nidhipati
Nidhipati
Proof of Spend for AI agents. A signed receipt that proves what an agent was authorized to pay, what it actually paid, what it used and what was refunded. Not a token, not custody, not another payment rail.
Рельсы двигают деньги. Nidhipati доказывает, что движение было правильным.
Status: v0.2. Proof validator (signed receipts) and agent spend audit, both with tests.
Site: https://mrpkk.github.io/nidhipati/
Free scan: https://github.com/mrpkk/nidhipati/issues/new?template=free-spend-audit.yml

Reserve and NAV report
For tokenised assets: the issuer's own numbers turned into a NAV with explicit formulas and an
evidence hash per line. The verdict is backed, underbacked, or incomplete — and the ratio
is refused when any line has no price, because a number computed over half a reserve is not
a number.
nidhipati-reserve report examples/reserve.example.json --key keys/private.pem --markdown report.mdNAV = Σ quantity × price × (1 − haircut) − liabilities
ratio = NAV / supplyThe statement hash is compared with the file if you provide it. The disclaimer travels inside the signed document. Details and the partner/legal checklist: docs/RESERVE-REPORT.md.
Related MCP server: mesa-mcp
Resolution evidence
When a market resolves and someone disagrees, the question is whether the resolver's sources
say what the resolver claims and whether they agree with each other. The report answers with
four verdicts — supported, disputed, single_source, insufficient — and never picks a
winner.
nidhipati-resolve report examples/resolve.example.json --key keys/private.pem --markdown report.mdDetails: docs/RESOLUTION-EVIDENCE.md.
Reconciliation
Invoices on one side, transfers on the other. The report names what is closed, what nobody paid, and what arrived without an invoice — a transfer that duplicates a payment is counted once, never twice.
nidhipati-reconcile run examples/invoices.example.csv examples/transactions.example.csv --csv matches.csvDetails: docs/RECONCILIATION.md.
MCP server (for agents, not shells)
The same five checks over the Model Context Protocol: verify_receipt, audit_spend,
reserve_report, resolve_report, reconcile_books. Input is data, never a file path and never
a network call; the answers are the same reports the CLIs produce, including the refusal to print
a backing ratio when a line has no price.
{"jsonrpc":"2.0","id":1,"method":"tools/call",
"params":{"name":"reserve_report","arguments":{"reserve":{...}}}}python3 -m nidhipati_proof.mcp_stdio # stdio transport
docker build -t nidhipati-mcp . && docker run -i --rm nidhipati-mcpFive tools, all read-only: no custody, no keys, no chain read.
Free scan, and what it costs after
Send records of what your agents spent and get the audit back — no card, no account: open a free-scan issue. Paid: $2,500 fixed audit, $1,500/mo retainer, or 20% of verified savings. Full terms, including what is not included: docs/OFFER.md.
In CI, on every run:
- uses: mrpkk/nidhipati@v0.2.0
with:
records: billing/agent-spend.csv
policy: billing/policy.jsonQuick start
python3 -m pip install -e .[dev]
python3 -m pytest -q
python3 -m nidhipati_proof.cli verify examples/proof-of-spend.example.json --pubkey <base64url>What it checks
schema and canonical JSON;
Ed25519 signature;
mandate expiry vs settlement time;
amount, asset, network, payee;
usage.quantity × usage.unit_pricevs payment;refund ≤ payment;
verdict
allowfor a settled payment;receipt ID/replay (v0.2 store).
Agent spend audit
A signed receipt proves one charge. A bill proves a month. The audit reads the records you already have (CSV or JSON) and names the rows where money left without a reason:
Finding | What it means |
| the same receipt twice, or an equal charge within 120s with no receipt at all |
| settled above the authorised quote by more than 1% |
| status failed/error and still charged |
| authorised 10, used 4, nothing returned |
| more than 30 calls a minute from one agent |
| far above this agent's own median for the same tool and model (an estimate) |
| the record does not say where the money went |
| no policy file: the limit lives in a prompt; with a policy, the agent is over it |
python3 -m pip install -e .
nidhipati-spend audit examples/spend-sample.csv --policy examples/spend-policy.example.json
nidhipati-spend audit records.csv --json > report.jsonExit code 1 when there is an error — a pipeline can fail on it. The report keeps three
amounts apart on purpose: spent without a reason (duplicates, escalation, failed calls,
refunds not returned), above the usual price (an estimate, not proof), and over the
limit (the money may have been spent on real work).
The sample is synthetic and labelled: it contains every finding once, so you can see what a report looks like before trusting it with real invoices.
Honest limits
v0.1 does not verify the on-chain transaction;
onchain_verified=falseis explicit.It is not a statutory audit, legal, tax, or investment advice.
It does not guarantee the service was good; it proves the payment was within mandate.
No custody, no money transmission, no token.
Docs
SPEC.md— product, architecture, modules, SEO, monetization, 30/60/90.PROGRESS.md— slices, acceptance, metrics.docs/PROMPT-AND-IDEAS.md— prompt and decisions for RAG.docs/SEO-MONETIZATION.md— keywords, pages, funnel, pricing.docs/LAUNCH-KIT.md— Show HN, Reddit, Product Hunt, X/LinkedIn copy.docs/DEMO.md— real commands and sample output.docs/AGENT-SPEND-AUDIT.md,docs/RESERVE-REPORT.md,docs/RESOLUTION-EVIDENCE.md,docs/RECONCILIATION.md— module rules.schemas/proof-of-spend.schema.json— v0.1 schema.examples/proof-of-spend.example.json— example.
License
Apache-2.0.
Available Tools
5 toolsaudit_spendAudit an agent's spending recordsARead-onlyInspect
Find duplicates, price escalation, failed-but-billed calls, runaway loops, missing refunds, model overpay, unknown asset/network and budget breaches in a list of settled agent calls. Returns three separate amounts (money without a basis, estimate above the agent's own median, budget overrun) instead of one sum, because adding them together would overstate what can be recovered. Do NOT use as a statement of money actually returned.
| Name | Required | Description | Default |
|---|---|---|---|
| policy | No | Optional budget policy: {"limit_usd": "100"}. | |
| records | Yes | Rows with ts, agent_id, tool, quote, settled, status; optional model, actual, refund, asset, network, tx_hash, payee. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, destructiveHint=false, and openWorldHint=false, so the safety profile is covered. The description goes beyond them by disclosing a non-obvious return behavior: three separate amounts rather than one sum, plus the rationale that summing them would overstate recoverable money. What remains undisclosed is whether findings are per-record or aggregated, and whether 'records' is validated or silently skipped when malformed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the action verb and the anomaly list, then a second sentence that explains the unusual three-amount return shape and its rationale. Dense but every clause earns its place; the anomaly enumeration is long but directly useful for matching against a caller's intent.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description appropriately explains the return structure (three separate amounts) and warns against misinterpreting it. Combined with a fully documented input schema and read-only annotations, the definition is sufficient to select and invoke the tool; only the granularity of per-finding results is left to guesswork.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and the schema documents both 'records' (row fields incl. ts, agent_id, tool, quote, settled, status) and 'policy' (limit_usd). The description adds no syntax or format guidance for either parameter; 'budget breaches' only obliquely signals that the policy parameter drives that check. Baseline 3 is appropriate when the schema carries the parameter burden.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Find') against a precisely scoped resource (settled agent calls) and enumerates the anomaly classes it detects: duplicates, price escalation, failed-but-billed calls, runaway loops, missing refunds, model overpay, unknown asset/network, budget breaches. An agent can tell this is an anomaly-detection pass over a supplied list rather than a reconciliation, verification, or report-resolution step.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives one explicit when-not ('Do NOT use as a statement of money actually returned'), but that is an interpretive warning about the output, not a routing rule between tools. No sibling (reconcile_books, verify_receipt, resolve_report, reserve_report) is named, and no precondition such as 'call after settlement' is stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
reconcile_booksReconcile invoices against transfersARead-onlyInspect
Match invoices to stablecoin transfers by memo first, then exact amount and asset inside the invoice window. Names what is left over in both directions: invoices nobody paid, money nobody invoiced, invoices paid twice. A duplicate is counted once, never twice. Do NOT use as proof of who the payer was.
| Name | Required | Description | Default |
|---|---|---|---|
| invoices | Yes | id, amount, asset, created_at; optional due_at, payee, memo. | |
| transactions | Yes | tx_hash, amount, asset, timestamp; optional to, memo. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Goes well beyond the read-only/non-destructive annotations: it discloses the matching priority order, the invoice-window constraint, the exact return semantics ('names what is left over in both directions: invoices nobody paid, money nobody invoiced, invoices paid twice'), and dedup behavior ('a duplicate is counted once, never twice'). It also flags a key limitation about payer identity.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Four short sentences, front-loaded with the matching rule, followed by output semantics and a caveat. No redundant restatement of the title or schema, and every sentence carries information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description takes on the burden of describing results and does so precisely by enumerating the three leftover categories and the dedup rule. Combined with the caveat about payer attribution, an agent has everything needed to call and interpret it.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3, but the description adds meaning the schema does not: it explains that memo is the primary join key and that amount plus asset are compared inside the invoice creation window. This tells the agent how the two arrays are actually consumed together.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Match invoices to stablecoin transfers') plus the exact matching algorithm (memo first, then amount/asset within the invoice window). Nothing in the sibling set (reserve_report, resolve_report, verify_receipt, audit_spend) overlaps with this reconciliation job, so the purpose is unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides an explicit exclusion: 'Do NOT use as proof of who the payer was,' which steers the agent away from an attribution misuse. It does not name alternative tools for attribution or explain prerequisites, so it falls short of a full when/when-not routing guide.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
reserve_reportReserve and NAV report for a tokenised assetARead-onlyInspect
Turn an issuer's reserve lines into a NAV with explicit formulas and a sha256 evidence hash per line. Verdict is backed, underbacked, or incomplete - and the backing ratio is refused (null) when any line has no price, because a ratio over half a reserve is not a number. Do NOT treat the result as a statutory audit.
| Name | Required | Description | Default |
|---|---|---|---|
| reserve | Yes | Reserve document. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover the safety profile (readOnly, non-destructive, closed-world), yet the description still adds real behavior: verdict categories (backed/underbacked/incomplete), the null-ratio refusal rule when a line is unpriced, and a per-line sha256 evidence hash. The only gap is that it does not describe the shape of the returned report.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three tight sentences, each earning its place: transformation, decision rule with rationale, then an explicit misuse warning. Front-loaded with the core action.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema exists, and the description enumerates the possible verdicts and the null-ratio condition, which is what an agent most needs. The remaining gap is the internal structure of the nested reserve document, which neither schema nor description specifies.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With one required parameter at 100% schema coverage, the baseline is 3. The schema description is thin ('Reserve document.') and the nested object structure is undocumented; the description only hints that the document contains lines with prices. It adds marginal but not compensating detail.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: turning an issuer's reserve lines into a NAV with formulas and a sha256 evidence hash per line. The output artifact (verdict plus backed ratio) is clearly distinct. It does not name any sibling tool, so an agent gets no explicit differentiation from resolve_report or reconcile_books.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The 'Do NOT treat the result as a statutory audit' line gives a clear interpretation boundary, and the refusal rule signals when a ratio is meaningful. However there is no guidance on when to pick this tool over the sibling report tools, which are named in context but never referenced.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
resolve_reportResolution evidence for a prediction marketARead-onlyInspect
Weigh the sources a resolver says it read against the declared outcome. Verdicts: supported, disputed, single_source, insufficient. A conflict is reported as a conflict, never averaged. Do NOT use to trade or to place a position.
| Name | Required | Description | Default |
|---|---|---|---|
| market | Yes | Market document. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover the safety profile (readOnly, non-destructive, closed-world), so the description's added value is in disclosing output semantics: the four verdict categories and the rule that conflicts are 'reported as a conflict, never averaged.' That is genuine behavioral context an agent could not infer from structured fields. It stops short of saying what happens with zero sources or how the verdict is surfaced in the response.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences, zero filler. The core operation and verdict set come first, the conflict-handling rule second, and the usage prohibition last. Every sentence carries information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description does the necessary work of naming the verdict vocabulary and the no-averaging rule, which is exactly what an agent needs to interpret a result. The remaining gap is the shape of the input market document and what 'insufficient' is triggered by, but overall it is adequate for a single-parameter read-only tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline applies, but the single parameter is documented only as 'Market document.' with nested content left entirely unspecified in both schema and description. The description adds no guidance on what the market object must contain for evidence to be resolvable.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and comparison (weigh sources against the declared outcome) and enumerates the four verdict values, so an agent knows the tool produces an adjudication, not raw data. It does not name or distinguish itself from any of the listed siblings, which leaves differentiation implicit rather than explicit.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives a clear negative boundary: 'Do NOT use to trade or to place a position,' which rules out a plausible mis-invocation for a prediction-market tool. The positive trigger (evaluate a resolver's sourcing before accepting an outcome) is implied rather than stated, and no sibling alternative is named.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
verify_receiptVerify an agent payment receiptARead-onlyInspect
Check a signed proof-of-spend receipt offline: schema, Ed25519 signature, mandate expiry, positive amount, quantity*unit_price == amount, refund not above payment. Use when an agent or provider returns a receipt and you need to know whether it actually proves the charge was allowed. Do NOT use to move funds or to confirm a transaction on-chain - nothing here reads a chain.
| Name | Required | Description | Default |
|---|---|---|---|
| receipt | Yes | The receipt document as JSON. | |
| public_key | Yes | Ed25519 public key, base64url (from keygen) or 64 hex chars. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already establish readOnly/non-destructive/closed-world, and the description adds real value on top: verification is done offline and 'nothing here reads a chain'. It does not say what a failed verification surfaces (throw vs. structured error list) or whether partial failures are distinguishable, which is a meaningful omission for a validator.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the enumerated checks, then the usage condition and the exclusion. No filler, and the most decision-relevant content (what is verified, and what this is not) arrives first.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With a nested, otherwise-undocumented receipt object and no output schema, the description does the heavy lifting by listing the invariants checked. The remaining gap is the return shape: an agent can't tell from the definition whether it gets a boolean, a verdict object, or a list of failure reasons.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the two parameters are already documented, including the base64url-or-hex key format. The description still adds meaning by naming the receipt fields the verifier actually inspects (mandate expiry, amount, quantity*unit_price, refund), which the schema only calls an opaque 'receipt document as JSON'.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Names a specific verb (verify/check) and resource (signed proof-of-spend receipt), then enumerates the exact validations performed: schema, Ed25519 signature, mandate expiry, positive amount, quantity*unit_price equality, refund ceiling. That level of specificity clearly separates it from the reporting siblings (reserve_report, reconcile_books, audit_spend).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives an explicit trigger ('when an agent or provider returns a receipt and you need to know whether it actually proves the charge was allowed') plus explicit exclusions ('Do NOT use to move funds or to confirm a transaction on-chain'). Both the when and the when-not are stated, so the agent isn't left to infer.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
5 tool updates
v0.6.0- First observed
audit_spend - First observed
reconcile_books - First observed
reserve_report - First observed
resolve_report - First observed
verify_receipt
TDQS
Scored across 5 tools
Most tools target clearly distinct financial verification tasks: reserve NAV, resolver-source validation, receipt checking, invoice reconciliation, and spend auditing. The main possible confusion is between reserve_report and resolve_report because both share the _report suffix and sound like generic reporting tools, though their descriptions clarify the domains.
The set mostly follows a snake_case verb_noun or action_object pattern: resolve_report, verify_receipt, reconcile_books, audit_spend. reserve_report is slightly less action-oriented, but the overall convention remains readable and predictable.
Five tools is well-scoped for a focused financial verification and audit server. Each tool covers a distinct check rather than padding the surface with redundant operations.
The surface covers reserve backing, source resolution, receipt proof, invoice reconciliation, and spend auditing, forming a coherent verification lifecycle. Minor gaps may exist around ancillary lookup or evidence-retrieval operations, but the core domain is well covered.
Maintenance
Related MCP Connectors
Governed agent execution: x402 payments, budgets, receipts, verification, and audit.
Read-only checks for proposed orders against evidence and policy; no trading or payment authority.
Read-only agent-commerce audit, upgrade verification, diagnosis and x402 probing.
Read-only discovery for exact-commit Agent Skill validation, x402 payment, and signed receipts.
Related MCP Servers
AlicenseNot gradedqualityDmaintenanceEnables MCP hosts to verify agent spending mandates and receipts, providing stateless tools for authorization, chain verification, credential verification, and DID resolution.Apache 2.0- AlicenseAqualityBmaintenanceEnables agents to query a read-only ledger of machine payments, exposing tools for spending totals, purchases with event chains, verdicts, payer passports, and fiscal reporting data.7MIT
- AlicenseAqualityBmaintenancePolicy-gated agent spend with signed receipts and rail-extract audit: a fail-closed gate issues a COSE receipt for every allowed payment, and the audit reconciles those receipts against a rail extract so a settlement with no receipt is named rather than assumed. It settles on a mock rail, holding no wallet and signing no transaction.51Apache 2.0
- AlicenseNot gradedqualityBmaintenanceEnables AI agents to inspect, check, and audit signed offline spending authorizations, and to issue hash-chained receipts for each action taken against them. Enforces per-transaction, total, expiry, merchant, and human-approval constraints, returning allow, needs_human, or deny with the specific failing constraint.Apache 2.0