Know what is actually critical
Map contracts, wallets, Safes, chains, dependencies, owners, and emergency controls into one verified registry.
Operational readiness for onchain teams.
We turn the monitoring you already have into a tested response system: owned assets, routed alerts, current runbooks, and documented decisions.
Fixed scope, paid upfront, and built to work with the monitoring, Safe, and webhook tools you already run.
82Readiness
14/16Assets owned
3Runbooks tested
1Routing gap
Normalized alert inbox
Example
!
Withdrawal velocity above baselineVault ETH-USDC / Tenderly / severity high
✓
Safe owner route verifiedTreasury Safe / contact test completed
✓
Oracle fallback exercise closedRunbook v1.4 / evidence package saved
Active runbook
Review1
Validate indexed event against independent RPC.
2
Notify the named protocol and security owners.
3
Record facts, authority, and next decision.
Keep your detection tools. Fix the operating layer around them.
Examples of client-side tools.
Tenderly
OpenZeppelin
Safe
Webhooks
Before the alert
The 3am problem starts before 3am.
When a high-severity alert fires, nobody should be guessing which asset is affected, who has authority, or where the current runbook lives. The sprint fixes those operating questions before the pressure arrives.
See what the sprint testsAlert ownership timelineExercise
Withdrawal velocity alert receivedOriginal payload and independent evidence linked
Primary protocol owner acknowledgedBackup route remains visible and timed
Decision record openedFacts, unknowns, authority, and next review captured
The operating gap
Monitoring only matters when somebody owns the next action.
Most lean teams do not need another generic security dashboard. They need an accurate inventory, reliable routing, current runbooks, tested authority, and evidence that those pieces work together.
Route alerts to named humans
Review coverage, normalize alert sources, remove dead ends, verify contacts, and document primary and backup ownership.
Practice the decisions before pressure
Write protocol-specific runbooks, run a tabletop or routing test, capture the evidence, and leave a prioritized remediation backlog.
14-day readiness sprint
A fixed engagement with a concrete finish line.
Every sprint produces client-owned operational artifacts and a clear managed-service decision. It is not an open-ended security retainer disguised as discovery.
Map ownership
Kickoff, asset registry, dependencies, emergency authority, contacts.
Review coverage
Monitoring sources, routing paths, severity logic, and visible gaps.
Build and test
Three runbooks plus one facilitated tabletop or alert-routing exercise.
Close the loop
Remediation, evidence package, final report, and executive readout.
One operational control plane
Two products for teams moving value onchain.
Protocol Readiness
Operational implementation for protocols with existing security and monitoring tools but no dedicated readiness function.
- Verified assets and ownership
- Coverage and escalation matrix
- Three protocol-specific runbooks
- Tabletop test and evidence package
Agent Payment Evidence
A provider-neutral policy and evidence layer that makes wallet and x402 payment decisions portable, explainable, and replayable.
- Versioned policy and request schemas
- Deterministic reference decisions
- Replayable RFC 8785 evidence
- x402 and Safe request normalizers
Operating model
AI-native. Founder-operated.
Onchain On-Call is operated by Matt Brandenburg. AI agents handle repeatable intake, evidence organization, structured analysis, document production, and routine support. Matt remains accountable for scope, client communication, and final deliverables.
See how the system is operatedOperatorMatt Brandenburg
AI roleAnalysis, documentation, and support operations
Client roleProduction authority and technical approval
Clear boundaries
Useful operational work without inflated security claims.
The initial offer is readiness implementation. Scope expands only through a signed statement of work and qualified operating coverage.
We implementInventories, routing, runbooks, exercises, reports, and evidence.
We integrateExisting monitors, Safe activity, notifications, and signed webhooks.
We do not custodyNo private keys, transaction signing, or unilateral protocol control.
We do not overpromiseNo audit replacement, guaranteed detection, recovery, or implied 24/7 coverage.
Commercial model
Start with a sprint. Continue only if the work earns it.
Two founding engagements are offered at a temporary launch rate. In return, we ask for structured feedback and permission to publish an anonymized outcome summary.
Founding-client readiness sprintFirst two qualified protocols, paid upfront
$3,500Standard readiness sprintFixed 14-day scope after founding engagements
$6,500Managed readiness operationsConditional follow-on after operator and coverage qualification
$4,500/moAgent payment evidence workshopPolicy model, replay test, provider mapping, and gap list
$3,500