DEV Community

uuu
uuu

Posted on

I built a spending guard for AI agents that asks my phone before they pay

#mcp #security #ai #agents

I've been letting AI agents do more on their own, and at some point I realized that if one decided to buy something or upgrade a plan, nothing would stop it. So I built Saifuban ("wallet keeper" in Japanese).

https://ut181749ut.github.io/saifuban/

What it does

Before spending money, the agent asks Saifuban whether the payment is OK. Saifuban answers using rules you set:

  • Small amounts under your threshold are approved right away.
  • Anything larger sends a push notification to your phone. You tap Approve or Reject.
  • Payments over the daily budget or the per-payment limit are refused, as are merchants you haven't allowed.
  • A kill switch stops everything at once.

Rules are per agent, so a research agent can have $5/day while a coding agent gets more. Saifuban never handles card details or moves money. It only decides whether a payment is allowed.

How you connect it

It's a remote MCP server, so any client that supports remote MCP can use it with one URL: Claude (custom connector), ChatGPT (developer mode), Cursor, VS Code and so on. Open the site, pick a budget, and paste the URL it gives you. Then ask your agent "check my remaining budget with Saifuban" to confirm it's connected.

The agent sees three tools:

  • request_payment: ask whether a payment (merchant, amount, currency, reason) is allowed. It waits up to 45 seconds for you to approve on your phone.
  • check_payment_status: check a pending request later.
  • get_budget: how much is left today.

Amounts can be in yen or dollars, and the UI has an English mode.

Two things I had to get right

Pending requests count against the budget. If they didn't, an agent could fire off ten pending requests, and approving them all would blow straight past the daily limit. So a pending request reserves its amount until it's decided or expires (24 hours).

Asking is voluntary. Someone on Reddit pointed out that a prompt-injected agent could simply skip the check. That's true. So every approved request now returns a single-use payment_token that is scoped to the approved merchant and amount, expires in 24 hours, and dies if the agent is stopped. Whatever actually moves the money calls /redeem before paying:

curl -X POST https://zrphnuvrsldcycxtdftv.supabase.co/functions/v1/saifuban/redeem \
  -H "content-type: application/json" \
  -d '{"token":"sbt_...","merchant":"OpenAI","amount":12.5,"currency":"USD"}'
Enter fullscreen mode Exit fullscreen mode

A second redeem returns already_used, a different merchant returns merchant_mismatch, and a bigger amount returns amount_exceeds_approval. To be clear, this only becomes hard enforcement when the payment side checks the token. Today that means your own payment code, not third-party checkout.

API spend is the one place it's already enforced: if you store your OpenAI, Anthropic or OpenRouter key in Saifuban, the agent only ever gets a proxy key, and requests stop when the budget runs out.

Stack

Supabase Edge Functions and Postgres. All the rules are checked inside one database function, with a row lock per agent so concurrent requests can't race the budget. The site is a plain-JS PWA on GitHub Pages, and notifications use Web Push with approve/reject buttons right in the notification.

Try it

It's free and early. I'd love to hear what limits would make you comfortable letting an agent spend, and whether you'd verify tokens on the merchant side.

Top comments (0)