delegation playground
Watch authority
get granted, narrowed, denied, and revoked.
Five real acts, verified live against Base mainnet — a bounded grant, a narrower delegation, an attempt the guard actually enforces, two ways to try for more than was granted, and a revocation that kills a whole cohort at once. No authorization server anywhere in this page.
Loading wasm + config…
What's real here, and what isn't
The delegator key (A, below) is published on purpose and controls nothing outside the shared sandbox.
The challenge is self-issued: this page is holder and verifier in one place (the broker sandbox documents the same caveat).
Everything else — signatures, narrowing math, registry reads — is real, against Base mainnet.
Use budgets (max_uses) are signed into the grants, but this page does not meter them — nothing here counts calls. Metering is enforced by the deployment that sits in front of real tool calls (the @grantor/mcp broker). Act 3 checks the grant's scope and expiry, not a running count.
Grant
A signs a bounded grant to B — two tools, capped uses, an expiry — and B proves it against a live Base mainnet read. Press Start above to run it.
That identity step is a whole story of its own — no signup, no auth server, even passkeys: see the identity demo.
Delegate narrower
B delegates a strict subset onward to C — one tool instead of two, five uses instead of twenty. The narrowing is enforced by construction: a wider onward link refuses to sign at all (Act 4 shows that refusal directly).
Try it
Pick what C attempts. A granted tool returns ALLOW — in scope, not expired; anything else returns the guard's raw CapabilityDenied refusal. The grant's max_uses is signed into it, but this page doesn't count calls — a metering deployment (the broker) does. Try both — this one is yours to explore.
Escalate
Two ways to try for more than was granted. One is a polite refusal at signing — nothing is ever produced. The other is a cryptographic refusal — a forged assertion is caught by the live chain walk. They are not the same kind of "no".
(a) Widen the grant, and try to sign it
Refused before any signature is produced — a polite refusal.
(b) Forge a wider assertion instead
Minting never checks — only the live chain walk does. This one signs fine and fails on the wire: a cryptographic refusal, BadDelegation.
Revoke
A re-signs the very same grant, but against a cohort that's already been bumped on-chain. One epoch bump kills every deed issued against that cohort, everywhere, at once — no per-token revocation list to maintain.
Free play
The knobs, unlocked. Compose your own grant, delegate it onward, and watch ALLOW/DENY — same signing and verification path as the five acts above, your own tools/uses/expiry.
This exact mechanism, as a tool your agents use today
Every deny above is an argument; this is where it converts. The @grantor/mcp broker enforces grant/delegate/narrow/deny/revoke for real MCP tool calls — not advisory, structural.
npx -y @grantor/mcp servegrantor-mcp wrap --tools search,fetch --max-uses 20 -- npx some-mcp-serverNo analytics on any of this — the chain and npm are the only metrics, as everywhere on this site.