Add Pulse Verify connector — pre-execution verification data via x402

[GTCC777]

Adds a third-party connector plugin in the same shape as the Privy/MoonPay/Robinhood connectors: yield-xyz-agentkit-pulse-verify, a read-only verification layer that runs between yield discovery and actions_enter.

What it does: before an agent builds an enter transaction, it can fetch deterministic verification data about the venue from Pulse Network's x402 endpoints — token safety scans (EVM/Solana/Algorand, $0.015), holder concentration and exit-depth ($0.02), an independent on-chain read of Base USDC vault/lending APYs ($0.02) to second-source aggregator rates, and an optional one-call due-diligence report ($0.35). All pay-per-call in USDC via x402 (no API key, no signup) — a natural fit alongside AgentKit's own x402 support.

Design notes, mirroring the existing connectors:

• Builds on yield-xyz-agentkit (declared dependency); never touches unsignedTransaction, never signs, never executes.
• Facts-only framing throughout: the skill instructs agents to report scan verdicts and numbers to the user, never to advise or auto-block.
• .claude-plugin + .codex-plugin manifests, SKILL.md + references, and a marketplace.json entry — same layout as yield-xyz-agentkit-moonpay.

Endpoints are live and the params in references/endpoints.md are taken from the endpoints' own x402 discovery metadata. Happy to adjust anything to fit house style.

🤖 Generated with Claude Code

---

Note

Low Risk
Adds documentation and agent skill guidance only; no changes to signing, transaction building, or core AgentKit runtime code.

Overview
Adds yield-xyz-agentkit-pulse-verify, a new connector plugin in the same layout as Privy/MoonPay/Robinhood: Claude/Codex manifests, marketplace entry, and a skill that sits between yield discovery and actions_enter.

The skill documents read-only Pulse Network checks paid per call via x402 (token safety, holder concentration, exit depth, on-chain Base USDC APY cross-check, optional full due-diligence report). Agent instructions emphasize facts-only output, quoting batch costs upfront, and never touching or modifying unsignedTransaction.

marketplace.json also picks up formatting-only changes (expanded JSON structure / em-dash encoding) across existing plugin entries.

^{Reviewed by Cursor Bugbot for commit 75db333. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 3 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want fixes drafted automatically? Bugbot Autofix can create code changes for findings. A team admin can enable Autofix in the Cursor dashboard.

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 75db333. Configure here.}

[cursor]

Step 3 table scope mismatch

Medium Severity

The "When to run which check" table misapplies Step 3 to non-Base-USDC yields. As Step 3 is solely for Base USDC APY checks, this can lead to agents making irrelevant paid calls or missing appropriate token scans for other yield types.

 

^{Reviewed by Cursor Bugbot for commit 75db333. Configure here.}

[cursor]

Step 1 omits Yield fields

Medium Severity

Step 1 tells agents to read a “deposit token” and “reward/receipt token” from yields_get, but the Yield yield object uses inputTokens, outputToken, token/tokens, and providerId. Without those keys, agents may scan the wrong contract or skip the token that actually needs verification.

 

^{Reviewed by Cursor Bugbot for commit 75db333. Configure here.}

[cursor]

Step one omits addresses

Medium Severity

Step 1 says to collect deposit and reward tokens from yields_get, but Pulse scans require contract addresses (address, mint, asset). The base skill list items expose tokenSymbol, not addresses, so the connector never explains how to map YieldDto/inputTokens[] fields to the Step 2 query parameters.

 

^{Reviewed by Cursor Bugbot for commit 75db333. Configure here.}

[GTCC777]

Thanks — all three addressed in c95b101:

• Step 1 now maps the actual Yield fields (token / inputTokens[] / outputToken, providerId) to scan parameters, notes that list items carry only tokenSymbol so agents must call yields_get for the full token objects with address fields, and says to skip native assets that have no address.
• Step 3 is now explicitly scoped to Base USDC lending/vaults only.
• The when-to-run table reflects that scope (Step 3 only appears for Base USDC products).