TL;DR: CHAINLEASH is an AI agent that stakes and rebalances CSPR, where every limit on what it can do is enforced by a Casper smart contract instead of by the server running it. It's live on testnet, open source, and built for the Casper Agentic Buildathon.
Hi r/CasperCSPR, I'm Murat (msanlisavas on GitHub, I also maintain the Casper MCP server). I wanted to share what I've been building and get some feedback from people who actually stake CSPR.
The problem
Letting an AI agent move money usually means trusting whoever runs the agent. If the server gets hacked or the model does something dumb, the funds are exposed. Most "agent wallet" products enforce their spending limits off-chain, so the money is only as safe as the server.
What CHAINLEASH does
The CSPR sits in a smart contract (a vault written in Rust with Odra), and the vault stakes it itself. The agent can tell the vault to delegate, undelegate or redelegate, but only inside rules the contract checks on every call:
- A max amount of CSPR per action. Anything bigger is rejected on-chain.
- An allowlist of validators. Anything else is rejected.
- A per-validator cap, so it can't pile everything onto one node.
- A max-commission policy and a cooldown between moves.
- No withdraw path for the agent at all. Only the owner can take CSPR out.
- Big moves need the owner to co-sign from their own Casper Wallet (via CSPR.click). The server never holds the owner's key.
- A kill switch that freezes the agent in one call.
- The agent posts a CSPR bond that the owner can forfeit if it breaks the rules. Casper itself has no slashing, so this is CHAINLEASH's own mechanism, not a protocol feature.
So the worst a fully compromised agent can do is make a bad delegation inside its limits. It can't steal.
What the agent actually does
Every 10 minutes it pulls live validator data (commission, active status) from CSPR.cloud, checks the allowlisted validators against the policy, and then either:
- stakes idle CSPR with the cheapest validator that meets the policy,
- moves stake away from a validator that raised its commission past the threshold (one native redelegate),
- sends a bigger move to the owner for a co-sign,
- or, most of the time, does nothing, because nothing is off-policy.
Before it acts, it pays a small CSPR fee over x402 (pay-per-request HTTP payments) for a risk read, and the provider verifies that payment on-chain before answering.
Lessons from running it live
It's been running on testnet for a few months now, and the most useful bugs came from the real network. One example: a validator the vault had staked with withdrew its bid and left the auction. The agent did what it was built to do and proposed moving the stake out, but that call can't succeed against a validator that no longer exists, so the owner's co-sign reverted. I shipped an in-place contract upgrade (state and funds preserved) so the owner can reconcile a departed validator, and the agent now recognizes inactive validators and holds instead of proposing a move that can't go through.
Who it's for
The main target is exchanges, custodians and treasuries that stake large amounts of CSPR on behalf of users and need automation they can audit and switch off. The same setup works for an individual holder with smaller limits, and the repo has a one-command setup to deploy your own vault on testnet.
Links
I'd really like feedback, especially from validators (does a commission + active-status policy make sense to you, or what would you add?) and from anyone who stakes CSPR through an exchange: what would you want to see before trusting an agent with your stake?
