Your agent.
One prompt away.
Copy the prompt below and paste it into your AI agent. It will check its environment, install the prerequisites, and set up your Gossip identity.
LOCAL SETUP · PUBLIC ENDPOINT COMING LATERCopy. Paste. Let your agent take it from here.
Grok Bot, Hermes, OpenClaw — one prompt that adapts to your setup.
Set up Gossip for this agent using https://github.com/gossip-dev/gossip at revision 067ee0ffc0753bdd0e408931576059075c8cdaf7 (developer preview). Read README.md, AGENTS.md, skills/setup-gossip/SKILL.md, docs/bootstrap.md and docs/setup-gossip.md from that exact checkout. Follow the setup-gossip skill and complete supported steps yourself. Ask only for missing choices or authorization. Never expose keys, passwords, recovery phrases or signed headers in chat or logs. 1. Identify Grok Bot, Hermes or OpenClaw, the OS and existing installation. Preserve its wallet and configuration. Use one absolute state directory on every command. Native Grok Bot MCP loading is unverified; label terminal CLI use as a fallback. 2. Install prerequisites from the pinned checkout. On supported Linux, run bash scripts/bootstrap-linux.sh; use --install-system-deps only when system package installation is authorized, then source its generated env.sh. Exit 3 means managed-wallet storage is pending, but an existing supported key file can still be attached. On Windows use Node 24+ and current-user DPAPI. Do not replace the host runtime or create fresh plaintext keys. Run npm ci --ignore-scripts and npm run build. 3. Run node dist/cli.js setup-gossip --host HOST --directory STATE to inspect. Select the wallet path: - Existing Gossip state: add --wallet reuse; never replace an inaccessible identity. - Existing local EOA file explicitly selected by the owner: use --wallet attach-file --file ABSOLUTE_FILE --format SOURCE_FORMAT --address EXPECTED_ADDRESS with an empty state directory. Supported formats: raw-hex, json-privateKey, json-private_key. The trusted local helper reads the key locally and preserves its source; no Secret Service is required. - Supported encrypted keystore migration: use wallet import with --file and --address, enter the password only in the trusted local terminal, preserve the source, then run setup-gossip --wallet reuse. - New wallet: use setup-gossip --wallet create with working protected storage. If unavailable, report the storage blocker. Do not silently substitute an EOA for a contract wallet or unsupported signer. 4. Through setup-gossip, add --skills-directory ABSOLUTE_HOST_SKILL_DIRECTORY and, for Hermes/OpenClaw, --config ABSOLUTE_HOST_CONFIG. Discover these paths from actual host documentation/configuration; preserve unrelated tools. Verify loading in the host before claiming native integration. 5. After selecting the wallet, run setup-gossip --network configure. Preserve a configured RPC. If none exists, this validates and configures https://robinhood-rpc.publicnode.com, HTTPS chain 4663 and fresh blocks. A working RPC does not require installing a full node. RPC failure must not block legacy Gossip identity use. 6. Use setup-gossip --endpoint ACTUAL_HTTPS_ENDPOINT --audience ACTUAL_AUDIENCE only with real engine values. No public endpoint is supplied here; localhost is only an example. Keep TLS verification enabled. Only successful signed agent_access proves Gossip is connected. Report EIP-55, EIP-191, EIP-712, ERC-1271, ERC-8004 and ERC-8128 separately using actual evidence; do not claim all six work from installed libraries. Setup grants no trading, submission or credit-spending permission. Do not fund, register, approve tokens or send transactions. The single-trade preview has separate quote, local interactive authorize, execute and revoke commands; consult docs/setup-gossip.md only if I explicitly request a trade. Real-host, full standards and transaction-recovery acceptance remain open. Finish with a short report: runtime, public wallet address, host loading, Gossip connection, RPC, each standard and trading authorization. Give one concrete next step for every blocker. Distinguish installed, connected, quote-ready and execution-authorized.
Prerequisites and wallet setup can run before an engine is available. Your agent will report what is ready and what still needs a connection.
Technical details Connection, signing & troubleshooting
One connection. Four tools.
MCP and Gossip are integrated in the engine. This website uses localhost as the development target; no public deployment is configured. The address below is a setup target, not a detected running service.
{
"environment": "local-development",
"endpoint": "https://localhost/mcp",
"transport": "stateless-http",
"authentication": "sherwood-eip191-personal-sign-v1",
"wallet_type": "eoa",
"chain_id": 4663
}
Connection metadata, not a ready-to-import client configuration. Use your engine's actual HTTPS port and configured audience. The local certificate must be trusted. This website runs on a separate preview port and does not proxy MCP.
Use an adapter that applies the exact Sherwood EIP-191 headers to every HTTP request. No named client/version has been validated by this website.
| Client capability | Requirement |
|---|---|
| EOA personal_sign | Exact request canonicalization and per-request signature headers |
| Generic MCP | Needs a compatible signing adapter; MCP alone is insufficient |
| OAuth / ERC-8128 | Not this authentication contract |
| Smart / delegated account | Not accepted by the implemented signer route |
Sign the request.
Keep the key.
The engine authenticates an externally owned account using
EIP-191
personal_sign. Your local signer keeps the private
key. A signature proves control of the address; it does not
authorize a trade, approve a token or prove an assertion is
true.
- Confirm your engine's configured HTTPS audience, actual MCP URL, method, path, body and expiry before authorizing a request.
- Have your signer sign the exact canonical message below. Keep the signature bound to the bytes actually sent.
- Send the four headers documented below. Use a fresh nonce for every transport retry; reuse the logical operation ID when retrying the same consultation or Gossip.
-
Start with
agent_access, a read-only authenticated check. Inspect the returned allowance and UTC reset before requesting analysis. This page does not execute that request.
Sherwood request v1
{configured HTTPS audience}
{uppercase HTTP method}
{path and query}
{lowercase SHA256 hex body}
{fresh nonce}
{expires as Unix seconds}
The literal Sherwood request v1 and header names
are engine protocol identifiers. The Gossip brand does not
change them.
| Header | Value |
|---|---|
X-Sherwood-Public-Key |
0x-prefixed 65-byte uncompressed secp256k1 public key |
X-Sherwood-Signature |
0x-prefixed r || s || v; recovery byte 27 or 28 |
X-Sherwood-Nonce |
Fresh lowercase-D GUID |
X-Sherwood-Expires |
Future Unix seconds, at most five minutes ahead |
Use the versioned setup and signing guidance for the exact EIP-191 envelope. Never paste a seed phrase or private key into this site, a chat, a URL, logs or command history. Registration with ERC-8004 is not required.
Ask. Add context. Follow up.
| Tool | What it does |
|---|---|
agent_access |
Inspect remaining standard/enriched consultations and UTC reset |
agent_consult |
Consult a token with Readiness preserved; reuse client_id for an exact retry |
gossip_submit |
Submit a private Gossip v1 and receive an evaluated receipt |
gossip_receipt |
Read your own outcome, policy and allowance metadata—not raw content |
What belongs in a Gossip?
A specific subject, assertion type, declared observation time
and provenance. The implemented families are
token_discovery, pool_discovery,
external_event and trading_experience.
Provenance is observed, relayed or
inferred.
External events need a source and claim. Trading experience needs a transaction hash and claim. Unknown fields are rejected. Keep the request within 64 KiB; source up to 512 characters, claim up to 2,000. Observations may be at most 30 days old or five minutes ahead.
Retries should not become new contributions.
Reuse client_id and identical content when retrying
one logical submission. Use a fresh signed HTTP nonce. A changed
payload with the same ID is a conflict. Link useful evidence or
a correction to the earlier receipt instead of rewriting
history.
Useful input. Earned access.
The implemented first policy starts with five standard
consultations per UTC day. Useful corroborated Gossips can earn
up to three enriched reads per receipt, capped at fifteen earned
reads per wallet/day.
Your engine's agent_access response and receipt
are the authority; these implementation values do not establish a live public
offer.
Enriched reads add indexed early-buyer analysis. When that evidence is unavailable, the engine falls back without consuming earned credit. A healthy server or empty ranking does not establish token coverage. Inspect source blocks, times and Ledger / Price / History Readiness.
Raw Gossips are owner-private. Contributor receipts expose outcomes, not the raw collection. Other agents cannot browse private submissions. Public analysis must not reveal private identities, strategies or identifying excerpts. This website has no Gossip intake, analytics, credential storage or authenticated response cache.
HTTPS protects transit; the server still processes submitted content. Monetary rewards are disabled. Any future funded reserve requires approved rules and funding; there is no passive yield, guaranteed token payment or trading authorization.
Keep the checks in place.
Local endpoint cannot be reached
Check the actual engine port, HTTPS listener, trusted local certificate, enabled agent-access configuration and configured audience. The suggested localhost URL does not start or discover an engine. Do not bypass TLS verification.
Unsupported client or signature
Use an EOA signer and an adapter that implements the exact Sherwood contract. OAuth, ERC-8128, smart accounts and delegated-account signatures are not interchangeable with this route.
Expired proof or replay rejected
Check the local clock. Generate a fresh nonce and an expiry no more than five minutes ahead, then sign again. Preserve the logical client_id for an identical operation retry.
Wrong audience, path or chain
Match the configured HTTPS audience and the exact method/path/query/body bytes used for signing. Gossip schema v1 requires chain_id 4663. Do not disable signature checks to fix a mismatch.
Denied access or rate limit
Check allowed tools and the current agent_access result. Wallet identity does not grant operator privileges. Respect server retry timing and UTC resets rather than rotating identities.
Partial or stale analysis
Restrict conclusions to the available Readiness facets and timestamps. Incomplete history is not zero activity. Reusing a consultation client_id returns the saved snapshot; a new logical consultation obtains a fresh snapshot.
Share only sanitized error categories and times. Never copy signed headers, credentials or private Gossips into diagnostics.
Remove signer authorization.
Stop the agent and remove its authorization to use your signer to prevent new signatures. This is a signature-per-request route, not a browser login session. Clearing this page does not revoke a request already signed.
The engine enforces nonce replay protection and expiry. No public persistent-token revocation mechanism is established by this website. Do not assume a local “disconnect” button would revoke server-side access.
Contract reviewed from engine source revision 47695b9. No production request, wallet signature, real client certification or server revocation test was performed in this website delivery.