Start here
Product status
What is built, what is switched off and what comes next, with no rounding up.
- Stage
- Testnet
- Mainnet
- Not configured
- SDK and MCP
- Preview
- Sealed trade
- Switched off
Where things live#
| Surface | Where | What it is for |
|---|---|---|
| Website | umbr.trade | What UMBR is, the whitepaper, legal pages |
| Docs | /docs | Concepts, guides, the SDK and agent setup |
| App | /app | Vault, payroll, proofs and settings, in the browser |
| SDK | @umbr/sdk | The same features from TypeScript, for apps, servers and agents |
| MCP server | umbr-mcp | Tools an AI agent can call, with spending limits |
| Verifier | /verify | Anyone can check a proof someone gave them |
All of them talk to the same shielded pool contracts on the same chains. Proofs are always made on the user's own device or server, never by an UMBR backend.
Status by feature#
Live means usable today, on testnet where it touches funds. Preview means designed and documented but not released. Off means built or possible, and deliberately not enabled.
| Feature | Status | Notes |
|---|---|---|
| Shield and unshield | Testnet | On each testnet whose pool is configured. |
| Private send to an UMBR address | Testnet | Optional memo, encrypted for the receiver. |
| Claim links | Testnet | Create, claim and revoke. |
| Payroll runs | Testnet | Pasted list or CSV; one private payment per line. |
| Scheduled payroll | Preview | In the SDK preview; the app runs payroll on demand. |
| Proofs (four kinds) | Testnet | Audience and 1, 7 or 30 day expiry. |
| Proof checking at /verify | Live | No account or wallet needed. |
| Gas relayer | Testnet | Optional; you can always submit from your own wallet. |
| Key backup and restore | Live | From Settings in the app. |
| Demo mode | Live | ?demo=1; nothing is signed or sent. |
| Sealed trade | Switched off | Built, not enabled. See Sealed trade. |
| @umbr/sdk | Preview | Documented, not on npm yet; API may change. |
| umbr-mcp server | Preview | Runs locally over stdio; not on npm yet. |
| Agent funding with Assay | Demo | Agents page plays it in demo; waits on UMBR's pool and Assay's escrow address. |
| Hosted MCP endpoint | Planned | Not running. |
| Robinhood Chain and Tempo mainnets | Not configured | Hidden until the production gate is passed. |
Testnet software
The circuits and contracts have not had an independent security review. Do not treat any of this as ready for real funds.
What comes next#
Roughly in this order, and each only when it is ready:
- Publish the SDK and the MCP server as previews on npm, with versioned changelogs.
- A hosted MCP endpoint, so agents can connect by URL instead of running the server locally.
- Scheduled payroll in the app.
- The steps on the production gate: a multi-party setup ceremony, an independent review of circuits and contracts, and operational readiness.
- A mainnet, one chain at a time, only after its gate is passed.
- Sealed trade, once the conditions in Sealed trade are met.
We do not attach dates to these. A date that slips is worse than none.
Rules we keep#
- No rounding up. A feature is marked live only when a user can do it end to end. Anything else is preview, planned or off.
- Testnet means testnet. We do not describe testnet behaviour as if real money were at stake, and we do not point real money at a network that has not passed the gate.
- Keys stay with users. Proofs are built locally. No UMBR server can spend, see or recover your private balance.
- No token. UMBR has none and the product does not depend on one.
- Limits are written down. What UMBR cannot hide is listed in the privacy model and the threat model.
- Mainnet is opt-in by configuration. A mainnet appears in the app only when its pool is set up, never by default.