codex, Gemini CLI, and 25+ other agentskills.io-compatible agent gets native knowledge of how to call InsumerAPI for condition-based access across 37 chains.

Boolean, not balance. Verified yes or no. Provable and private.

Note

Technical preview

These skills are in early release. Expect refinements as the API surface evolves and as we add coverage for new chains and condition types.

What is wallet auth?

OAuth proves who the user is. Wallet auth proves what the wallet holds. InsumerAPI evaluates a wallet's on-chain state against a condition and returns an ES256-signed, JWKS-verifiable boolean. The pattern is read → evaluate → sign:

  1. Read — InsumerAPI reads the wallet's on-chain state on the requested chain
  2. Evaluate — wallet state is checked against the condition
  3. Sign — a boolean result is returned, ES256-signed, with a conditionHash for tamper detection

No secrets. No identity-first. No static credentials. Token gating is one form of condition-based access; this is the general primitive.

Available skills

SkillWhat it doesVersion
insumer-authFree API key creation, env var setup, credit balance0.2.0
insumer-attestCustom condition attestation across 37 chains (/v1/attest)0.2.0
insumer-trustCurated wallet trust profile, 45 base checks across 26 chains (/v1/trust)0.2.0
insumer-trust-batchBatch trust profiles for multiple wallets (/v1/trust/batch)0.2.0
insumer-jwks-verifyOffline ES256 verification of signed responses (raw sig or JWT) against the public JWKS0.2.0

Installation

These skills follow the Agent Skills open standard, so they install into any compatible agent.

# Project-level (per repo)
npx skills add insumerapi/insumer-agent-skills

# Global (every project on your machine)
npx skills add insumerapi/insumer-agent-skills --global

Option B: Manual (Claude Code)

Each skill folder goes directly under ~/.claude/skills/ (one level deep; a nested insumer/ group folder is not discovered):

git clone https://github.com/insumerapi/insumer-agent-skills.git
mkdir -p ~/.claude/skills
cp -r insumer-agent-skills/skills/insumer-* ~/.claude/skills/

Option C: Manual (Grok Build)

Grok Build reads the same SKILL.md format from ~/.grok/skills/ (every project) or .grok/skills/ in a repo:

git clone https://github.com/insumerapi/insumer-agent-skills.git
mkdir -p ~/.grok/skills
cp -r insumer-agent-skills/skills/insumer-* ~/.grok/skills/

Restart your agent. The skills activate when you ask about InsumerAPI: getting a key, attesting a wallet condition, a wallet trust profile, or verifying an InsumerAPI signed response.

First use (60 seconds)

  1. Get a free API key (10 free verifications plus 100 reads/day, no signup beyond an email):

    curl -s -X POST https://api.insumermodel.com/v1/keys/create \
  -H "Content-Type: application/json" \
  -d '{"email":"you@example.com","appName":"insumer-agent-skills","tier":"free"}'

  2. Set the env var:

    export INSUMER_API_KEY='insr_live_...'

  3. Ask your agent something that triggers a skill. Examples:

    • "Add wallet auth to my Express app — gate /admin by USDC balance on Base"
    • "Check whether wallet 0xabc...def holds at least 100 USDC on Base"
    • "Show me a wallet trust profile for 0xd8dA...6045"
    • "Verify this JWT against the InsumerAPI JWKS"

The skill loads the right canonical request shape, the offline verification recipe, and the failure-mode guardrails — your agent emits working integration code on the first try.

Why these skills exist

The agent ecosystem already knows how to call HTTP APIs. What it doesn't know — and gets wrong — is the InsumerAPI-specific patterns that matter:

  • Boolean, not balance by construction (standard mode never returns the underlying balance)
  • Offline ES256 verification against the public JWKS (the signature is the product, not the JSON body)
  • decimals is a cross-check, never an input (leave it out: the token's own decimals are read from the chain, and a sent value that differs is rejected with a 400)
  • Backend-only key handling (never expose insr_live_... in browser JS)
  • Read → evaluate → sign primitive (the whole point — not just an HTTP call)

Each skill encodes these as hard constraints, with reference shapes verified against the live API.

Compatible agents

These skills work in any agentskills.io-compatible agent. The current adopter list includes Claude, Claude Code, Cursor, GitHub Copilot, VS Code, OpenAI Codex, Google Gemini CLI, JetBrains Junie, Sourcegraph Amp, Block Goose, OpenHands, OpenCode, Letta, Roo Code, Mistral Vibe, ByteDance Trae, Snowflake Cortex, Databricks Genie, Spring AI, Kiro, Workshop, Qodo, Factory, Firebender, and others — see agentskills.io/home for the live list. xAI's Grok Build reads the same SKILL.md format (see Option C above).

Network endpoints and credentials

The skills are instructions plus small helper scripts. There are no hooks, no MCP servers, and no install or postinstall steps. The scripts use the Python standard library, except insumer-jwks-verify/scripts/verify.py, which needs pyjwt[crypto] installed by you.

ScriptCallsSends
insumer-auth/scripts/create_key.pyPOST https://api.insumermodel.com/v1/keys/createemail (yours), appName, tier: "free"; no key needed
insumer-auth/scripts/buy_key.pyPOST https://api.insumermodel.com/v1/keys/buytxHash, chainId, appName (default "insumer-agent-skills"), keyDelivery: "apiKey", and amount unless paying in BTC; no key needed
insumer-auth/scripts/buy_credits.pyPOST https://api.insumermodel.com/v1/credits/buyINSUMER_API_KEY, plus txHash, chainId, amount unless paying in BTC, optional updateWallet
insumer-attest/scripts/attest.pyPOST https://api.insumermodel.com/v1/attestINSUMER_API_KEY and the request body you provide
insumer-trust/scripts/trust.pyPOST https://api.insumermodel.com/v1/trustINSUMER_API_KEY, the wallet addresses you pass, and optional proof: "merkle"
insumer-trust-batch/scripts/trust_batch.pyPOST https://api.insumermodel.com/v1/trust/batchINSUMER_API_KEY, the wallet addresses you pass, and optional proof: "merkle"
insumer-jwks-verify/scripts/verify.pyGET https://insumermodel.com/.well-known/jwks.jsonNothing; it fetches the public keys and verifies locally

The only credential is INSUMER_API_KEY, read from the environment and sent only to api.insumermodel.com in the X-API-Key header. No script signs or sends a transaction or holds a private key. None reads any other environment variable (beyond the standard proxy variables Python's HTTP client honors) or any file except a request or wallet list you pass on the command line (--body-file, --wallets-file) or on stdin.

create_key.py and buy_key.py send appName: "insumer-agent-skills" by default, a label on the key that tells InsumerAPI which channel it came from. Pass --app-name to use your own; nothing else is collected.

The skills also show GET https://api.insumermodel.com/v1/credits (balance check) as a curl example. The paid paths in insumer-auth (Path 3 and Path 4) begin with a crypto payment that the skill tells the agent never to make without the user's explicit approval of the amount, token, chain and recipient.

Resources

License

MIT — see LICENSE.