Skip to main content
Glama
Sign In
Agent Clearing Desk

Agent Clearing Desk

by nguyenhieuec
OverviewSchemaSourceRelated ServersDiscussionsAdmin
TypeScript
Remote

Agent Clearing Desk

A spend gate for AI agents that call paid tools. Each agent key has a hard budget (one-off, daily or monthly) and a tool allowlist; every call is cleared before it runs and returns an Ed25519-signed receipt that anyone can verify offline.

Architecture

How a call is cleared

  1. Unknown tool: 404. Arguments that break the input schema: 400 with the problems. Nothing is charged.

  2. Tool not on the allowlist: 403 with a signed receipt. Too many failed calls this hour: 429.

  3. One conditional UPDATE reserves the price; if the budget has no room, 402 with a signed receipt.

  4. The upstream runs. On failure, timeout or refused arguments the reservation is refunded to its own budget period (502, 504 or 400).

  5. On success the price is charged and the receipt signs the input hash, result hash, amount and upstream cost (SHA-256 over canonical JSON).

Operators add a tool from any MCP server at run time with POST /api/admin/tools; the desk runs the MCP session handshake and reads that server's tools/list for the schema. An optional upstream credential header is sealed with AES-256-GCM and never returned. Money is integer millicents. The audit log and receipts are append-only. Receipts are visible only within their organization.

Related MCP server: Cerberus

Run it

npm install
npm test                    # real SQLite (node:sqlite, Node 22.5+), production migrations
npm run typecheck
npm run db:migrate:local
npm run dev

Secrets for a deployment:

Secret

What it is

RECEIPT_SIGNING_KEY

Ed25519 private key as JWK JSON

ADMIN_SECRET

Bearer token for /api/admin/* (unset: the admin API is closed)

OPENKRILL_REFRESH_TOKEN

OpenKrill Connect refresh token; seeds the first refresh, later tokens rotate in D1

OPENKRILL_API_KEY

Optional static OpenKrill API key; when set it replaces the Connect token

UPSTREAM_SECRET_KEY

32 random bytes in base64; seals credentials of operator-added MCP servers (unset: such credentials are refused)

OPENKRILL_CLIENT_ID (the Connect client) is a plain var in wrangler.jsonc. If a refresh token ever stops working, set a new seed and delete the upstream_credentials row.

Scripts:

  • scripts/run-e2e.mjs: live end-to-end run (operator flow with ADMIN_SECRET).

  • scripts/verify-receipt.mjs response.json [public-key.json] [--input args.json]: offline check of the signature, the result hash, the input hash and the readable copy; takes a REST response, an MCP tools/call result or a bare receipt.

  • scripts/sync-tool-schemas.mjs: copies input schemas from the upstreams.

License

MIT

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

Loading tool schema changelog…

    This server cannot be deployed

    One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

    Resources

    Related MCP Connectors

    Related MCP Servers

    • evav-gateway

      evav-gatewayofficial

      evavai
      A
      license
      Not graded
      quality
      D
      maintenance
      Governed MCP gateway that lets AI agents call tools with policy enforcement, prompt-injection screening, a kill-switch, and tamper-evident signed audit logs.
      Apache 2.0

    • Cerberus

      lz-123123
      A
      license
      Not graded
      quality
      D
      maintenance
      Provides a three-layer payment firewall for AI agents, enabling identity verification, risk screening, and execution authorization with on-chain policy enforcement for secure and auditable transactions.
      226 npm
      2
      MIT

    • interlock-mcp

      Mustaqeem-Rafi
      A
      license
      Not graded
      quality
      B
      maintenance
      Enables AI agents to use payment APIs safely by gating every tool call through deterministic mandates, value checks, and an exactly-once ledger, so they cannot pay twice or exceed authorisation.
      62 npm
      MIT

    • genpark-agent-budget-token

      alphaparkinc
      A
      license
      Not graded
      quality
      B
      maintenance
      Enables autonomous agents to enforce financial guardrails by tracking real-time token burn and cost velocity, automatically throttling or freezing execution when budgets are exceeded. It also blocks destructive shell commands, prompt injections, and runaway planning loops while sanitizing outputs before they are returned.
      7
      MIT