SafeTrust is a decentralized P2P escrow platform for rental transactions. Funds are held in tamper-proof smart contracts on the Stellar network via the TrustlessWork API — no intermediaries, full on-chain transparency.
Use cases: rental deposits, service agreements, P2P property rentals.
Core flow:
Tenant finds property → PAY → Freighter signs XDR → funds locked on-chain
→ released on fulfillment or returned on dispute
Stellar Blockchain (TrustlessWork API)
│ signed XDR
services/webhook (Node + Express, port 3002)
│ SQL
infra/backend (Hasura GraphQL, port 8080)
│ GraphQL
apps/frontend (Next.js 14, port 3001)
| Tool | Min version |
|---|---|
| Docker + Docker Compose | latest |
| Node.js | ≥ 18 |
| pnpm | ≥ 8 |
| Hasura CLI | latest |
npm install -g pnpm hasura-cligit clone https://github.com/safetrustcr/dApp-SafeTrust.git
cd dApp-SafeTrust
pnpm install
⚠️ Always runpnpm installfrom the repo root —workspace:*deps only resolve from there.
Step 1 — Frontend:
cp apps/frontend/.env.example apps/frontend/.env.localStep 2 — Hasura / Backend:
cp infra/backend/.env.example infra/backend/.env.localFill in both files before continuing. See the sections below for how to obtain each value.
SafeTrust uses Firebase for authentication.
- Go to console.firebase.google.com → create a project.
- Authentication → Sign-in method → enable Email/Password.
- Project Settings → Your apps → register a Web app → copy the config values into
apps/frontend/.env.local. - Project Settings → Service Accounts → Generate new private key → copy
project_id,client_email,private_keyintoinfra/backend/.env.local.
Required for escrow deploy, fund, and release flows.
- Go to dapp.trustlesswork.com → connect Freighter wallet.
- Settings → Profile → fill in the use-case field (required).
- Settings → API Keys → Request API Key → select Testnet.
- Copy the key immediately — shown only once.
Add to apps/frontend/.env.local:
TRUSTLESS_WORK_API_KEY=<your_testnet_key>
TRUSTLESS_WORK_API_URL=https://dev.api.trustlesswork.comFull guide: docs.trustlesswork.com → Request API Key
cd infra/backend
bin/startbin/start runs in order: starts Docker containers → waits for Hasura health → applies migrations → reloads metadata → applies seeds. Takes ~30 s on first run.
Reset the database:
docker compose down -v
bin/startFrom the repo root in a separate terminal:
pnpm run devStarts both apps/frontend (port 3001) and apps/api (port 3002) via Turborepo.
Requires Hasura running:
pnpm --filter @safetrust/web run codegenWrites typed Apollo hooks to packages/graphql/generated/index.ts.
Reference only — not an implementation step.
All TrustlessWork calls return an unsigned XDR that Freighter must sign before broadcast.
Deploy: POST /deployer/single-release → XDR → sign → POST /helper/send-transaction
Fund: POST /escrow/single-release/v2/fund → XDR → sign → POST /helper/send-transaction
Release: POST /escrow/single-release/v2/release-funds → XDR → sign → POST /helper/send-transactionFull API reference: docs.trustlesswork.com
- Run
pnpm run dev— both apps must start without errors. - No
console.login production paths, no unexplainedanyor@ts-ignore. - Link the issue your PR closes.
Branch naming: feat/<issue-number>-short-description · fix/<issue-number>-short-description
mcp.json at the repo root connects Cursor and Claude Code to:
- TrustlessWork docs and live escrow tools
- Stellar Raven — Stellar ecosystem docs + live data
safetrust— SafeTrust's own MCP server (mcp/): escrow tools, live Hasura queries and architecture context. Build it first withpnpm --filter @safetrust/mcp build, then restart the editor.
Cursor picks up mcp.json automatically.
For stellar-raven: run /mcp → Authenticate → sign in in browser.
No API keys required for any server.
© 2026 SafeTrust. Released under the MIT License.