Phylax is a pre-install security layer for AI agent skills. Before a skill can touch a wallet, Phylax scans it and returns a deterministic verdict — ALLOW, WARN, or DENY — with a rule ID and human-readable proof for every finding. It turns "install and hope" into "audit, then install."
Read more
What HEY knows
Building
Dormant: no ship for 98 daysDormant: 0 meaningful events in 30 days; latest ship on 2026-07-12.Evidence →Source
Follow puts Phylax on your private watchlist; its changes then lead “Since you were last here” when you come back. Following needs an account; browsing never does.
Counted from the chain. Usage says the contracts are used, not that anyone is building.
Contracts
Fact1 contract on record for code changes, 1 with verified source; no implementation or interface change recorded.
Token market · context
Trading inactiveToken verified
Not yet known
Unknown3 gaps: Official docs (no source), API description (no source), Contract activity (partly measured). HEY read its website and found no link to docs.
“Dormant” by the activity rule: 0 meaningful events in the last 30 days, the newest 2026-07-12.
SourceRepositories, changelogs and feeds HEY reads for this project, and the ship events recorded from them.ReadRecordsCode changes, week of 2026-07-06 – 2026-07-12 · at least 15 commitsv0.1.0 — Phylax public launchWhat HEY derivedHEY’s activity rule reads the counted events as “Dormant”.Not concludedIt says what HEY can read of the building, not how good the project is, who is behind it, or what its token will do. Quiet or unknown is not "abandoned".
Verified Builder.
The quality gate found verified building evidence from the project's own sources.
Token verified: the project's own site, a deploy record in its own repository, or an on-chain signature names this contract.
SourceThe project's own published sources and HEY's check of the contract.ReadWhat HEY derivedToken verified: the project’s own site names it.Not concludedIt says whether the project itself names this contract. It is not a safety check, and a token is not the project.
Trading inactive.
Trading inactive: the only pool is the launch pool holding the token’s own supply, and nothing traded in it in the last day.
Source4 readings from HEY's own market tables.ReadWhat HEY derivedHEY’s market rule reads this token’s market as “Trading inactive”.Not concludedMarket status is context only. It never changes activity status or Build Momentum, and it is not a view on the price.
Market figures are context only and never change activity status. Methodology
This week HEY looked inside 1 of 15 commits to see what changed: 1 changed code. One code change is enough for the week to count, so HEY stopped there.
Record ship:ae8a62e4… · HEY counts it as building; it does not judge the release’s quality or what it means for the token.
No meaningful, source-backed updates in the 7 weeks since HEY began reading this project’s sources; earlier weeks are not yet read.
Questions HEY can answer about Phylax — as of 2026-10-18
Is Phylax still being built?
DerivedDormant: 0 meaningful events in 30 days; latest ship on 2026-07-12.Evidence →
What did Phylax ship last?
FactCode changes, week of 2026-07-06 – 2026-07-12 · at least 15 commits — Code activity, on 2026-07-12.Evidence →
Is 0xff36bcB3cB9e3e2dac718ccaec3Bc5Ed489D9f0d Phylax’s own contract?
FactToken verified: The project’s own site names this contract.Details →
What does HEY not know about Phylax?
Unknown3 gaps: Official docs (no source), API description (no source), Contract activity (partly measured). HEY read its website and found no link to docs.Details →
Build timeline
v0.1.0 — Phylax public launch
GitHub release · Source verified
First public release of Phylax — a pre-install security audit for agent skills on Base (chain 8453). Phylax scans a skill before you install it and returns a deterministic ALLOW / WARN / DENY verdict with line-level evidence. What it does · Static scan — prompt-injection…Show allShow less
First public release of Phylax — a pre-install security audit for agent skills on Base (chain 8453). Phylax scans a skill before you install it and returns a deterministic ALLOW / WARN / DENY verdict with line-level evidence. What it does
Static scan — prompt-injection, secret-exfiltration, and obfuscation in SKILL.md + manifest
Code changes, week of 2026-07-06 – 2026-07-12 · at least 15 commits · Code activity · in the week of 6 Jul (week precision)
Observed before (29 Jun–5 Jul) and Observed after (13–19 Jul): Code changes, week of 2026-07-06 – 2026-07-12 · at least 15 commits
Measure
Observed before29 Jun–5 Jul
Observed after13–19 Jul
Volume per dayprovider archive
—Not measured: HEY began reading this market’s price, liquidity and volume on 2026-07-12, during this ship’s week
$95.7/day5 of 7 days
Volume before 3 Sep come from GeckoTerminal’s daily candles (provider archive, read 2 Oct), not from HEY’s own readings; HEY’s own readings start 3 Sep. The archive holds no liquidity or valuation.
Not shown: Price and valuation: the market is not live · Liquidity: HEY began reading this market’s price, liquidity and volume on 2026-09-03, after this ship · Usage: HEY began counting this project’s calls on 2026-09-26, after this ship
Observed around the same time — HEY does not claim this event caused it.
Market context and product usage, placed by time. Seven days either side; the day in progress is never compared. Open evidence · As data