Shotoku – local authorization layer for AI agents

Developers Julius and Issa, two developers from France, released Shotoku, an open-source local authorization layer that enforces per-transaction (maxAmount) and rolling 24-hour (maxDailyAmount) spending limits for AI agents before any payment executes. Shotoku runs entirely on the user's machine with no account, cloud or telemetry, writes every approved, denied or pending decision to a local append-only data/decisions.jsonl file, and integrates via a plain TypeScript function or an MCP server that wraps other MCP servers, including PayPal's, with the product currently in beta and tested end to end against PayPal's sandbox. The tool holds no funds, stores no credentials or private keys, and never signs or settles payments, positioning policy enforcement as separate from the agent's own wallet or payment rail.

Give your agents a budget, not your card. Budgets, approvals, and a tamper-evident audit trail for AI agent spending — enforced before the payment happens, entirely on your machine. Deterministic. No custody. Agents spend. Shotoku checks first. Every autonomous action needs a decision. Local-first by design. Every spending decision stays on your machine. Policies decide. Budgets and rules, in one YAML file. One function call. Add spend controls to any agent in minutes. Give it a budget. Policy rules take maxAmount per transaction and maxDailyAmount a rolling 24-hour limit per vendor, and a budget caps everything one agent spends per day. Over a limit, the request is denied before the payment happens, or held for you with overLimit: pending approval, so small refunds go through and a big one waits for a human. An if statement is logic. Shotoku is infrastructure. It gives you rolling budgets, a structured audit trail, a human approval queue, policy as config instead of code, and MCP integration — so the same rules apply whether your agent runs in your terminal, in Claude, or anywhere else. Put Shotoku in the path. In MCP wrapping mode, Shotoku sits in front of the agent's other MCP servers, PayPal's included, so every tool call is decided before it reaches them and the agent has no other route through the protocol. Elsewhere, signed receipts: every approved decision carries a short-lived token that your payment proxy or CI verifies before executing. Shotoku still never touches your funds. Never. Shotoku holds no funds, stores no credentials or private keys, and never signs or settles a payment. It only decides whether a spend is allowed and records that decision — your agent's own wallet or payment rail does the executing. Logging records what happened. Shotoku decides what should happen before it does. The budget checks, approval queue, policy evaluation, and structured reasons are what make it enforcement rather than observability. No. Shotoku runs entirely on your machine. No account, no cloud, no telemetry. Decisions are stored locally in a JSONL file you can inspect, move, or delete at any time. In a local append-only file at data/decisions.jsonl inside your project. Every authorization decision — approved, denied, or pending — is written there in plain text. Yes. The core is a plain TypeScript function: if your agent can call a function, it can use Shotoku. Any MCP-compatible agent can use the MCP server without code changes, and wrapping puts the MCP servers it already uses, such as PayPal's, behind your policy. Yes. shotoku telegram sends each pending decision to your Telegram with Approve and Deny buttons. Only your taps count, and nothing listens on your machine. There is also a local dashboard shotoku ui and a terminal UI. The agent receives a structured response with the denial reason and a decision ID. What happens next is up to you — retry, surface it to the user, or halt. Shotoku records the decision either way. Shotoku is in beta — early but functional. The core authorization path is stable and tested, and it runs end to end against PayPal's sandbox. Use it for real projects, but expect the API to evolve. File issues and we'll ship fixes fast. Shotoku is built by Julius @juliuspsc https://x.com/juliuspsc and Issa @prunier issa https://x.com/prunier issa — two developers from France who care deeply about building great software. Shotoku is open-source today, with plans to grow into an enterprise product. Contributions and feedback are very welcome. Your agents are already spending. Set the limits.