Spending controls for AI agents.
Let agents act. Don't let them overspend.

SpendShield is an open-source authorization and spending policy layer for AI agents — enforcing budgets, transaction limits, approvals and audit rules before money moves.

Try the Playground → GitHub
Real policy engine output
$25 breakfast → mcdonalds.comALLOW
$75 weekly planDENY
replayed payment (same grant)DENY
injection: "$500 to scam-vip.com"DENY
Why it exists

A wallet can move money. It doesn't decide whether an agent should.

Budget

Can this agent spend $25 right now? Cumulative, atomic, per identity — not just per call.

Authority

Is this action actually authorized? Deterministic policy code, not the model's opinion.

Execution safety

What if the request is replayed, malformed, duplicated, or exceeds policy? Signed single-use grants.

SpendShield sits between agent intent and payment execution.

The difference

A spending limit isn't a spending policy.

Request 1$40 ✓
Request 2$40 ✓
Request 3$40 ✗— daily budget consumed

But real systems also hit retries, parallel agents, duplicate requests, transaction splitting and malformed or injected input. So SpendShield isn't just "$100/day" — it's policy + authorization + enforcement + audit.

Watch it decide

See the policy engine make the decision.

RequestDecisionReason
$25 breakfast → mcdonalds.comALLOWwithin policy
$75 weekly plan → mcdonalds.comDENYexceeds per-transaction limit
replayed request (same grant)DENYgrant already consumed
malformed amount / forged signatureDENYfail-closed

Try it yourself →

How to use it

Three ways in. Pick yours.

Python

Embed SpendShield into your agent or payment workflow.

pip install spendshield Quickstart →

MCP

Add spending controls to MCP-based agents (Claude, etc.).

uvx --from spendshield spendshield-mcp --policy policy.yaml Claude setup →

Payments / x402

Enforce authorization before payment execution on any rail.

spendshield.adapters.x402 x402 guide →
Not a wallet

Why it isn't "another agent wallet".

Agent ↓ Intent ↓ ┌────────────────────┐ │ SpendShield │ │ policy │ │ authorization │ │ budget │ │ validation │ │ audit │ └────────────────────┘ ↓ Wallet / x402 / Stripe ↓ Payment

SpendShield decides whether an agent is authorized to spend. Your wallet / payment rail executes the payment.

Proof

Built for real agent payment workflows.

MCP Registry

Published & active: io.github.felixpg13-glitch/spendshield v0.8.3

registry ↗

AgentKit example

Working integration example — policy before Coinbase AgentKit payment actions, with counted executions.

example ↗

x402 adapter

Gate x402 payments before execution, client- and server-side.

adapter ↗

Ecosystem

Glama · awesome-x402 · awesome-mcp-servers · Awesome-MCP-ZH · agentic-commerce · AI security tools (PRs open)

Protocol work

AP2 conformance vectors · verb-authority composition · external reviewer reproductions

Open source

MIT · Python + MCP · adversarial test suite · failure map · security checklist