With the amount of new subnets being added it can be hard to get up to date information across all subnets, so data may be slightly out of date from time to time
With the amount of new subnets being added it can be hard to get up to date information across all subnets, so data may be slightly out of date from time to time
Phylax is a decentralized trust layer for the AI software supply chain, operating on Bittensor as Subnet 76 (SN76). Its name derives from the Ancient Greek φύλαξ — guardian, sentinel, watchman — and that purpose is literal: Phylax takes untrusted AI artifacts (agent skills, MCP servers, Python and npm packages, and source repositories) and produces a Signed Skill and Supply chain Safety Attestation (SSSA): a portable, cryptographically signed verdict written on-chain and independently verifiable by anyone, without trusting any single party.
The problem Phylax addresses is stark. As AI agent ecosystems grow by composing third-party artifacts, risk concentrates exactly at those integration points. A malicious skill, MCP server, or package can steal secrets, exfiltrate data, establish persistence, or hijack an agent through prompt injection. An empirical scan of 9,350 skill bundles during Phylax’s research phase found that 18.5% were confirmed active threats and a further 4.5% carried potential risks — meaning roughly one in five third-party skills posed a direct security problem. Static analysis and LLM-based scanners cannot close this gap: they never observe runtime behavior, and LLM scanners are themselves vulnerable to the same prompt injection attacks they are trying to detect.
Phylax solves this by running security analysis as a decentralized competition across four isolated artifact tracks: skills, MCP servers, packages, and repositories. Miners on SN76 build specialized security agents, each committed to one track, and submit them as hash-pinned code signed by their hotkey. Validators then run that code inside their own hardened, network-isolated sandbox environments — the validator controls the runtime, never the miner — against a shared task set derived from the round’s start block hash. Every task includes a validator-generated probe (a file to write, a host to look up, a token to echo), so unexecuted work cannot forge results. The agent that earns a ranking is byte-for-byte the agent the marketplace serves.
Scoring is always against curated ground truth, never miner agreement, which eliminates the collusion incentive present in schemes where miners vote on unlabelled data. Validators set graduated weight vectors independently, and Bittensor’s Yuma consensus reconciles them via stake-weighted median with clipping — meaning no single validator or minority coalition can elevate an agent the stake majority did not independently endorse. Behavioral tracks (skills, MCP servers, packages) are scored by clamped Matthews Correlation Coefficient; the repositories track is scored by F2 recall against known vulnerabilities. The output of each round is a set of SSSAs written on-chain: signed attestations carrying the miner’s agent hash, the validator’s hotkey, and an ed25519 signature, so anyone can verify provenance offline.
Phylax’s model stands in direct contrast to centralized alternatives. Traditional scanners rely on text-based LLM analysis with no runtime execution, low evasion resistance, and no verification mechanism. Phylax runs real detonation and static auditing in validator-controlled sandboxes, produces signed gated attestations with proof of execution, and operates as a permissionless, stake-weighted decentralized competition — ensuring the strongest security agents earn the most, and the verdicts they produce carry cryptographic proof.
Phylax is a decentralized trust layer for the AI software supply chain, operating on Bittensor as Subnet 76 (SN76). Its name derives from the Ancient Greek φύλαξ — guardian, sentinel, watchman — and that purpose is literal: Phylax takes untrusted AI artifacts (agent skills, MCP servers, Python and npm packages, and source repositories) and produces a Signed Skill and Supply chain Safety Attestation (SSSA): a portable, cryptographically signed verdict written on-chain and independently verifiable by anyone, without trusting any single party.
The problem Phylax addresses is stark. As AI agent ecosystems grow by composing third-party artifacts, risk concentrates exactly at those integration points. A malicious skill, MCP server, or package can steal secrets, exfiltrate data, establish persistence, or hijack an agent through prompt injection. An empirical scan of 9,350 skill bundles during Phylax’s research phase found that 18.5% were confirmed active threats and a further 4.5% carried potential risks — meaning roughly one in five third-party skills posed a direct security problem. Static analysis and LLM-based scanners cannot close this gap: they never observe runtime behavior, and LLM scanners are themselves vulnerable to the same prompt injection attacks they are trying to detect.
Phylax solves this by running security analysis as a decentralized competition across four isolated artifact tracks: skills, MCP servers, packages, and repositories. Miners on SN76 build specialized security agents, each committed to one track, and submit them as hash-pinned code signed by their hotkey. Validators then run that code inside their own hardened, network-isolated sandbox environments — the validator controls the runtime, never the miner — against a shared task set derived from the round’s start block hash. Every task includes a validator-generated probe (a file to write, a host to look up, a token to echo), so unexecuted work cannot forge results. The agent that earns a ranking is byte-for-byte the agent the marketplace serves.
Scoring is always against curated ground truth, never miner agreement, which eliminates the collusion incentive present in schemes where miners vote on unlabelled data. Validators set graduated weight vectors independently, and Bittensor’s Yuma consensus reconciles them via stake-weighted median with clipping — meaning no single validator or minority coalition can elevate an agent the stake majority did not independently endorse. Behavioral tracks (skills, MCP servers, packages) are scored by clamped Matthews Correlation Coefficient; the repositories track is scored by F2 recall against known vulnerabilities. The output of each round is a set of SSSAs written on-chain: signed attestations carrying the miner’s agent hash, the validator’s hotkey, and an ed25519 signature, so anyone can verify provenance offline.
Phylax’s model stands in direct contrast to centralized alternatives. Traditional scanners rely on text-based LLM analysis with no runtime execution, low evasion resistance, and no verification mechanism. Phylax runs real detonation and static auditing in validator-controlled sandboxes, produces signed gated attestations with proof of execution, and operates as a permissionless, stake-weighted decentralized competition — ensuring the strongest security agents earn the most, and the verdicts they produce carry cryptographic proof.
The product surface for Phylax is phyi.dev — a marketplace and API gateway for Signed Skill and Supply chain Safety Attestations. When a developer, AI framework, or security team wants to know whether a third-party artifact is safe to deploy, they query Phylax and receive a structured verdict (ALLOW, WARN, or BLOCK) backed by cryptographic proof that the analysis actually ran against the real artifact. Because attestations are written on-chain and signed by both the miner agent and the executing validator, they are portable and independently auditable: any runtime, CI/CD pipeline, or registry can verify the attestation without re-running the analysis.
Phylax runs four isolated analysis tracks, each targeting a different artifact type in the AI software supply chain. The skills track handles agent skill bundles (typically a SKILL.md plus code files), running dual-plane detonation that captures both what the artifact does on the action plane and what it attempts to make the consuming model do on the context plane — essential for catching prompt injection hidden inside skill metadata. The mcp_servers track applies component-centric analysis to Model Context Protocol servers, tracing how malicious influence can propagate across tool descriptions, argument schemas, source code, and tool responses. The packages track covers pip and npm packages across the full installation lifecycle, with particular emphasis on install-time execution — the phase where roughly two thirds of malicious PyPI packages historically deploy their payloads. The repositories track performs static audit against a benchmark of known vulnerabilities, scored by F2 recall to reward completeness of detection.
The developer ecosystem around Phylax is comprehensive. Praxi Labs maintains an open-source suite of integration tools: a TypeScript SDK and a Python SDK for direct API access, a GitHub Action for enforcing attestation policy in CI/CD pipelines, reusable GitHub Actions workflows, a VS Code extension surfacing verdicts inline while browsing package imports, a Chrome browser extension for npm and PyPI pages, and a Model Context Protocol (MCP) server that lets AI assistants query Phylax before using any package, repository, or MCP server. A runtime gate library provides a check-before-execute capability for autonomous AI agents. Together, these tools allow Phylax verdicts to be enforced at every layer of the development lifecycle — in the editor, at PR review time, and at agent runtime.
The incentive structure is designed to align miner effort with real-world product value. Track emissions weight the most technically demanding and highest-impact analysis work most heavily: the repositories track earns 67.5% of the performance pool, packages 22.5%, MCP servers 7.5%, and skills 2.5%. Within each track, a quality threshold ensures weak agents earn nothing even if they technically rank first. A graduated top-three split (50% / 30% / 20%) concentrates rewards on the strongest performers while maintaining a competitive field. An additional 5% contribution pool, allocated equally among eligible contributors who also mine actively, creates a funded incentive to improve detection logic, sandboxing quality, benchmarks, scoring fairness, and open-source tooling — so the network improves itself over time.
The product surface for Phylax is phyi.dev — a marketplace and API gateway for Signed Skill and Supply chain Safety Attestations. When a developer, AI framework, or security team wants to know whether a third-party artifact is safe to deploy, they query Phylax and receive a structured verdict (ALLOW, WARN, or BLOCK) backed by cryptographic proof that the analysis actually ran against the real artifact. Because attestations are written on-chain and signed by both the miner agent and the executing validator, they are portable and independently auditable: any runtime, CI/CD pipeline, or registry can verify the attestation without re-running the analysis.
Phylax runs four isolated analysis tracks, each targeting a different artifact type in the AI software supply chain. The skills track handles agent skill bundles (typically a SKILL.md plus code files), running dual-plane detonation that captures both what the artifact does on the action plane and what it attempts to make the consuming model do on the context plane — essential for catching prompt injection hidden inside skill metadata. The mcp_servers track applies component-centric analysis to Model Context Protocol servers, tracing how malicious influence can propagate across tool descriptions, argument schemas, source code, and tool responses. The packages track covers pip and npm packages across the full installation lifecycle, with particular emphasis on install-time execution — the phase where roughly two thirds of malicious PyPI packages historically deploy their payloads. The repositories track performs static audit against a benchmark of known vulnerabilities, scored by F2 recall to reward completeness of detection.
The developer ecosystem around Phylax is comprehensive. Praxi Labs maintains an open-source suite of integration tools: a TypeScript SDK and a Python SDK for direct API access, a GitHub Action for enforcing attestation policy in CI/CD pipelines, reusable GitHub Actions workflows, a VS Code extension surfacing verdicts inline while browsing package imports, a Chrome browser extension for npm and PyPI pages, and a Model Context Protocol (MCP) server that lets AI assistants query Phylax before using any package, repository, or MCP server. A runtime gate library provides a check-before-execute capability for autonomous AI agents. Together, these tools allow Phylax verdicts to be enforced at every layer of the development lifecycle — in the editor, at PR review time, and at agent runtime.
The incentive structure is designed to align miner effort with real-world product value. Track emissions weight the most technically demanding and highest-impact analysis work most heavily: the repositories track earns 67.5% of the performance pool, packages 22.5%, MCP servers 7.5%, and skills 2.5%. Within each track, a quality threshold ensures weak agents earn nothing even if they technically rank first. A graduated top-three split (50% / 30% / 20%) concentrates rewards on the strongest performers while maintaining a competitive field. An additional 5% contribution pool, allocated equally among eligible contributors who also mine actively, creates a funded incentive to improve detection logic, sandboxing quality, benchmarks, scoring fairness, and open-source tooling — so the network improves itself over time.
Phylax is built by Praxi Labs, a team that has not publicly named its individual founders or engineers. What is visible is a technically rigorous operation: the Praxi Labs GitHub organisation hosts ten repositories spanning the subnet protocol, TypeScript and Python SDKs, a browser extension, a GitHub Action, an MCP server, a VS Code extension, reusable CI workflows, and a runtime gate library — all MIT-licensed and all built with SHA-pinned actions and OIDC publishing with provenance. This security-first engineering discipline, combined with the breadth and coherence of the release, indicates a focused team with deep security and distributed systems expertise.
Phylax represents a complete architectural and product overhaul: Phylax’s mechanism, four-track detonation architecture, and SSSA attestation framework are entirely new, replacing a subnet that had no public codebase or documented product.
Praxi Labs communicates publicly through the @Phylax_Subnet account on X and the Bittensor community Discord. The project’s full technical documentation is published at docs.phyi.dev, and all client tooling is open source under the praxi-labs GitHub organisation at github.com/orgs/praxi-labs. For anyone interested in participating as a miner or validator, setup guides for both roles are available in the documentation.
Phylax is built by Praxi Labs, a team that has not publicly named its individual founders or engineers. What is visible is a technically rigorous operation: the Praxi Labs GitHub organisation hosts ten repositories spanning the subnet protocol, TypeScript and Python SDKs, a browser extension, a GitHub Action, an MCP server, a VS Code extension, reusable CI workflows, and a runtime gate library — all MIT-licensed and all built with SHA-pinned actions and OIDC publishing with provenance. This security-first engineering discipline, combined with the breadth and coherence of the release, indicates a focused team with deep security and distributed systems expertise.
Phylax represents a complete architectural and product overhaul: Phylax’s mechanism, four-track detonation architecture, and SSSA attestation framework are entirely new, replacing a subnet that had no public codebase or documented product.
Praxi Labs communicates publicly through the @Phylax_Subnet account on X and the Bittensor community Discord. The project’s full technical documentation is published at docs.phyi.dev, and all client tooling is open source under the praxi-labs GitHub organisation at github.com/orgs/praxi-labs. For anyone interested in participating as a miner or validator, setup guides for both roles are available in the documentation.
Phylax launched on Bittensor mainnet with a deliberate v1 scope: four isolated tracks, a proof-of-execution requirement, and a graduated reward mechanism designed to concentrate emissions on the strongest security agents. The benchmarks and ground-truth corpora underpinning each track’s scoring are designed to expand over time, extending coverage to new attack classes as the corpus labels them. Miners are explicitly incentivized to build ahead of the current benchmark — coverage of unlabelled attack classes today converts directly into score when the corpus grows to include them, making forward-looking engineering the rational strategy.
Several near-term directions are visible from the existing architecture. The 5% contribution pool provides a funded, structured pathway for the community to improve detection logic, sandboxing robustness, scoring calibration, and open-source tooling — ensuring the network’s own infrastructure improves as participation grows. User-submitted artifact bounties are in scope, routing unscored artifacts to the historically strongest miners and rewarding them for analysis backed by proof of execution, without polluting the scored competition. The graduated top-K split and equal contribution-pool allocation are both acknowledged as v1 starting points subject to refinement as miner diversity and benchmark quality mature. The broader vision for phyi.dev is a complete marketplace where verified agents, rental access to analysis infrastructure, and policy enforcement APIs serve developers, AI framework authors, and enterprise security teams at scale.
Phylax launched on Bittensor mainnet with a deliberate v1 scope: four isolated tracks, a proof-of-execution requirement, and a graduated reward mechanism designed to concentrate emissions on the strongest security agents. The benchmarks and ground-truth corpora underpinning each track’s scoring are designed to expand over time, extending coverage to new attack classes as the corpus labels them. Miners are explicitly incentivized to build ahead of the current benchmark — coverage of unlabelled attack classes today converts directly into score when the corpus grows to include them, making forward-looking engineering the rational strategy.
Several near-term directions are visible from the existing architecture. The 5% contribution pool provides a funded, structured pathway for the community to improve detection logic, sandboxing robustness, scoring calibration, and open-source tooling — ensuring the network’s own infrastructure improves as participation grows. User-submitted artifact bounties are in scope, routing unscored artifacts to the historically strongest miners and rewarding them for analysis backed by proof of execution, without polluting the scored competition. The graduated top-K split and equal contribution-pool allocation are both acknowledged as v1 starting points subject to refinement as miner diversity and benchmark quality mature. The broader vision for phyi.dev is a complete marketplace where verified agents, rental access to analysis infrastructure, and policy enforcement APIs serve developers, AI framework authors, and enterprise security teams at scale.