MandatePay
MandatePay
面向代理支付(agentic payments)的授权防火墙
身份 · 意图 · 策略 · 人工审批 · 密码学证明
自主代理可以发起支付提案,但不应被授予无限的财务权限。MandatePay 会在每笔机器发起的支付执行之前,依据经签名的人类授权令(mandate)对其进行验证。
为什么需要它
代理商务(agentic commerce)引入了一个新的控制问题:支付服务商如何证明某个 AI 代理的行为是在人类或组织所委托的权限范围内? 传统结账流程假定有真人到场。API 密钥只能确立应用访问权限,却无法界定用途、限额、地域、商户范围,或委托意图的确切边界。
MandatePay 是一个研究级控制平面,位于代理与支付通道之间。它不持有或转移资金。
Related MCP server: Safe4
它的独特之处
签名授权令: 权限可机器验证且防篡改。
策略即代码: 对金额、累计支出、币种、国家、商户、用途、有效期和频次设定确定性限制。
人工挑战: 高风险意图会暂停,等待与具体支付绑定的审批。
代理身份绑定: 授权令不能被其他代理复用。
重放安全: 幂等键返回原始决策。
可验证事件: 每项决策都会进入哈希链式日志。
MCP 工具: 代理可通过受限的工具接口请求授权。
默认拒绝(fail closed): 无效签名、畸形金额、过期权限和越界行为一律拒绝。
授权生命周期
sequenceDiagram
participant H as Human / Organization
participant A as AI Agent
participant M as MandatePay
participant P as Payment Provider
H->>M: Sign bounded mandate
A->>M: Submit payment intent
M->>M: Verify identity + signature + policy + state
alt within authority
M-->>A: Single-use authorization
A->>P: Execute with authorization proof
else approval threshold
M-->>H: Challenge exact intent
else policy violation
M-->>A: Deny with reason codes
end
M->>M: Append decision to audit chain快速开始
git clone https://github.com/muhammadashir0/mandatepay.git
cd mandatepay
python -m unittest discover -s tests -v
python app.py打开 http://localhost:8080。
在控制台中尝试四种场景:
€299 / software / DE→ 授权€400 / software / DE→ 人工挑战€900 / software / DE→ 拒绝:超出支付限额€100 / travel / GB→ 拒绝:用途和国家不符
切换场景时请使用新的幂等键。
MCP 服务器
python -m mandatepay.mcp_server这个零依赖的 JSON-RPC 服务器只暴露一个刻意收窄的工具:request_payment_authorization。该工具返回的是决策,而非资金划转。
威胁模型
MandatePay 的设计针对以下威胁:
被盗用或权限过高的代理凭证;
提示注入导致非预期购买;
授权令篡改与权限升级;
重复执行与重放;
频次滥用与累计超支;
模糊的人工审批;
取证证据不完整。
信任边界、非目标与生产环境控制措施,请参阅 docs/THREAT_MODEL.md。
仓库架构
mandatepay/
├── mandatepay/
│ ├── core.py # signed mandate + deterministic policy engine
│ ├── store.py # state, idempotency, tamper-evident journal
│ └── mcp_server.py # constrained MCP-compatible tool server
├── web/index.html # premium operator console
├── tests/ # policy and adversarial scenarios
├── docs/ # protocol, threat model, product direction
└── app.py # sandbox HTTP API不只是演示,而是评估
测试覆盖了授权、审批挑战、身份不匹配、越界、频次限制以及签名授权令篡改。下一层基准将衡量对抗性场景下的误授权、误拒绝、重放抵抗、策略覆盖率、决策延迟和审批负担。
路线图
Ed25519/JWS 生产级签名与密钥轮换
OAuth 认证的代理身份与工作负载身份
绑定意图哈希的审批仪式
面向支付服务商的单次使用授权令牌
具备并发保证的持久化 SQL 账本
OpenTelemetry 决策追踪与签名审计导出
面向代理支付攻击的对抗性评估语料库
执行接口背后的 Stripe/Adyen 沙箱适配器
多币种十进制与 FX 策略
负责任使用边界
本仓库是一个安全与金融科技研究 MVP,使用合成身份,不涉及真实资金。HMAC 仅用于让演示保持零依赖。生产部署需要经过评审的非对称密码学、加固的身份体系、持久化事务存储、认证与授权、监管分析、隐私控制、独立安全测试以及支付服务商认证。
战略背景
代理支付系统需要基于授权令的授权、决策与执行分离、代理身份、可编程控制、审计追踪和分级人工监督。MandatePay 将这些设计要求转化为一个可检视的开源原型。
许可证
Apache License 2.0。
Available Tools
1 toolrequest_payment_authorizationA
Evaluate a proposed agent payment against a signed spending mandate. Does not move funds.
| Name | Required | Description | Default |
|---|---|---|---|
| amount | Yes | ||
| purpose | Yes | ||
| currency | Yes | ||
| merchant_id | Yes | ||
| merchant_country | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the burden of behavioral disclosure. The explicit statement 'Does not move funds' is a critical side-effect disclosure that prevents accidental fund transfers. However, it does not describe the output nature (e.g., approval/denial) or any other side effects, leaving some behavioral gaps. The core non-effect is well covered, so a 4 is appropriate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two concise sentences, leading with the core purpose and then a critical safety note. There is no wasted wording, and the most important information (the scrutiny and non-movement) is front-loaded. This is an exemplary level of conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description is too brief for a tool with five required parameters and no output schema. It omits the return value (e.g., whether the authorization is granted or denied), any prerequisites like having the mandate document, and does not clarify the 'purpose' field's semantics. An agent lacks critical information to interpret the tool's result and handle errors effectively, making it incomplete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema description coverage is 0%, so the description must compensate by explaining the parameters. It does not describe any of the five fields (amount, currency, merchant_id, merchant_country, purpose). The context of a 'proposed agent payment' hints at their role but provides no additional meaning beyond the schema's field names, which is insufficient for a tool with no inline descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Evaluate') and a clear resource ('proposed agent payment against a signed spending mandate'), and explicitly states it does not move funds, which distinguishes it from payment execution tools. Even without siblings, the purpose is precise and unambiguous, leaving no doubt about what the tool does.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description clearly implies the use case: evaluating a payment proposal against a mandate before funds are moved. It does not explicitly state when not to use it or mention alternatives, but the context is strong enough that an agent understands when to invoke it. Since no siblings are present, the lack of exclusions is acceptable.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
1 tool update
v0.1.0- First observed
request_payment_authorization
TDQS
Scored across 1 tool
With only one tool, there is no possibility of confusion or overlap between tools. The tool's purpose is clearly defined and singular.
A single tool follows a consistent verb_noun pattern ('request_payment_authorization'), which is clear and descriptive. No inconsistencies exist by definition.
The server has only one tool, which feels thin for a system named 'MandatePay'—implying broader mandate management. While the tool itself is well-scoped, the overall surface is borderline minimal.
The tool covers only payment authorization, but the domain suggests the need for related operations like mandate creation, listing, updating, or checking status. Without these, agents face significant dead ends when managing mandates.
Related MCP Connectors
Allow, ask, or veto — a policy decision point your agent consults before signing any payment
Pre-spend firewall for AI agents. Approves, blocks, flags transactions against policy rules.
Agent payments, API key vaulting, and governed mandates. Agents spend within user-defined limits.
Check an agent action against its operator's mandate before acting: permit, deny or escalate.
Related MCP Servers
- AlicenseNot gradedqualityAmaintenanceDeterministic, auditable payment policy enforcement for AI agents. It provides pre-action authorization with scopes, budgets, allowlists, and signed mandates via an MCP server.MIT
- AlicenseNot gradedqualityCmaintenanceEnables AI agents to verify proposed payments against their assigned task, budgets, permitted categories, and counterparties, returning an ALLOW or DENY decision with a tamper-evident audit trail.MIT
- AlicenseNot gradedqualityBmaintenanceEnables AI agents to use payment APIs safely by gating every tool call through deterministic mandates, value checks, and an exactly-once ledger, so they cannot pay twice or exceed authorisation.260 npmMIT
- AlicenseNot gradedqualityFmaintenanceEnables MCP clients to ask permission before an agent acts, returning allow, deny, or ask_human with receipts, and to monitor agent spend, limits, and recent decisions.84 npmFunctional Source , Version 1.1, ALv2 Future