Straight answers. If yours isn't here, email [email protected].
No. Obol is a research preview: a design, a draft token format, and results from two lab prototypes. There is no package to install and no release date. When there's something you can run, this page will say so first.
One thing to know: the name obol on PyPI belongs to an unrelated project. It is not ours. Don't install it expecting this.
Yes. Earlier versions of this site described a traffic-inspecting proxy that correlated what an agent said with what the kernel saw it do. We built that, and then a plan-gated successor. Both worked in the lab. Both pointed at the same conclusion: rather than getting better at catching an agent misusing power, stop giving it power it doesn't need for the next action. Obol is now about that.
Gray Owl Research, LLC — a small independent security research practice. Obol is a research project, not a venture-funded product.
A signed, single-use, expiring permission for one specific action, minted from what you asked the agent to do, that a gate checks and burns before the action happens.
In Greek myth, the obol was the coin placed with the dead to pay Charon, the ferryman, for passage across the river. No coin, no crossing. The metaphor is exact: an agent's action crosses from its private context into the real world, and it should pay a fare that only you can mint.
No, and nothing currently does. Obol makes injection far less useful. A fooled agent can only spend the coins the current task gave it, and values that came from untrusted content can be barred from shaping the arguments of sensitive actions. The agent can read a malicious instruction and still be unable to act on it.
It would be, so the design avoids it. You approve at the level of a request (“book the trip under $600”), not each click. Routine, low-risk actions can draw from a standing allowance you set once — small, capped, and still receipted. Prompts are reserved for actions that are new, costly, or irreversible.
Those decide whether a client may talk to a server, with broad scopes that last for a session. Obol sits underneath: which exact call, with which arguments, for which request, shaped by which input, once. It's designed to work with them — an obol can ride alongside a normal access token.
Not at the gate. A model can help draft a coin from your request, and you approve the result. Checking a coin at the moment of action is signatures and comparisons — nothing an attacker can argue with.
The first gates target agents that use MCP tools and coding agents with pre-tool hooks, because that's where our lab work was done. The coin format itself isn't tied to any vendor or model.
It's built first for individuals and small teams running real agents — the people the enterprise market isn't serving. Nothing about the format stops a larger organization from using it.
The coin format will be an open spec. The reference gate is intended to be open source, released with its test suite and lab data. A security tool you can't read is asking for trust it hasn't earned.
Email [email protected]. We're especially interested in people running agents that can send, spend, or delete, and in anyone who wants to attack the design.
Good — that's the point of publishing early. Email with subject “Obol design issue.” If it's a vulnerability in anything we've released, use “Security Disclosure — Obol” and we'll acknowledge within 48 hours.