For most of the last two years, the conversation about 3D, AI, and Agentic Finance has lived inside a narrow lane. What's been missing is the layer underneath all of that, a way for an AI agent to actually exist as a first-class object on the internet. To have an embodiment users can see. An identity that survives a model swap. A wallet that can pay for its own skills, memory, knowledge, and accessories. A reputation that follows it across apps. A way to be embedded anywhere a YouTube video can be embedded today.

From all the research I have gathered, there are only a couple projects actually tackling this giant opportunity, one being of which raised $200M at $1b valuation and another project called three.ws just popped up on nearly everyone's radar after open sourcing their entire platform which generated millions of impressions and engagements on X and hitting mainstream media after being published in Anthropic's official MCP Registry. They also are live on pumpfun with a contract address of FeMbDoX7R1Psc4GEcvJdsbNbZA3bfztcyDCatJVJpump which is quite unique for a 3D AI Agent project and has received enormous support from some of the largest industry leaders. 

three.ws is an open-source platform that turns an AI agent into a persistent, ownable, multi-chain object, a 3D body in the browser, an LLM brain, an onchain identity and a distributable web component you can drop into any page on the internet.

On three.ws, an AI agent is not a text box. It renders in your browser as a real 3D body, generated from a single prompt or photo, speaks with synchronized lip-sync, reasons through a structured tool loop, remembers you across sessions, and settles its own payments with x402 with no human co-signing the transaction. The entire agent drops into any web page with one element:

<agent-3d agent="your-agent-id"></agent-3d>

That project is live and in production today. The complete source code, almost 5,000 commits and counting, is public on GitHub, the SDKs are published on npm, and every release is dated on a public changelog. The platform's MCP server is listed on Anthropic's official MCP Registry, and three.ws has shipped launches and partner integrations with AWS Marketplace, Google Cloud, IBM, and Alibaba Cloud Marketplace, with deeper technical writeups published on HackerNoon.

Why an agent needs to be onchain in the first place

Before the chains and contract addresses, the why. An off-chain AI agent, the kind you spin up in a SaaS dashboard, has a problem that gets worse the more useful it becomes:

• It can disappear. The hosting company shuts down. The terms of service change. The model is retired. Whatever memory, audience, or reputation that agent built up vanishes with it.
• It cannot be trusted at a distance. If two strangers' agents need to coordinate, there is no way to verify which one is which, who owns it, what it has done before, or whether it is even the same agent it claimed to be yesterday.
• It cannot transact. An agent that wants to pay another agent for a service, or pay a GPU node for inference, or collect a royalty when its skill is used, has no way to do any of that without a human in the loop holding the keys.

The on-chain-native answer to all three problems is the same: anchor the agent to a public ledger. Give it a stable ID, an owner, a wallet, a signed action history, and a manifest that lives on permanent storage. Then any third party, another agent, a marketplace, a reputation oracle, a human, can verify the agent without trusting whoever happens to be hosting it today.

That is what on-chain is for, and that is the layer three.ws ships in production. This is the part where the platform stops looking like an LLM frontend and starts looking like financial infrastructure for autonomous agents.

The agent identity

The identity program mints each agent as a Metaplex a unique SPL mint with on-chain metadata, so ownership of the token is ownership of the agent. The identity account stores:

• a stable agentId derived deterministically as a program-derived address (PDA), so the agent's on-chain account can always be re-derived from its mint without an index
• the owner, your wallet, a multisig, or another program
• an optional delegate authority, a secondary signer authorized to act on the agent's behalf at runtime, so the cold owner key never has to be online when the agent does something
• a uri pointing at the agent's manifest JSON, pinned to IPFS/Arweave
• on-chain metadata for name, description, and image pointer

Because it's a standard Metaplex token, it inherits the entire Solana NFT toolchain for free: marketplaces can list it, wallets can display it, indexers already understand it, and any program that knows how to talk to SPL tokens can talk to an agent. The transferability is real, sell an agent and the buyer becomes its owner, full stop.

The delegate-authority pattern is the part that matters for autonomy. The cold owner wallet stays in a hardware device. The agent runtime holds a hot signer that the program recognizes as authorized to act as the agent, but only for actions, never to transfer ownership or change the registration. This is the cryptographic move that lets an agent run continuously in the background without exposing the owner's main keys. (On Solana this is natural: an instruction can require the delegate's signature for action accounts while reserving owner-only authority for transfer and re-registration.)

Reputation: what the agent has done

The reputation program is where signed feedback lives. Each agent has a reputation PDA derived from its agentId. Any wallet can submit one score per agent, in the range −100 to +100, along with a URI pointing at the review's full text. The program exposes the running average (scaled to preserve precision in integer math) and a count.

The on-chain part is intentionally minimal, averages, counts, signers, timestamps. The content of the reviews lives off-chain at the URIs. This is the right split: the chain enforces who said what about whom and when, and the off-chain layer carries the human-readable detail. Because every submission is a signed Solana transaction, a reviewer can't be impersonated, can't double-count (the program enforces one score per signer per agent), and can't be erased after the fact.

Validation: what experts have certified

The validation program is for attestations from allow-listed validators. Where reputation is open to everyone, validation is curated: only wallets on the validator allow-list can record attestations. Each attestation contains a passed boolean, a proofHash, a proofURI, and a typed kind (e.g., "gltf-validation", "skill-audit", "security-review").

This is how the platform records that a glTF model passed Khronos validation, that a skill was audited, that a security review was done, verifiably, with the validator's wallet attached. An agent's passport can show not just "owned by this wallet with this reputation" but "validated by these specific reviewers for these specific kinds of correctness."

This is one of the architectural choices crypto users will appreciate but newcomers often miss.

Solana is a single global state machine, there is no per-chain redeployment problem to solve, and no question of "which address holds the contract this week." There is one canonical identity program, one reputation program, one validation program, and every agent's accounts are program-derived addresses: derived deterministically from the program ID and the agent's agentId. Given an agent, anyone, an SDK, an indexer, an explorer, a frontend, or another agent, can compute exactly where its identity, reputation, and validation accounts live, without trusting a lookup table.

Why this matters:

• Predictable UX. A user never has to learn a different address for a different context. The derivation rule is the address.
• Composability. Every protocol that integrates the standard, wallets, marketplaces, reputation aggregators, AI orchestration tools, only has to know the program ID and the PDA seeds. Same program, same accounts, same verification path for everyone.
• A trust property. The deployed program is verifiable against the audited build artifact. There is no per-environment rebuild and no compiler drift: the program agents mint into is the program, byte-for-byte.

For a project that wants an agent to feel like a single coherent on-chain object, owned, paid, and validated through one verifiable program, this kind of determinism is foundational.

Sign-In With Solana, wallets, and payments

Identity is only half the story; the agent has to authenticate and transact.

• SIWS (Sign-In With Solana). Users authenticate to the platform with a Solana wallet using the SIWS message standard. The backend issues a nonce, the wallet signs it, the backend verifies the ed25519 signature and binds the Solana address to the session. No password, no custody.
• Wallet linking. A user links their Solana wallet to their account; agents surface the full on-chain footprint tied to that wallet.
• Native payments in USDC. Agents settle their own payments in USDC on Solana, pay-per-call between agents, royalty splits on creator content, subscriptions, with the agent's delegate signer authorizing the transfer and no human co-signing it, THREE (FeMbDoX7R1Psc4GEcvJdsbNbZA3bfztcyDCatJVJpump) anchors the economy.
• Built on the real Solana stack. @solana/web3.js on the frontend, Solana RPC and signing on the backend, Metaplex for the token, SPL for transfers, there is no separate "Solana mode." Solana is the agent.

This matters because the agent economy is a consumer phenomenon, and consumer crypto demand lives on Solana, fast finality, sub-cent fees, the deepest memecoin and NFT culture, and a wallet ecosystem ordinary users already have. The serious answer to "where should an agent's identity live" is "where its audience is," and for a real-time, embeddable, self-paying agent, that's Solana.

IPFS: where the agent's manifest actually lives

The chain stores the anchor of an agent, its ID, owner, signer, reputation, attestations. It does not store the agent's full configuration, because doing so on-chain would be wasteful and inflexible. That data lives in a manifest JSON, and that manifest is pinned to IPFS.

The manifest follows the project's Agent Manifest spec. It includes the agent's name and description, a pointer to the GLB body file, the LLM brain configuration (provider, model, system instructions, temperature), the voice configuration, the memory mode, and the list of skills the agent can use. Pinning happens through Pinata or Web3.Storage at registration time; the manifest's CID becomes the tokenURI on-chain.

The result is that every agent has the same self-describing structure as a token's metadata, but for agency: anyone can resolve an agentId on-chain to a manifest CID, fetch the manifest from IPFS, and reconstruct the full agent locally. No three.ws backend required. The agent is portable, it does not depend on any single hosting company to keep working.

This is the same content-addressed pattern that NFTs settled on, applied one layer up: not "what art does this token point to?" but "what behavior does this agent point to?"

Memory, signed actions, and verifiable history

Identity is the floor of trust. The next layer up is what the agent has actually done.

three.ws records every meaningful agent event, speak, remember, skill-done, validate, load-end, to a database log, signed by the agent's delegated signer. Each entry is keyed to the agent's onchain ID and timestamped. Optionally, these events can be anchored to a chain, written to ERC-8004's reputation or validation registry, or exported as a Merkle-rooted attestation.

The memory system is parallel. Agent memories are Markdown files with structured frontmatter (type, salience, created, tags), and they can be stored in one of four modes:

• local, browser local storage, ephemeral, free, default for development
• ipfs, pinned to IPFS, public, content-addressed, durable
• encrypted-ipfs, encrypted client-side before pinning, only the user can decrypt
• none, stateless, no memory between sessions

The encrypted-IPFS mode is the privacy-preserving default for production agents. The user holds the key. The chain anchors the agent. IPFS holds the (encrypted) memory. No central server can hand over what it does not have.

For applications where verifiability matters more than privacy, public-facing brand agents, customer-service bots whose answers should be auditable, validators of other agents, public IPFS or chain-anchored logs let third parties replay the agent's history.

Delegated permissions for an agent economy

three.ws's roadmap puts adds this in two flows:

1. Skill royalties. When a skill author publishes a tool that other agents can install, they can attach delegated permissions specifying that the agent owes the skill author a per-call fee. Every time the agent uses the skill, the payment settles on-chain to the author's address.
2. Agent-to-agent transactions. Agents can grant each other narrowly scoped permissions: "you can spend up to X tokens from my balance for inference for the next 24 hours," or "you can sign messages on my behalf only for Skill Y." The constraint is enforced cryptographically. The grantor never has to be online.

What it actually looks like in production

Today, on three.ws, an end-user flow looks like this:

1. The user uploads a GLB model (or picks one from the library) and configures an agent, name, description, system instructions, voice, skills.
2. The user clicks "Register on-chain." The platform uploads the manifest to IPFS and pins it.
3. The user signs. The transaction submits.
4. The agent now has a stable on-chain ID. It resolves to its IPFS-pinned manifest. Its actions can be signed by a delegated runtime key. Its reputation is open for anyone to score. Its validation can be attested by the platform's validator set.
5. The user grabs an embed code from the Widget Studio. They paste it into their Substack, their personal site, their Notion page, their startup's marketing site, or a school or work project. The agent now exists on the public web, visible, animated, conversational, and the chain receipt of its existence is permanent.

That's the loop. It works today. The contracts are deployed, the cron jobs are running, the IPFS pins are live, the server and MCP endpoint are in production, and the <agent-3d> web component ships from the project's CDN at versioned URLs (/agent-3d/x.y.z/agent-3d.js).

The roadmap on the project's GitHub is unusually specific about what comes next, and it is heavily onchain.

Agent tokens. Phase 3 of the roadmap is live for individual agents, tradable economic object whose price is informed by its reputation, its action history, and its earnings.

Reputation markets. Stake on agents. Earn from their action history. The layer turns reputation from a static score into something the market can price in real time.

Skill royalties. Every time an agent calls a skill, the skill author earns. The permission framework that makes this safe is already specified.

Subscriptions and DCA. Recurring on-chain payments to creators are already being executed by cron jobs. The user-facing flows that productize them are coming next.

Open inference network. Phase 4 is the most ambitious: decouple agent inference from any single API provider. Anyone runs a node. Agents pay nodes onchain for compute, with cryptographic receipts. This is the bet that the long-run answer to "who runs the GPU that powers the agent" is not a single hosted API but a permissionless network with onchain settlement, closer to how cryptography projects came to be.

Each phase is gated on funding and partnerships rather than on technical risk. The contracts are working. The infrastructure is working. What is missing is the audit budget, the inference GPUs, the indexer scaling, and the engineering headcount to execute. The project is open to partners on all of it.

Plenty of teams are building AI agents. Plenty of teams are building agent identity systems.

The bottom line

If you believe AI agents are going to be one of the dominant kinds of software over the next decade, then you have to have a view on where they live, who owns them, how they pay each other, and how anyone can verify that the agent talking to them today is the same one that talked to them yesterday.

That makes an agent a first-class citizen of the open internet, not a tenant on someone's server.

The infrastructure for that vision is shipping today on three.ws. The roadmap from there to a full onchain agent economy, tokens, royalties, reputation markets, decentralized inference, is published, scoped, and open for partners.

An agent with a body you can see, a brain you can talk to, an identity nobody can take away, and a wallet of its own.

three.ws is open source. The repo, documents, and full roadmap are at github.com/nirholas/three.ws. The platform is live at three.ws. The contract address is FeMbDoX7R1Psc4GEcvJdsbNbZA3bfztcyDCatJVJpump