Prometheus Protocol has rolled out a decentralised system that verifies software builds automatically, tackling one of the biggest trust gaps in crypto and AI: knowing whether the code that runs an app is the same as the code shown to users.
Until now, the app verification process on prometheusprotocol.org was manual and centralised. The new system replaces human checks with an automated network of independent “verifier bots” that rebuild submitted software and confirm, through cryptographic proof, that the final deployed version matches its open-source code.
This upgrade matters for AI agents running on the Internet Computer. These agents—known as MCP servers—can control assets, trade tokens, or manage digital treasuries. When money and autonomy are involved, blind trust isn’t enough. A single line of hidden code can compromise entire wallets or protocols.
Prometheus has automated reproducible builds, a long-standing but rarely practised method in open-source security. Developers submit their app and a link to its GitHub repository. The system posts small bounties that attract verifier bots, which then rebuild the app in clean environments using tools like Docker. When a majority of bots—such as five out of nine—produce identical results, the app earns a “Verified” status.
Each verification is recorded on-chain using Internet Computer standards such as ICRC-118 for Wasm registry, ICRC-120 for safe installation and upgrades, ICRC-126 for verification records, and ICRC-127 for the bounty mechanism. Together, these standards form a transparent, incentive-driven process that anyone can audit publicly.
The economics are straightforward. Developers pay about $2.25 for nine independent verifications. Bots that complete successful builds earn small rewards automatically. Even bots that detect mismatches receive payment, encouraging honest participation. The result is a self-sustaining network where proof replaces promises.
For users, the “Verified” badge adds confidence when granting AI agents financial permissions. They can view on-chain attestations showing which independent bots verified the app. While this system doesn’t replace security audits—it doesn’t check for bugs or logic flaws—it ensures that what’s running on-chain truly matches the published source code.
In the broader ICP ecosystem, this approach fits into a growing movement towards verifiable computation and automated trust. Prometheus Protocol’s upgrade pushes the Internet Computer closer to a state where transparency is practical, not just theoretical. It lays the groundwork for an economy of AI agents that operate under mathematical proof rather than personal reputation.
Developers can now register their apps for verification on prometheusprotocol.org, while technically inclined users can set up verifier bots to earn rewards and help secure the system.
Dear Reader,
Ledger Life is an independent platform dedicated to covering the Internet Computer (ICP) ecosystem and beyond. We focus on real stories, builder updates, project launches, and the quiet innovations that often get missed.
We’re not backed by sponsors. We rely on readers like you.
If you find value in what we publish—whether it’s deep dives into dApps, explainers on decentralised tech, or just keeping track of what’s moving in Web3—please consider making a donation. It helps us cover costs, stay consistent, and remain truly independent.
Your support goes a long way.
🧠 ICP Principal: ins6i-d53ug-zxmgh-qvum3-r3pvl-ufcvu-bdyon-ovzdy-d26k3-lgq2v-3qe
🧾 ICP Address: f8deb966878f8b83204b251d5d799e0345ea72b8e62e8cf9da8d8830e1b3b05f
🪙 BTC Wallet: bc1pp5kuez9r2atdmrp4jmu6fxersny4uhnaxyrxau4dg7365je8sy2q9zff6p
Every contribution helps keep the lights on, the stories flowing, and the crypto clutter out.
Thank you for reading, sharing, and being part of this experiment in decentralised media.
—Team Ledger Life
