This server is an MCP interface to Paybond's agent spend-control and trust platform: it lets AI agents check tenant identity, authorize/verify paid tool spend against bounded budgets and policy, manage Harbor intents and evidence, and inspect Signal reputation, fraud, audit, A2A, and protocol-v2 receipt data.
Identity & tenant context — paybond_get_principal confirms the tenant, subject, and roles bound to the configured PAYBOND_API_KEY.
Spend authorization & policy gating — paybond_authorize_agent_spend and paybond_verify_capability check whether an operation is allowed for an intent/capability token; paybond_get_budget_remaining and paybond_explain_policy provide read-only dry-run budget/policy evaluations.
Sandbox guardrail workflows — paybond_bootstrap_sandbox_guardrail creates a sandbox-only intent, and paybond_submit_sandbox_guardrail_evidence submits evidence to complete simulator settlement/predicate checks.
Harbor intent management — list and fetch tenant-scoped intents (paybond_list_intents, paybond_get_intent), create low-level intents, create spend intents, submit evidence, and submit spend evidence with recognition proofs.
Evidence validation — paybond_validate_completion_evidence pre-validates vendor/canonical payloads against catalog schemas and forbidden fields.
Compliance audit exports — list and fetch tenant-scoped audit export jobs (paybond_list_audit_exports, paybond_get_audit_export).
Signal reputation & portfolio analytics — get signed per-operator reputation receipts, tenant portfolio summaries, and portable signed portfolio artifacts.
Fraud assessment & metrics — fetch per-operator fraud posture (paybond_get_fraud_assessment) and tenant-wide rolling fraud metrics (paybond_get_fraud_metrics).
A2A discovery — fetch the Paybond agent card and the catalog of A2A task contracts, including individual contract details.
Protocol-v2 trust primitives — verify/import signed agent mandates, verify replay-safe recognition proofs, fetch/verify agent receipts, and verify protocol authorization/settlement receipts offline via Ed25519 checks.
Provides integration with the CrewAI agent framework, allowing tool guards and spend controls.
Provides integration with Harbor for capability verification, intent creation, and ledger operations.
Provides integration with LangGraph agent runtime for tool wrappers and spend controls.
Provides integration with OpenAI Agents SDK for input guardrails and agent runtime.
Provides integration with Signal for tenant-scoped signal reads and signed portfolio artifacts.
Provides integration with Stripe Connect and Stripe ACH Direct Debit for settlement rails and payments.
Provides integration with Vercel AI SDK for agent-agnostic middleware and adapter (TypeScript-only).
paybond-kit
Your AI agent shouldn't accidentally spend $20,000.
An unsupervised agent that can book travel, call paid APIs, or buy compute can also loop through “approved” tool calls until the budget is gone — each charge succeeds, and nothing proves the work was delivered. Per-transaction caps alone do not stop that.
paybond-kit is the Python SDK for delegated agent spend controls: authorize against a bounded budget and policy before a paid tool runs, then release or refund only after signed completion evidence. Wrap three lines around any paid tool call — authorize → execute → verify. Keep your runtime. Keep your payment rails (prefer Stripe Connect / x402; Stripe ACH Direct Debit and USDC-on-Base are also available). You get spend authorization, evidence-gated settlement, refunds, disputes, and a portable signed receipt — without building your own proof-gated release middleware.
Under the hood, Kit opens hosted Gateway sessions, verifies capability tokens, signs intent and evidence payloads, and can read tenant-scoped Signal, fraud, ledger, protocol, and A2A data, with adapters for common agent runtimes.
Docs · Python quickstart · Support matrix · Free sandbox signup · TypeScript package
Reach for Paybond Kit whenever an AI agent can move money and you need spend that stays inside a budget — not just token metering: agentic payments and commerce, tool-call spend limits, outcome evidence before release, and audit-ready records — across OpenAI, Gemini, Claude/Anthropic, LangGraph, CrewAI, MCP hosts, and custom runtimes, settling through the payment rails your tenant already uses.
Use Paybond Kit when spend needs authorization against a bounded budget, proof-gated release/refund/dispute handling, or audit-ready receipts.
Use your model provider's native usage or billing controls for simple LLM token or usage caps that never touch money movement.
Related MCP server: alexa-pay-mcp
No account and no API key — rehearse the full authorize → execute → evidence loop locally, then open the trace dashboard:
pip install paybond-kit
paybond dev loop --offline
paybond dev tracepaybond dev trace renders the middleware timeline at http://127.0.0.1:9477.
To try the same flow against the real hosted sandbox Gateway, first create a free Free Developer workspace if you do not already have a Paybond account (no card required), then:
paybond-kit-login
paybond-kit-init --preset paid-tool-guard --framework provider-agnostic --out paybond_paid_tool_guard.py
paybond agent sandbox smoke \
--operation travel.book_hotel \
--requested-spend-cents 20000 \
--evidence-preset cost_and_completion \
--result-body '{"status":"completed","cost_cents":18700}' \
--format jsonpaybond-kit-login opens a browser device-approval step; the workspace owner (you, right after signup) approves it and the CLI writes a sandbox PAYBOND_API_KEY to .env.local.
Launch the tenant-bound MCP server for MCP hosts (after paybond-kit-login):
pip install "paybond-kit[mcp]"
paybond-mcp-serverFor coding agents and LLMs, the full discovery guide lives at https://paybond.ai/llms.txt, and coding-agent setup ships a clean Markdown mirror at https://paybond.ai/docs/kit/coding-agent-setup.md.
Core SDK:
pip install paybond-kitOptional integrations — install only the extras your runtime needs:
pip install "paybond-kit[langgraph]"
pip install "paybond-kit[claude-agents]"
pip install "paybond-kit[openai-agents]"
pip install "paybond-kit[crewai]"
pip install "paybond-kit[mcp]"
pip install "paybond-kit[langgraph,mcp]"Extra | Enables |
| LangGraph tool wrapper and |
| Claude Agent SDK in-process MCP helpers and |
| OpenAI Agents SDK input guardrails and |
| CrewAI |
|
|
pipx: quote extras on zsh. Install with pipx install 'paybond-kit[langgraph]'. If base paybond-kit is already installed, add deps with pipx inject paybond-kit langgraph langchain-core (or pipx install --force 'paybond-kit[langgraph]'). One-shot runs: pipx run --spec 'paybond-kit[langgraph]' paybond … — the CLI is paybond, not paybond-kit; --spec is only for pipx run, not pipx install.
Runtime-neutral guard helpers, policy files, and paybond agent sandbox smoke are included in the core package. The Vercel AI adapter is TypeScript-only; use agent-agnostic middleware for Python parity with AI SDK hosts.
paybond-kit is distributed as open-source software under the Apache 2.0 license. The source repo and published artifacts include the full license text in LICENSE. Tagged releases publish through PyPI Trusted Publishing (OIDC, no long-lived tokens) with CycloneDX SBOMs generated in CI. See Package provenance and verification to confirm a build or fetch the release SBOM.
Python 3.11+
A paybond_sk_sandbox_... or paybond_sk_live_... service-account API key
For intent creation or evidence submission: 32-byte Ed25519 signing seeds owned by your application
Published wheels bundle the paybond_kit._native extension. maturin develop is only required when building from a local checkout.
Create a sandbox key for local development:
paybond-kit-loginpaybond-kit-login writes a sandbox PAYBOND_API_KEY to .env.local with file mode 0600, adds the default .env.local target to .gitignore when needed, and refuses to overwrite an existing key unless --force is passed. Custom env-file paths inside a git repo must already be ignored. Live production keys are created by tenant admins in Console and stored in deployment secret managers.
The package ships the paybond CLI (paybond, paybond-kit-init, paybond-kit-login, paybond-mcp-server).
Scaffold a starter project from bundled templates:
paybond init --template invoice-agent
pip install -r requirements.txt
paybond agent sandbox smoke --policy-file paybond.policy.yaml \
--operation saas.provision_seat \
--requested-spend-cents 2900 \
--evidence-preset cost_and_completion \
--result-body '{"status":"completed","cost_cents":2900}' \
--format jsonEnd-to-end sandbox smoke (bind + execute + evidence) with no app code:
paybond agent sandbox smoke \
--policy-file paybond.policy.yaml \
--result-body '{"status":"completed","cost_cents":2900}' \
--format jsonPolicy-file bootstrap maps evidence_preset to Gateway completion_preset only — do not also send evidence_schema (paybond-kit 0.11.4+). See Agent policy.
agent sandbox smoke only requires paybond-kit. Framework demo commands load their optional extras on demand.
Use this when you have a paid tool and want Paybond guardrails in the sandbox:
paybond-kit-init \
--preset paid-tool-guard \
--framework provider-agnostic \
--out paybond_paid_tool_guard.pyThe generated integration opens Paybond from the environment, loads .env.local when PAYBOND_API_KEY is not already present, bootstraps a sandbox guardrail intent, wraps your paid-tool handler, and submits sandbox evidence. It does not generate a paid-tool implementation. Free Developer is sandbox-only; live settlement rails start on paid production plans.
Every session is bound to the tenant realm echoed by gateway-authenticated service-account introspection.
Do not pass tenant ids by hand for normal SDK usage.
Construct one Paybond session per tenant/service account.
Treat any tenant or intent echo mismatch from Harbor as a severity-zero defect.
import asyncio
import os
from paybond_kit import Paybond
def required_env(name: str) -> str:
value = os.environ.get(name)
if not value:
raise RuntimeError(f"missing {name}")
return value
async def main() -> None:
paybond = await Paybond.open(
api_key=required_env("PAYBOND_API_KEY"),
expected_environment="sandbox",
)
try:
print("tenant realm:", paybond.harbor.tenant_id)
finally:
await paybond.aclose()
asyncio.run(main())Use Paybond Kit when an agent workflow needs delegated spend guardrails, tool-call budget checks, paid API or vendor action approval, evidence, release/refund logic, disputes, or audit-ready receipts.
import asyncio
import os
from paybond_kit import Paybond
async def main() -> None:
paybond = await Paybond.open(
api_key=os.environ["PAYBOND_API_KEY"],
expected_environment="sandbox",
)
try:
guardrail = await paybond.guardrails.bootstrap_sandbox(
operation="travel.book_hotel",
requested_spend_cents=20_000,
currency="usd",
)
guard = paybond.spend_guard(guardrail.intent_id, guardrail.capability_token)
guarded_tool = guard.guard_tool(
operation=guardrail.operation,
requested_spend_cents=guardrail.requested_spend_cents,
handler=book_hotel,
)
result = await guarded_tool({"hotel_id": "hotel_123", "max_price_cents": 20_000})
await paybond.guardrails.submit_sandbox_evidence(
guardrail.intent_id,
{"result": result, "sandbox": True},
)
finally:
await paybond.aclose()
asyncio.run(main())The paybond.harbor and paybond.guardrails clients are created by Paybond.open(...) and bound to the tenant resolved from the service-account API key. Production integrations read capability_token from paybond.intents.create(...), or from paybond.intents.fund(...) after an x402_usdc_base payment challenge is satisfied.
Core SDK:
Paybond.open(...) for API-key-only, tenant-derived hosted sessions
HarborClient for capability verification, intent creation, x402 funding, evidence submission, and ledger reads
paybond.signal and paybond.fraud on Paybond sessions opened from one service-account API key
PaybondIntents helpers for principal-side signing, x402 funding, payee-side signing flows, and settlement confirmation
PaybondSpendGuard, authorize_spend, and guard_tool for spend-named wrappers around capability verification
Runtime-neutral and framework aliases: paybond_agent_tool_spend_guard, paybond_runtime_neutral_tool_spend_guard, paybond_langgraph_tool_spend_guard, and paybond_mcp_tool_spend_guard
paybond_runtime_tool_call_adapter for agent SDKs and custom runtimes that expose a tool-call object plus an application-owned executor
Agent middleware and CLI:
PaybondAgentRun, tool registry, interceptor, and policy-file binding
paybond init, paybond agent run bind, paybond agent tool execute, and paybond agent sandbox smoke
Optional LangGraph, Claude Agents, and MCP integrations via extras (see table above)
Gateway and trust helpers:
GatewaySignalClient and ServiceAccountSignalSession for tenant-scoped Signal reads and signed portfolio artifacts
GatewayFraudClient and ServiceAccountFraudSession for tenant-scoped fraud assessments, review queues, review events, metrics, and release-gate config
list_plaid_banks and fund_ach_with_plaid_bank (paybond_kit.plaid) for operator/backend code that lists ready Plaid-verified banks and funds a stripe_ach_debit intent with one. Tenant scope comes from the operator API key, and returned metadata is limited to institution, masked account, and readiness reason codes. These are deliberately not exported from paybond_kit.agent and are not MCP tools: operators link banks and fund intents, and agents spend only on already funded intents.
Protocol-v2 helpers for mandate verification, replay-safe recognition proof verification, receipt reads, and A2A discovery
paybond-kit-login for sandbox device approval and local .env.local API-key setup
paybond-kit-init for generating a Paybond guardrail integration helper
Agent-facing surfaces are model-provider agnostic. Paybond verifies tool operations and tenant scope, not whether a tool call came from OpenAI, Anthropic, Gemini, a local model, or another runtime.
allowed_tools values are your own tool or operation names, not a Paybond-owned catalog. Harbor enforces string matching against whatever names you chose when creating the intent.
settlement_rail on intent creation is a principal-signed rail request. Stripe destinations and x402 receive addresses stay tenant-owned server-side config and are never supplied by the SDK caller.
The protocol-v2 surface is trust-first: signed mandates, recognition proofs, and receipts work across supported settlement adapters instead of treating any single rail as the product boundary.
Gateway-backed protocol helpers raise ProtocolHttpError with parsed error_code and error_message fields when the gateway returns a JSON error envelope. Recognition-gated flows surface unregistered_key, revoked_key, mandate_agent_key_mismatch, and protocol_binding_mismatch explicitly.
No console UI workflows, and no bank-linking flow: Plaid Link, public_token exchange, access tokens, and Stripe processor tokens stay server-side in the Gateway and are never accepted or returned by Kit
No bundled LLM or model runtime — bring your own agent framework and install optional extras when needed
No model-provider-specific MCP wrapper; the MCP server is host-agnostic and works with any MCP-compatible runtime
For local development from this directory:
python3 -m venv .venv
source .venv/bin/activate
pip install -e ".[dev]"
maturin developUse this path when you are editing the package itself or rebuilding the bundled native extension locally.
Agent + LLM discovery guide: https://paybond.ai/llms.txt
Coding-agent setup (Markdown mirror): https://paybond.ai/docs/kit/coding-agent-setup.md
Long-form docs: https://paybond.ai/docs/kit
Agent quickstart: https://paybond.ai/docs/kit/quickstart-agent
One-command guardrails: https://paybond.ai/docs/kit/one-command-guardrails
Python quickstart: https://paybond.ai/docs/kit/quickstart-python
Python SDK reference: https://paybond.ai/docs/kit/sdk-reference-python
Agent integrations: https://paybond.ai/docs/kit/agent-integrations
Support matrix (languages, frameworks, rails): https://paybond.ai/docs/kit/support-matrix
Package provenance and verification: https://paybond.ai/docs/kit/package-provenance
MCP server guide: https://paybond.ai/docs/kit/mcp-server
Agent runtime tutorial: https://paybond.ai/docs/kit/agent-runtime-tutorial-python
Python example projects: https://paybond.ai/docs/kit/examples-python
LangGraph patterns: https://paybond.ai/docs/kit/quickstart-python#agent-framework-integrations
Free Developer sandbox signup: https://paybond.ai/signup
For maintainers working from a source checkout, release verification lives in this package directory:
python3 scripts/verify_release.pyThis builds wheel and sdist artifacts, inspects them for stray local files, validates metadata/extras, and smoke-installs the built wheel in a temporary virtual environment.
For maintainers only:
export MATURIN_PYPI_TOKEN="pypi-..."
./scripts/publish_release.shThis reruns release verification and then publishes the sdist and wheel with maturin publish --non-interactive.
Use this when an agent has an intent_id and capability_token and needs a tenant-bound spend gate before calling a side-effecting tool, paid API, vendor action, or settlement workflow. Do not use this for creating, funding, or changing intents; call paybond_create_spend_intent or paybond_fund_intent first when no funded capability token exists.
Inputs: intent_id (required), operation (required), token, requested_spend_cents. Returns: allow, tenant, message, audit_id, +5 more
Use this when building or testing a first paid-tool integration and you need a sandbox-only guardrail intent with no live settlement rails. Do not use this for production live money movement or already-created Harbor intents.
Inputs: operation (required), requested_spend_cents (required), currency, metadata, +2 more. Returns: intent_id, operation, tenant_id, settlement_mode, +4 more
Use this when you already have a fully signed Harbor intent request body and replay-safe recognition proof for the gateway /harbor/intents route. Do not use this for the normal agent spend-control path unless you specifically need the low-level Harbor API; prefer paybond_create_spend_intent.
Inputs: body (required), recognition_proof (required), idempotency_key. Returns: state, intent_id, capability_token
Use this when an agent workflow needs a new Paybond spend intent with bounded budget, allowed operations, evidence requirements, and settlement review. Do not use this for checking an already funded capability token; use paybond_authorize_agent_spend before the paid action.
Inputs: body (required), recognition_proof (required), idempotency_key. Returns: state, intent_id, capability_token
Use this when you need a read-only explanation of whether a proposed spend would allow, require approval, or deny under the tenant spend-control policy. Do not use this to authorize spend or create approval requests; call paybond_authorize_agent_spend to persist a decision.
Inputs: intent_id (required), task_id, currency, operation, +7 more. Returns: outcome, explanation, reason_codes, remaining_cents, +1 more
Fetch the published Paybond A2A discovery card for protocol-trust delegation.
Inputs: no named parameters. Returns: object
Fetch one published Paybond A2A task contract by identifier.
Inputs: contract_id (required). Returns: object
Use this when you need the signed paybond.agent_receipt_v1 JSON for one receipt_id (SHA-256 action id or intent-terminal UUID) via tenant-bound Gateway GET. Do not use this for protocol settlement receipts—call paybond_get_settlement_receipt_v1. For agent-to-agent handoff without embedding JSON in prompts, prefer the MCP resource paybond://receipt/{receipt_id} (resources/read verifies at the operational tier). Validity tiers beyond operational, continuity-chain, inclusion proofs, owner disclosure, and ACTA/PEF/SCITT adapters are Kit/CLI/Gateway auditor surfaces—not this tool's job. Read-only and side-effect free.
Inputs: receipt_id (required). Returns: kind, tenant_id, receipt_id
Fetch one tenant-scoped compliance audit export job detail through the gateway operator view.
Inputs: job_id (required), issue_download. Returns: object
Use this when you need a read-only dry-run of remaining spend budget for a tenant-bound intent before authorizing a paid tool. Do not use this to authorize spend or create decisions; call paybond_authorize_agent_spend when you are ready to gate a side-effecting tool.
Inputs: intent_id (required), task_id, currency, operation, +7 more. Returns: spend_scope, policy_version, remaining_cents
Use this when you need the read-only fraud assessment and review posture for one known tenant-scoped operator DID (review state, fraud signals, and compact fraud_assessment). Example: look up operator_did=did:web:vendor.example#booker-agent (optionally score_version=1.0) before deciding whether to continue a spend workflow for that operator. Do not use this for tenant-wide fraud backtesting metrics—call paybond_get_fraud_metrics instead—or for Harbor intent escrow detail—call paybond_get_intent. Idempotent read; returns null when no assessment exists for that operator.
Inputs: operator_did (required), score_version. Returns: tenant_id, operator_did, fraud_assessment
Use this when you need tenant-wide Signal fraud backtesting and monitoring metrics over a rolling window (flagged operators, severity counts, review outcomes, precision/false-positive rates, and backtest_summary). Requires PAYBOND_API_KEY with Signal analytics read access and the private-dashboards feature. Do not use this for one operator's fraud posture—call paybond_get_fraud_assessment instead—or for Harbor intent escrow detail—call paybond_get_intent. Idempotent read with no side effects; omit window to default to 24h; unsupported windows fail with HTTP 400 ("window must be one of 24h, 7d, or 30d").
Inputs: window, score_version. Returns: window, tenant_id, window_ended_at, backtest_summary, +10 more
Fetch one tenant-scoped Harbor intent detail through the gateway operator view.
Inputs: intent_id (required). Returns: object
Use this when you need a read-only, tenant-scoped Signal portfolio aggregate for the authenticated API key (operator_count, average_score, total_terminal_intents, total_receipted_volume_cents, operators_under_review, and checkpoint_last_ledger_seq). Requires PAYBOND_API_KEY with Signal analytics read access and the private-dashboards feature. Do not use this when you need a portable signed operator list for partner or verifier sharing—call paybond_get_signed_portfolio_artifact instead—or for one operator's signed receipt—call paybond_get_reputation_receipt. Idempotent read with no side effects; auth, RBAC, feature, or gateway failures surface as tool errors.
Inputs: score_version. Returns: tenant_id, average_score, scoring_model, operator_count, +6 more
Use this when you need to confirm which tenant-bound service-account principal the configured PAYBOND_API_KEY authenticates as (tenant_id, subject, and roles). Call early as a prerequisite before Harbor escrow, Signal reads, or other tenant-scoped tools when tenant identity is unknown. Not required before every later call once tenant_id is already known from a prior principal response or host config. Do not use this when you need Harbor intent escrow detail; use paybond_get_intent instead when you have an intent_id. Do not use this for A2A discovery; use paybond_get_a2a_agent_card instead. Makes one read-only external GET to the gateway principal endpoint; idempotent identity lookup with no side effects (no mutations, spend reservations, escrow changes, or ledger writes); auth or gateway failures surface as tool errors.
Inputs: no named parameters. Returns: roles, subject, tenant_id
Use this when you need the signed Signal reputation receipt for one known tenant-scoped operator DID (score, metrics, reason codes, and Ed25519 signing material under receipt). Requires PAYBOND_API_KEY with Signal analytics read access. Do not use this for tenant-wide aggregates—call paybond_get_portfolio_summary—or a portable signed operator list—call paybond_get_signed_portfolio_artifact—or one operator's fraud review posture—call paybond_get_fraud_assessment. Idempotent read with no side effects; returns null when no receipt exists for that operator and score_version.
Inputs: operator_did (required), score_version. Returns: receipt, updated_at, schema_version
Fetch the signed protocol-v2 settlement receipt for one Harbor intent.
Inputs: receipt_id (required). Returns: object
Use this when you need a portable, tenant-scoped signed Signal portfolio snapshot (operator list plus Ed25519 signing material) for offline verifier checks or partner sharing—not a public leaderboard. Requires PAYBOND_API_KEY with Signal analytics read access. Omit score_version to use the gateway default current model (1.0). Do not use this for tenant-wide aggregates without signatures—call paybond_get_portfolio_summary—or for one operator's signed receipt—call paybond_get_reputation_receipt—or for one operator's fraud review posture—call paybond_get_fraud_assessment. Idempotent read with no side effects; auth, RBAC, feature, or gateway failures surface as tool errors.
Inputs: score_version. Returns: kind, tenant_id, signature_hex, score_model_version, +1 more
Import a signed AgentMandateV1 through the gateway v2 protocol surface and bind it to one Harbor intent using a replay-safe recognition proof.
Inputs: intent_id (required), signed_mandate (required), recognition_proof (required), transport_binding. Returns: object
Fetch the published catalog of Paybond A2A task contracts for delegated Harbor workflows.
Inputs: no named parameters. Returns: object
List tenant-scoped compliance audit export jobs through the gateway operator view.
Inputs: limit, cursor. Returns: object
List tenant-scoped Harbor intents through the gateway operator view. Supports optional status, operator DID, limit, and cursor filters.
Inputs: limit, cursor, status, operator_did. Returns: object
Use this when you already have a Harbor evidence request body and recognition proof for the gateway /harbor/intents/{id}/evidence route. Do not use this for the high-level spend-control path unless you need the low-level Harbor API; prefer paybond_submit_spend_evidence.
Inputs: body (required), intent_id (required), recognition_proof (required), idempotency_key, +1 more. Returns: state, intent_id, evidence_id
Use this when a sandbox guardrail intent needs evidence to complete simulator settlement or predicate checks. Do not use this for live Harbor spend evidence; use paybond_submit_spend_evidence for production spend intents.
Inputs: intent_id (required), payload, metadata, artifacts, +4 more. Returns: intent_id, operation, tenant_id, payload_digest, +3 more
Use this when a Paybond spend intent needs signed evidence so release, refund, review, and receipt generation use the same audit-ready record. Do not use this to create or fund intents, and do not use it for sandbox guardrail evidence.
Inputs: body (required), intent_id (required), recognition_proof (required), idempotency_key, +1 more. Returns: state, intent_id, evidence_id
Pre-validates vendor and canonical completion evidence against catalog JSON Schemas and preset forbidden_evidence_fields. Required before evidence submit tools when PAYBOND_MCP_EVIDENCE_POLICY=strict. Harbor remains authoritative at submit time.
Inputs: preset_id (required), vendor_payload, canonical_payload, frozen_vendor_api_version, +2 more. Returns: ok, preset_id, pack_stale, drift_kinds, +4 more
Verify a signed AgentMandateV1 envelope through the gateway v2 protocol surface.
Inputs: signed_mandate (required). Returns: object
Use this when you already have a signed paybond.agent_receipt_v1 JSON object and need an offline operational-tier (default) Ed25519 signature check—schema, digest, and Gateway signature—matching resources/read on paybond://receipt/{receipt_id}. Optional validity_tier=primary|attested raises the bar (payee digest / operator attestation). Do not use this for protocol authorization/settlement receipts—call paybond_verify_protocol_receipt_v1. Continuity-chain audits, inclusion proofs, owner disclosure, and ACTA/PEF/SCITT are Kit/CLI/Gateway auditor surfaces. Read-only and side-effect free: success returns valid=true with kind, receipt_id, tenant_id, and the normalized receipt; failures raise a clear verification error.
Inputs: receipt (required), validity_tier. Returns: kind, valid, receipt, tenant_id, +2 more
Verify a replay-safe AgentRecognitionProofV1 against an expected purpose and request envelope. Verifier context (tenant_id, verifier_id) is derived from the authenticated MCP session only.
Inputs: proof (required), expected_purpose (required), expected_request (required). Returns: object
Use this when you need raw capability-token verification for one tenant-bound Harbor intent. Do not use this to create, fund, or modify intents; use paybond_authorize_agent_spend as the clearer gate before side-effecting agent tools.
Inputs: intent_id (required), operation (required), token, requested_spend_cents. Returns: allow, tenant, message, audit_id, +5 more
Use this when you already have a signed protocol-v2 authorization or settlement receipt JSON object and need offline Ed25519 verification (structure, message digest, and signature) through the gateway. Do not use this to verify AgentMandateV1 envelopes—call paybond_verify_agent_mandate_v1—or to check a Harbor capability token before spend—call paybond_verify_capability or paybond_authorize_agent_spend. To load a settlement receipt by intent UUID first, call paybond_get_settlement_receipt_v1 then pass its body here. Read-only and side-effect free: success returns valid=true with kind, receipt_id, tenant_id, and the normalized receipt; unsupported kind, malformed JSON, digest mismatch, or bad signature fail with a gateway error (typically HTTP 400).
Inputs: receipt (required). Returns: kind, valid, receipt, tenant_id, +1 more
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Scored across 31 tools
Each tool has a meticulously crafted description that clearly states its purpose and explicitly lists what NOT to use it for, eliminating ambiguity even across similar-looking tools like paybond_create_intent vs paybond_create_spend_intent.
All tools follow a consistent 'paybond_verb_noun' pattern (e.g., get, verify, submit, list, create) with optional version suffixes, making the naming predictable and systematic.
With 31 tools, the server is far beyond the typical 3-15 range. While the domain is complex, the large surface area can overwhelm agents and increase selection difficulty.
The tool set covers a broad range of fintech operations: identity, intents, capabilities, evidence, fraud, reputation, A2A, receipts, and mandates. Minor gaps like refunds or dispute resolution might exist, but core workflows are well-supported.
Pay for APIs with USDC. Read-only x402 payment discovery, verification, evidence, and status.
Discover machine-payable APIs, probe x402 payment terms, and run seller operations. Non-custodial.
Machine-payable API infrastructure for autonomous agents. Per-call x402 settlement in USDC.
Payment identity intelligence for AI agents.
