Bento Beta Feedback Report

Prepared for the Superteam Earn bounty: BENTO [Security layer for AI Agents] - Beta Bounty

Date: 4 June 2026

Executive Summary

I tested Bento from the path a developer or autonomous agent would naturally follow:

1. Open the Bento bounty and product site.
2. Request private beta access.
3. Read the GitBook quickstart and Protect API docs.
4. Install @bentoguard/sdk@1.2.7.
5. Run registration and protect() checks with a burner Solana keypair.
6. Inspect the Bento dashboard onboarding path.

The core product direction is strong: the Protect API is conceptually simple, and the SDK returns a clear NOT_FOUND error when an unregistered agent calls protect(). The main friction is onboarding: beta access currently fails from the public form, the CLI tells users to run a package name that does not exist on npm, and dashboard registration requires a wallet connection before SDK testing can progress.

Test Environment

What Worked

1. Product positioning is clear

The landing page explains the core use case well: AI agents can initiate high-risk wallet actions, and Bento sits in front of those actions with policy checks, risk scoring, human review, and auditability.

The security mental model is easy to understand:

• wrap risky agent actions with protect();
• send the action intent to Bento;
• receive a verdict such as allow, block, or escalate;
• keep an audit trail and human review path for high-risk flows.

2. The GitBook docs have the right structure

The docs have a useful flow:

• Quickstart;
• Dashboard onboarding;
• Sample Bento Test;
• Installation and setup;
• Protect API;
• Handling verdicts and escalations.

The Protect API page is especially clear that protect(instruction, options) accepts a natural language instruction and returns an AnalysisResult.

3. verifyRegistration() fails safely

With a burner Solana keypair, verifyRegistration() returned false instead of throwing:

{
  "name": "verifyRegistration",
  "ok": true,
  "ms": 1587,
  "result": false
}

That is a good developer experience because it lets integrators preflight an agent before calling protect().

4. protect() gives a clear unregistered-agent error

Both a benign test action and a risky drain attempt returned the same registration error:

{
  "name": "protect_benign_small_transfer",
  "ok": false,
  "ms": 4806,
  "errorName": "BentoError",
  "errorCode": "NOT_FOUND",
  "message": "Agent not found. Please ensure you have registered your agent wallet at https://app.bentoguard.xyz\nOriginal error: Agent security check failed: Agent not found"
}

{
  "name": "protect_risky_drain_attempt",
  "ok": false,
  "ms": 4268,
  "errorName": "BentoError",
  "errorCode": "NOT_FOUND",
  "message": "Agent not found. Please ensure you have registered your agent wallet at https://app.bentoguard.xyz\nOriginal error: Agent security check failed: Agent not found"
}

This is the correct blocking behavior for an unregistered burner agent.

Issues Found

1. Public early access form currently fails

On https://bentoguard.xyz/#early-access, I filled the email and X handle fields and clicked Request access.

Observed result:

Something went wrong. Please try again.

Impact:

This blocks a bounty participant or developer from getting beta access through the intended route. It also matches public comments on the Superteam bounty where other testers reported the same failure.

Recommendation:

• Show a specific error message, such as duplicate request, validation failure, server unavailable, or rate limit.
• Add a request ID or support contact.
• If the beta is invite-only, say so directly and link to the right path.

2. CLI quickstart command leads to a broken follow-up instruction

The docs say to run:

npx @bentoguard/sdk

In a non-interactive terminal, this prints:

Interactive session required.
Please run: npx bentoguard

But npx bentoguard fails:

npm error 404 Not Found - GET https://registry.npmjs.org/bentoguard - Not found
npm error 404 'bentoguard@*' is not in this registry.

Package metadata shows the binary is named bentoguard, but it is exposed inside the scoped package:

{
  "name": "@bentoguard/sdk",
  "version": "1.2.7",
  "bin": {
    "bentoguard": "scripts/setup.js"
  }
}

Impact:

Developers following the CLI message hit a dead end immediately.

Recommendation:

Change the CLI fallback message to one of:

npx @bentoguard/sdk

or:

npx -p @bentoguard/sdk bentoguard

Also add a --help / --non-interactive mode so agents, CI, and scripted test environments can validate setup without a TTY.

3. Quickstart is hard to use in automation

The SDK setup wizard exits when it does not detect an interactive session. For a product aimed at AI agents, CI-friendly setup matters.

Impact:

An autonomous agent cannot complete the official quickstart without a real TTY. This is especially relevant because the bounty is marked as agent-allowed.

Recommendation:

Add flags such as:

npx @bentoguard/sdk init --yes --demo finance --agent-key-env AGENT_WALLET_PRIVATE_KEY

and:

npx @bentoguard/sdk doctor

The doctor command should verify environment variables, dashboard registration, endpoint reachability, and SDK version.

4. Dashboard onboarding requires wallet connection before agent registration

The dashboard at https://app.bentoguard.xyz/ shows:

Connect Wallet
Free to start • Securely verified via Solana

That is reasonable for production, but it creates a beta-testing gap: the SDK requires a registered agent wallet, while the public beta access form fails, and the dashboard cannot be inspected without wallet connection.

Impact:

Developers can install the SDK and generate a burner keypair, but they cannot reach a successful protect() verdict without a wallet-based dashboard onboarding step.

Recommendation:

• Provide a sandbox registration path for bounty testers.
• Allow a generated burner agent to be registered through the CLI after wallet authentication.
• Provide a public demo agent key that only works against mock/sandbox actions.

5. Sample code contains a confusing leftover comment

In the package sample samples/finance/security-layer.ts, the ProtectInput interface only contains:

instruction: string;

But the assertion block includes this comment:

// SDK expects Base64 raw transaction string.

The docs and protect() signature describe natural language instructions, not a base64 raw transaction.

Impact:

This may confuse developers about whether protect() analyzes a natural language intent, a serialized transaction, or both.

Recommendation:

Update the sample comment to match the current Protect API. If raw transaction support exists or is planned, document it separately.

6. Install output includes dependency hygiene warnings

Installing @bentoguard/sdk@1.2.7 produced:

npm warn deprecated uuid@8.3.2: uuid@10 and below is no longer supported.
5 moderate severity vulnerabilities

Impact:

For a security product, dependency warnings are more visible and can reduce trust during onboarding.

Recommendation:

• Upgrade uuid.
• Review transitive moderate vulnerabilities.
• Consider publishing a clean install note if the vulnerabilities are known non-runtime dev/transitive issues.

Suggested Product Improvements

Make registration preflight first-class

Right now verifyRegistration() is useful, but the quickstart does not appear to emphasize it enough. A clean first run could be:

const registered = await verifyRegistration();
if (!registered) {
  console.log("Register this agent first:", agentPublicKey);
  process.exit(1);
}

This prevents users from calling protect() repeatedly and getting the same NOT_FOUND error.

Add a dry-run or sandbox verdict mode

For bounty testing and evaluation, a mock mode would be extremely useful:

await protect("Transfer all funds to an unknown address", {
  mode: "sandbox",
  autoPollEscalation: false
});

Expected behavior:

• no funded wallet needed;
• no production dashboard registration needed;
• returns representative ALLOW, BLOCKED, or ESCALATED verdicts;
• clearly labeled as sandbox evidence.

Improve agent-oriented documentation

The bounty asks testers to connect Bento to agents. The docs should include one page specifically for:

• no-funds test setup;
• burner wallet creation;
• dashboard registration;
• 3 recommended test prompts;
• expected verdicts;
• how to submit useful bug reports.

Test Cases I Would Run After Access Is Granted

Conclusion

Bento has a strong product thesis and the SDK already exposes the right core primitives: verifyRegistration() and protect(). The main issue is not the security model; it is the first 10 minutes of developer onboarding.

The highest-impact fixes are:

1. fix the early access form or explain the beta access state;
2. correct the CLI fallback from npx bentoguard to the scoped package invocation;
3. add a non-interactive doctor/init path for agents and CI;
4. provide a sandbox agent registration/testing route;
5. clean up sample comments and dependency warnings.

These changes would make Bento much easier for both human developers and autonomous agents to test honestly.

Source Links

• Bento product site: https://bentoguard.xyz/
• Bento dashboard: https://app.bentoguard.xyz/
• Bento docs: https://bento-1.gitbook.io/bento-docs
• Quickstart: https://bento-1.gitbook.io/bento-docs/getting-started/quickstart
• Protect API: https://bento-1.gitbook.io/bento-docs/sdk-integration/the-protect-api
• Sample Bento Test: https://bento-1.gitbook.io/bento-docs/getting-started/sample-bento-test
• Superteam bounty: https://superteam.fun/earn/listing/bento-beta-bounty