0 of 12 AI agent frameworks can cap what an agent spends in dollars (we checked)

Disclosure: I work on Pink Agentic AI Payments at PinkWallet, a payment-control layer for AI agents. This survey covers general-purpose agent frameworks, not payment products, and Pink is not in the table. Every cell links to the framework's own docs: github.com/Pink-Agentic-Payments/agent-framework-spend-guardrails.

Short answer: none of the 12 most popular agent frameworks documents a spending budget in currency for tool calls. They can make an agent stop after N steps (9 of 12) or pause for a human (10 of 12), but none of them knows what a single tool call costs in dollars. If your agent can spend money, the cap has to come from somewhere else.

The 12 frameworks and 8 controls

We checked each framework's own documentation or source code on 2026-10-09 for eight controls:

• C1 human approval before a tool runs
• C2 a programmatic per-tool hook that can block a call
• C3 max steps / iterations / turns
• C4 a token or LLM-cost budget for a run
• C5 a money budget for tools, in currency
• C6 a tool-call rate limit
• C7 idempotency / dedup of tool calls
• C8 a built-in audit log of tool calls with arguments

Framework	C1	C2	C3	C4	C5	C6	C7	C8
LangChain/LangGraph	yes	yes	yes	partial	no	yes	no	n/d
CrewAI	yes	yes	yes	no	no	yes	no	partial
OpenAI Agents SDK	yes	yes	yes	n/d	no	n/d	n/d	partial
Vercel AI SDK	partial	yes	yes	partial	no	n/d	n/d	partial
Google ADK	yes	yes	yes	no	no	n/d	n/d	partial
Microsoft AutoGen	partial	n/d	yes	yes	no	n/d	n/d	n/d
Semantic Kernel	n/d	yes	n/d	n/d	no	n/d	n/d	partial
LlamaIndex	yes	n/d	n/d	n/d	no	n/d	n/d	n/d
Pydantic AI	yes	yes	yes	yes	no	yes	n/d	n/d
Mastra	yes	yes	n/d	partial	no	n/d	n/d	n/d
Claude Agent SDK	yes	yes	yes	n/d	no	n/d	n/d	n/d
smolagents	no	no	yes	no	no	no	no	partial

n/d = not documented.

What the table says

1. 0 of 12 document a currency budget for tool calls (C5). That is fair to say plainly: these are general-purpose frameworks, so a dollar cap was never their job.
2. 10 of 12 offer some form of human approval (C1 yes or partial), but not all of them can gate one specific tool call; some only stop the whole run.
3. 9 of 12 can block a specific tool call in code (C2), not just by prompt instruction. That hook is where a spending check can be plugged in.
4. 9 of 12 document a max-steps limit (C3), the most common control in the survey.
5. Only 2 of 12 document a clean token or cost budget for a run (C4 = yes), with 3 more partial. And a token budget limits what the model costs, not what the agent buys.

So where should the spending cap live?

Not in the prompt. "Never spend more than $50" is text in the model's context; it can be misread, forgotten, or overridden by a prompt injection.

Use the framework hook (C2) to call something outside the model that knows the money: the payment API or a control layer in front of it. That layer should hold the budget, the per-payment cap, the allowed payees and the approval rule, and it should answer before the payment executes. Three outcomes cover almost every case: allow, ask a human (with silence meaning no), or block.

A companion census of 49 payment MCP servers found the same gap from the other side: of 37 servers that can move money, only 4 document a spending budget and only 6 document human approval (payment-mcp-census).

Try it

Pink's public sandbox gives an agent seven MCP tools (pink.get_budget, pink.check_policy, pink.request_payment and friends) and answers every request with allowed / pending_human / blocked against per-agent budgets and rules. Test money only: agentic-sandbox.pinkwallet.com. There are runnable LangGraph, OpenAI Agents SDK, CrewAI and Vercel AI SDK examples in sandbox-examples.

If we got a cell wrong for your framework, open an issue with a docs link and we will fix it.

Comments

[fable7]

Good audit, and C5 is the column that actually bites. One thing from the security side that makes the same point harder: a cap written as text is not just unreliable, it is bypassable by construction. In Adversa's Cryptographic Context Injection writeup (Oct 6), Copilot CLI rejected the identical instruction in plaintext and executed it once it arrived as ciphertext the agent decrypted inside its own runtime, then shipped a .env.prod to an attacker endpoint in 28 seconds with no confirmation. Whatever you put in the prompt lives in exactly the context that got bypassed.

So C2 is the right hook, with one caveat: it has to answer without asking the model, and it has to fail closed. In CI, a budget service that is unreachable when the hook fires and returns "allow" is the same as no gate at all.

I would also split C4 for coding agents. The expensive thing there is rarely a priced tool call, it is the retry loop, and a per-run budget that ignores token spend will miss the case most people actually hit.