Escrow for agents: what already exists
We went through the npm registry, the official MCP Registry, GitHub and the standards forums in November 2026 looking for every escrow MCP server, agent-escrow protocol and escrow contract we could find. Here is what each one does, what MM borrowed, and what nobody was doing yet.
The rail MM settles on
Base Commerce Payments Protocol, AuthCaptureEscrow v1.1.0. Built by Coinbase, audited by Spearbit and Coinbase Protocol Security (the v1.1.0 change was audited on 22 July 2026), deployed by CREATE2 at 0xf968…B19c on both Base and Base Sepolia. MM checks this against live RPC before every deploy: code present, the ERC-3009 collector wired to this escrow, and USDC's signing domain on both networks.
Why this contract and not a new one: it splits a payment into authorize (lock) and capture (pay out). The operator — MM — can only capture to the receiver named in the signed payment or void back to the payer. The fee cap and the fee address are inside the payer's signature. After the authorization expiry the payer can call reclaim themselves. Funding uses ERC-3009, so a buyer signs one message and pays no gas. Partial captures give milestones and split rulings for free. Most projects below ship their own new escrow contract; MM adds no new contract code at all.
Escrow MCP servers and agent-escrow projects
Descriptions follow each project's own documentation. “Self-described” means we didn't run it.
| Project | Where the money sits | Who decides a dispute | Notes |
|---|---|---|---|
| Trustless Work | Soroban contracts on Stellar | A named dispute-resolver role | Hosted MCP (18 tools), single- and multi-release escrows, returns unsigned transactions for the caller to sign. The most complete escrow-as-a-service we found. MM took milestones and the "you sign, we submit" pattern. |
| ERC-8183 Agentic Commerce (draft, Feb 2026) | A job escrow contract | A single evaluator address | Client / provider / evaluator jobs: Open → Funded → Submitted → Completed / Rejected / Expired. Live implementations include CardZero on Base mainnet and NadBounty on Monad. Forum discussion flagged that a provider can also be the evaluator. MM keeps the evaluator idea but makes it a multi-lab panel plus objective checks. |
| ClawBank × Shodai × Kleros (Sept 2026) | A fresh 2-of-3 Safe per agreement | Kleros "Agentic Commerce Court" with AI jurors | Ricardian contract signed through DocuSign, symmetric deposits from both sides, ruling options fixed in advance; ClawBank executes the ruling. MM borrowed the up-front, disclosed ruling rule and the seller bond. |
| AgentWorks | Escrow v4 on Base Sepolia | M-of-N evaluator committee, UMA optimistic oracle as arbiter | Agents act through Cobo Agentic Wallet "pacts" with spend caps; FastMCP server. |
| Docket Arbiter | AgentEscrow on X Layer testnet | Two AI evaluators, then AI arbitration | Closest to MM's panel idea, with one model family (Gemini). |
| PayCrow (npm paycrow) | Escrow contract on Base | Self-described dispute resolution | Escrow around x402 pay-per-call, with trust scores from on-chain sources. |
| Synmerco (@synmerco/mcp-server) | Stripe and USDC on several L2s | Self-described automated resolution | 46 tools, ERC-8004 reputation, an encrypted "confidential escrow" mode. |
| Kustodia (kustodia-escrow) | Fiat and crypto, 10 chains | Not documented in the registry entry | 36 MCP tools (self-described). |
| Cascrow (cascrow-mcp) | MilestoneEscrowV3 | AI verification | Milestone funding with a local signer that keeps keys on your machine. |
| Tollbooth (@tollbooth-sdk/mcp) | Role-based USDC escrow on Arc | Role holders | Agents hiring and paying agents. |
| decanus-labs/escrow-mcp | DualDepositEscrow v2 on Base | Contract rules | Both sides deposit, so both have something to lose. |
| DirectPing / PactLayer | SimpleEscrow quests on Base / Robinhood Chain | Quest poster | Bounty-style: post a task with ETH or USDC, settle on-chain. |
| base-escrow-mcp, TBUSD escrow MCP | Single P2P escrow contracts on Base | Buyer or a named arbiter | Create, release, refund, dispute with ETH, ERC-20 or TBUSD. |
| XRPL escrow MCP, x402-auth-capture-xrpl | Native XRP Ledger escrow | Crypto-conditions | Release by revealing a preimage; an XRPL binding of x402's auth-capture idea. |
| @yuvlero/mark, Mostro | 2-of-3 Bitcoin multisig; Lightning hold invoices | An arbiter key; Mostro admins | Non-custodial Bitcoin escrow. Hold invoices lock funds in the payer's channel until released. |
| Circle Refund Protocol | Refund Protocol contract | An arbiter who can only release or refund | The clearest statement of the non-custodial arbiter idea. MM gets the same guarantee from the Base contract. |
| Viridis agent-escrow / agent-arbitration | No funds — records only | An arbitration oracle | Exactly-once state machine with a tamper-evident hash chain. MM's audit log uses the same idea. |
| iEscrow MCP | iEscrow (custodial) | iEscrow | OAuth MCP for P2P crypto trades; money only moves with human 2FA. Source not published. |
| Hive escrow and dispute MCPs, StableDrop escrow-payments, Doomsday proof-of-escrow | Various | Various | Registry entries for trust-minimized USDC escrow, a disputable AP2 payment service with signed receipts, and read-only escrow verification. |
| Marketplaces with escrow: Glongus, Mercadopleis, Relay Tech, Wenrwa, NadBounty, AgentTrust, XPR agents, Pactline | Each their own | Each their own | Escrow inside a marketplace for goods, human services or bounties, rather than escrow for any deal. |
| Escrow.com (the incumbent) | Escrow.com's bank accounts | Escrow.com staff | REST API with buyer / seller / broker parties, items with an inspection period in seconds, milestone schedules, and an escrow fee split of 50% or 100% (buyer pays by default). No MCP server of its own; Pipedream's Escrow.com connector lists zero tools. MM copies the human model — terms, inspection window, milestones, fee split — and replaces the bank account and the staff. |
What nobody was doing yet
- Checking delivery from public records. Almost every project asks the buyer, an evaluator, or a jury. MM reads registry records and DNS for domains, GitHub for repos, chain state for NFTs, transfer receipts for token deliveries (one transaction can't prove two deals), proof codes on web pages, and file fingerprints — and pays out on the objective ones without anyone clicking.
- Settling on an audited contract it didn't write. MM's escrow is Coinbase's audited Commerce Payments contract. A bug in MM's server can send money to the wrong one of the two parties, but never to anyone else, and the buyer can always reclaim after expiry.
- Judging with several labs at once. Disputes go to models from different labs; the middle vote wins, one appeal goes to a five-model panel, and everything a party writes is fenced off from the models' instructions.
- Escrow.com's plain human model. Terms both sides accept, an inspection window that pays the seller if the buyer goes quiet, milestones, a fee split, and funding with one gasless signature.
Sources
- base/commerce-payments (contracts, deployment addresses, audits)
- Official MCP Registry search: escrow, arbitration, dispute
- npm registry search: escrow MCP
- ERC-8183 discussion on Ethereum Magicians
- Trustless Work API
- iEscrow MCP docs
- AgentWorks
- Escrow.com API: create transaction
- Pipedream: Escrow.com connector