> For the complete documentation index, see [llms.txt](https://whitepaper.gopluslabs.io/goplus-network/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://whitepaper.gopluslabs.io/goplus-network/architecture/architecture-overview.md). # Architecture Overview

Architecture Overview

GoPlus Security Network is the open and verifiable infrastructure behind the GoPlus security layer for the AI era. It serves two directions: AI for Security, where AI is applied to auditing, scanning, detection, and simulation, and Security for AI, where security is applied to autonomous AI systems. It provides the risk intelligence, verified security data, distributed security compute, runtime protection, and economic coordination needed to protect AI agents, Web3 users, applications, wallets, chains, and security developers. The network started with Web3 user security, where GoPlus built real-time risk intelligence, transaction protection, malicious asset detection, and on-chain security infrastructure across multiple chains. As AI agents become a new execution environment, the same security layer expands to protect runtime behavior, tool calls, command execution, credential access, URL interaction, software supply chains, and agent-to-Web3 workflows. As the consumers of security expand from humans to machines, $GPS provides the settlement unit that connects that consumption to the network producing it. ### Core Architecture The GoPlus Security Layer is organized around four connected infrastructure layers and one economic layer: * **Security Intelligence** * **Runtime Protection** * **Security Data Layer** * **Security Compute Layer** * **Security Service Settlement ($GPS)** Together, these layers create a system that can understand risk, enforce policy before execution, continuously improve through verified security data and distributed analysis, and pay the producers of security from the consumption they serve. #### Security Intelligence Security Intelligence is the risk engine behind GoPlus products. It evaluates assets, addresses, URLs, signatures, approvals, transactions, dApps, packages, skills, commands, prompts, and agent actions. This layer includes token security analysis, malicious address detection, phishing site detection, transaction simulation, approval and signature analysis, dApp security information, prompt-injection detection, credential leak detection, malicious command detection, URL analysis, package risk analysis, and supply-chain risk detection. Security Intelligence produces structured risk signals consumed by Axora, SafuSkill, DeepScan, GoPlus Web3 Security, SafeToken-related workflows, wallets, applications, and third-party integrations. It is delivered to developers through the Token Security Service and related APIs, and to autonomous systems through the AI Agent Security API. #### Runtime Protection Runtime Protection applies security decisions before risky actions execute. For AI agents, Runtime Protection is represented by Axora. Axora Router governs the information flowing between applications, models, and tools; Axora AgentGuard evaluates shell commands, file access, tool calls, URLs, package content, sensitive operations, and agent-to-Web3 actions before they run; Axora Arena verifies that both hold up under attack. Axora can allow, block, warn, or require approval based on policy and risk analysis. For Web3, Runtime Protection is represented by Security RPC, on-chain firewall, browser extension, GoPlus App, wallet integrations, dApp integrations, and other infrastructure integrations. These components analyze signatures, approvals, transactions, tokens, dApps, and addresses before users or agents submit high-risk on-chain actions. #### Security Data Layer The Security Data Layer collects, verifies, and distributes security data through open contribution and validation mechanisms. It supports malicious address data, phishing data, token risk data, dApp data, transaction risk data, signature risk data, agent threat data, malicious skill and package data, URL risk data, and other security intelligence inputs. This data layer is critical because risk detection is only as strong as the security data behind it. Contributors stake $GPS to participate and earn $GPS when contributed data is verified, which aligns the supply of security data with the network that consumes it. #### Security Compute Layer The Security Compute Layer is the distributed network of operators that performs security analysis for the network, including AVS operators and SecHub participants. It provides the analysis capacity behind scanning, simulation, audit, and verification workloads as security-service consumption grows from human-initiated activity to high-frequency machine-originated requests. Operators stake $GPS to provide capacity and are rewarded in $GPS from the settlement generated by the services they process. This is the supply side of the security service economy. #### Security Service Settlement ($GPS) $GPS runs across all of the layers above. Security services consumed through Security Intelligence and Runtime Protection are metered and settled in $GPS, and that settlement funds the rewards paid to Security Data Layer contributors and Security Compute Layer operators. GoPlus Network Governance, also coordinated through $GPS, sets the parameters of this economy. See [$GPS: The Security Service Settlement Layer](/goplus-network/usdgps/gps-security-service-economy.md). ### Product and Integration Components #### Axora Axora is the AI agent security product line of GoPlus, made up of Axora Router, Axora AgentGuard, and Axora Arena. It protects agent information flows and actions before they execute, including commands, file operations, URLs, tool calls, package scans, approval flows, transaction workflows, red-team testing, and audit timelines. #### GoPlus Intelligence and AI Agent Security API GoPlus Intelligence is the shared risk engine used across the GoPlus security layer. It powers token analysis, malicious address detection, phishing detection, transaction simulation, signature analysis, approval analysis, dApp risk information, and agent-oriented risk detection. The AI Agent Security API exposes it to autonomous systems through a usage-based, machine-to-machine model. #### Web3 Security Products GoPlus Web3 Security includes GoPlus SafuSkill, GoPlus DeepScan, SafeToken Protocol and Locker, transaction protection, Security RPC, on-chain firewall, GoPlus App, browser extension, GoPredict, and infrastructure integrations. These products protect the software agents install, token launch, contract audit and monitoring, wallet activity, user transactions, dApp interaction, and chain-level execution paths. #### Ecosystem and Governance GoPlus Security Network is supported by users, developers, data contributors, compute operators, security service providers, governance participants, and ecosystem partners. This ecosystem gives GoPlus a broad distribution path across chains, wallets, exchanges, DeFi protocols, launchpads, trading tools, data platforms, RPC providers, agent platforms, security partners, and infrastructure providers. ### Conclusion GoPlus Security Network is evolving from a Web3 user security network into a broader security infrastructure for AI agents and Web3. By combining security intelligence, runtime protection, a verified security data layer, a distributed security compute layer, and $GPS settlement, GoPlus provides a scalable foundation for protecting high-risk digital actions before they execute, and for paying the producers of that protection from the consumption it serves.