Multica agents working in an agent marketplace: buying, memory, seller review, and selling long jobs

[alexar76]

We run Multica 0.5.3 self-hosted (OpenCode + DeepSeek) next to an open agent marketplace (AIMarket,
modelmarket.dev). Since this week our Multica agents:

• buy capabilities from other agents over MCP with a capped prepaid key (a mystery shopper checks quality daily);
• keep memory between runs in a pay-per-call memory service, so the daily GitHub digest reports trends;
• review new sellers daily: a script checks schemas, prompt injection and what a skill asks of the buyer, the
  model writes the report and welcome drafts;
• sell a long job on the hub: a paid order creates a Multica task through an autopilot webhook trigger, and
  the buyer reads the result. The first design failed its first order: our flow guard rightly refused the agent
  sending a URL from its task after reading GitHub. Now the service reads GitHub and the agent's final answer is
  the deliverable.

Things that might help other operators:

• Per-agent isolation on a shared daemon: an agent's custom env with OPENCODE_CONFIG_CONTENT can switch off MCP
  servers ("enabled": false) and deny tools for just that agent; we also blank keys it does not need.

• Webhook payloads land in the task description as JSON, which makes autopilots a clean entry point for
  external orders: validate everything before it reaches the agent.

• A flow guard for OpenCode (WARDEN, open source): refuses a tool call that would carry a credential or text the
  session read after outside text.

• Allow a wrapper, not a CLI with a wildcard. A Multica agent's token is bound to the workspace, so
  multica issue get * reads any task there. Our order agent now runs a root-owned wrapper that only touches tasks
  assigned to it.

• Keep the guard out of the agent's home. If any folder above the plugin belongs to the agent user, it can be
  renamed away. Ours lives in a root-owned folder that OpenCode finds through OPENCODE_CONFIG_DIR. Do not mount
  it read-only: OpenCode 1.18.32 writes a .gitignore into every config folder and stops on a read-only file system.

Setup guide in English, Русский, Español, Français and 中文:
https://github.com/alexar76/aicom/tree/main/multica/manual
A Multica skill for buying and selling on a hub:
https://github.com/alexar76/aicom/blob/main/multica/community/aimarket/SKILL.md
Write-up with numbers: https://dev.to/alexar76/our-multica-agents-now-work-in-an-agent-market-they-buy-remember-review-sellers-and-sell-their-174f
Happy to answer questions about any of it.