Shield47
Live on Base

Agents are tracked by default. Shield47 makes their transactions private and unlinkable.

On a public chain, anyone can read your entire on-chain life, every balance, counterparty, and move your AI agents make. Shield47 shields funds into a unified privacy pool and unshields to a clean wallet, with zero linkage between the two.

Non-custodial · live on Base · verified by zero-knowledge proofs

Launch App → Launch Skill { } MCP Server
explorer · base / 0x9f…a3c1
PUBLIC
EVERYTHING ANYONE CAN READ ABOUT THIS WALLET
balance
deposit from
swaps
recurring in
position
label
zk-proof · payer ↛ payee unlinkable
Public today. Unlinkable with Shield47.
Built on Base · Independently audited ✓ complete · MCP·Claude·Cursor·ACP · Open-source

Every move your agent makes is public. Permanently.

AI can't transact over email or Slack. Blockchains are the first rails it can actually use, agents that hold value, sign contracts, and pay each other directly. But every one of those actions happens in the open, and the ledger never forgets.

Agents finally coordinate on-chain

Contracts, payments, and messages between agents settle on the chain, the only neutral rail machines can transact on without a human in the loop.

All of it happens in the open

Every interaction is broadcast to a public forum and recorded forever. Who an agent talks to, what it pays, and how it decides are readable by anyone.

The AI web needs both

Machines need data that stays private but still proves true. Shield47 keeps it immutable and verifiable, without putting it on display.

How it works

Shield in. Unshield out.
No link between the two.

01

Shield: deposit into the pool

Your agent deposits funds into the unified privacy pool and receives a private note.

→
02

Blend: break the link

Zero-knowledge proofs sever the connection to your deposit inside one shared anonymity set.

→
03

Unshield: withdraw clean

Funds arrive at a fresh wallet with no traceable connection to the source. Gasless via x402.

The protocol

Infrastructure-grade by design

01

Unified privacy pool

One anonymity set. Every shield deepens the same pool, so withdrawals blend into the crowd.

02

Non-custodial

The protocol never touches your funds. You hold the note, only you can unshield.

03

Audited Groth16 proofs

The live stack runs on Groth16 zero-knowledge proofs, independently audited, with the audit complete.

04

Gasless withdrawals

A relayer pays gas via x402, so a fresh wallet needs no prior funding.

05

Compliance-capable

KYT/KYP screening keeps flows compliance-capable, so institutions stay auditable, not exposed.

06

Post-quantum, on the roadmap

A WHIR hash-based stack, formally verified in Lean, with no trusted setup, the credibility moat coming next.

Secure today. Quantum-ready next.

We never present a roadmap item as already shipped. Here is exactly where the protocol stands.

Pre-quantum privacy · Live

LIVE NOW

Link-breaking shielded transfers, running today on Base with battle-tested zero-knowledge cryptography.

Shielded transfersoperational
Proof systemGroth16 · trusted setup
Agent MCP serveroperational
Independent auditcomplete

Post-quantum · On its way

~95% COMPLETE

A quantum computer could one day break the elliptic-curve cryptography securing today's chains, and adversaries can harvest encrypted data now to decrypt later. We're moving to a WHIR hash-based stack that stays secure even then. Not yet deployed.

Post-quantum stack~95%
WHIR proof circuitno trusted setup
Formally verified (Lean)in progress
On-chain verify~3M gas
Deploymentnot yet deployed
status values illustrative, to be replaced with verified figures before launch
Agent-native

Built to be used by software, not just people.

The first agent-native privacy protocol. Full MCP support and an OpenClaw SKILL.md let AI agents transact privately, no frontend required.

  • ✓ Native MCP server, drop into Claude, Cursor, and ACP
  • ✓ Shield and unshield from a few lines of agent code
  • ✓ Gasless withdrawals, relayer pays gas via x402
  • ✓ KYT/KYP screening keeps automated flows compliance-capable
agent_workflow.ts 
import { Agent } from "@shield47/mcp";

const s47 = new Agent({ chain: "base" });

// shield funds into the unified pool
const note = await s47.shield({
  token: "USDC",
  amount: 5_000,
});

// later, unshield to a clean wallet, no link
await s47.unshield({
  note,
  to: "0x41…7e08",   // fresh address
  gasless: true,        // relayer pays via x402
});
A cut above

Most privacy hides amounts. We break the link.

A fair frame for where Shield47 sits, not a takedown of anyone.

AMOUNT-ONLY PRIVACY

Hides values, but the payer↔payee link stays visible, so the graph is still reconstructable.

ISOLATED PRIVACY CHAINS

Private, but walled off from DeFi liquidity and from the agents now transacting on-chain.

SHIELD47

Breaks the link, on Base, with full DeFi and agent reach, and stays compliance-capable for institutions.

$S47 · fee share · fee discounts · governance

Give your agents the privacy any
serious operation requires.

Shield your first transaction on Base, or drop the MCP server into your agent stack today.

Live on Base · independently audited · post-quantum on the roadmap
FAQ

Answers before you decide

Shield47 is privacy infrastructure, not a sanctions-evasion tool. It is built around a "Do Not Track, enforced" posture with KYT/KYP screening that keeps flows compliance-capable, so legitimate users get privacy while compliance teams keep the auditability they need. It is not designed for, and screens against, illicit flows.
No. Shield47 is non-custodial. You hold the private note that represents your deposit, and only that note can unshield the funds. The protocol contracts never take custody and cannot move, freeze, or seize your balance.
The live stack runs on Groth16 zero-knowledge proofs and has been independently audited, with the audit complete. A WHIR hash-based, post-quantum stack, formally verified in Lean and with no trusted setup, is nearly ready on the roadmap (not yet deployed). We publish results rather than claim them early.
Yes. Shield47 ships a native MCP server and an OpenClaw SKILL.md, so agents in Claude, Cursor, and ACP can shield and unshield directly, no frontend required. It is the first agent-native privacy protocol.
Shield47 settles on Base L2. Withdrawals are gasless, a relayer covers gas via x402, and the protocol charges a small fee (placeholder %, to be finalized). $S47 holders receive fee discounts and a share of protocol fees.