🤖 CITIZEN AGENT

Every wallet on X1 gets a personal AI bound to it — soul-bound, on-chain-aware, with its own keypair, its own balance, and a hard daily cap. The first paired-AI-per-wallet system on a Solana-class chain.

🔑 Deterministic keypair. Your agent's wallet is derived from sha256(masterSeed + 'citizen-agent-v1' + yourPubkey). Same wallet → same agent, every time. No registry. No central authority. Lose access to your wallet → you lose access to your agent. That's the bond.

What it does

balance — read your wallet's XNT and the agent's own balance
holdings — list every SPL + Token-2022 token in your wallet, priced
recent_activity — pull your last on-chain trades + transfers
top_tokens — query the live X1 screener for top tokens by liquidity
screener_lookup — full token detail (price, holders, liquidity, change windows)
claim_faucet — trigger your free APEX faucet claim
send_xnt — execute a real on-chain transfer (with explicit confirmation, daily 5 XNT cap)
city_tour — guided walk through the APEX ecosystem (faucet, screener, agora, reputation)

How payments work

You fund your agent's wallet with a click — send any amount of XNT to its address. The agent spends only what it has, never reaches into your main wallet. Daily spend cap: 5 XNT. Cap resets at UTC midnight. Want to spend more? Top up the agent.

Confirmation flow on real actions

You: send 0.5 XNT to FAUCET
Agent: I will send 0.5 XNT (~ $0.41) from  to HYiepS7m…1x8kJ.
       Daily cap remaining: 4.5 XNT.
       Reply 'confirm' to execute or 'cancel' to abort.

You: confirm
Agent: ✓ Sent — sig: 5KpB2wBX…JW5Q
       Explorer: https://explorer.x1.xyz/tx/5KpB2wBX…JW5Q

No silent execution. Every on-chain mutation requires an explicit "confirm". Read-only tool calls (balance, holdings, screener) execute directly without prompting.

Why a paired AI matters

SOUL-BOUND

Agent identity is derived from your wallet, not stored in a centralized registry. There is no API key. Cancel one, get the same one back next time you connect.

ON-CHAIN AWARE

The agent reads chain state directly, not from a database. Your holdings, your trades, your token-account balances — all from on-chain truth, every call.

BOUNDED

Hard daily cap on outbound XNT. Confirmation gate on mutations. Agent's wallet is funded only by you — its blast radius is exactly what you put in.

ECOSYSTEM-NATIVE

Plugged into the screener, faucet, agora, and reputation registry. Ask "what's CAPY doing?" → the agent queries the live screener and reads on-chain.

Open it

The agent terminal lives inside Citizens City. Connect your wallet, click 🤖, talk to your agent.

→ OPEN CITY → X402 / MCP → AGENT.JSON

Quick answers

Q: Does the agent have my private key?
No. The agent has its own keypair, deterministically derived from a server-side master seed plus your wallet's public key. The agent can sign for its own wallet only. To send any funds out, the agent's wallet must be funded by you first.

Q: What if I lose access to my wallet?
You lose access to the agent paired to it. The agent's keypair is reproducible only from the master seed + your public key, and the master seed never leaves the server. By design, there is no backup path that bypasses your wallet.

Q: How is this different from ChatGPT with my wallet?
ChatGPT can talk about your wallet but can't sign anything. The Citizen Agent is a real on-chain identity — it has its own funded keypair, can sign transactions, and operates inside the boundaries you set (daily cap + confirmation gate). It's the LLM brain plus the chain hands.

Q: Is this MCP-compatible?
Yes — every Citizen Agent tool is also exposed as a free or paywalled tool on the APEX MCP server. External agents (Claude Desktop, Anthropic SDK clients) can call the same tools through the standard MCP JSON-RPC interface.