Show HN: My AI spent $15 on a test order, so I built a payment guardrail

Developer built SpendShield, an open-source payment safety layer for Python and MCP, after his AI automation system charged 4 orders of ¥99 ($15 total) on a test order that was meant to be a dry run. SpendShield provides spend-capped digital identities, four deterministic gates (dry_run, budget, max_amount, approval), and an encrypted secret vault to prevent AI agents from spending money recklessly. The tool integrates with x402, the open payment protocol for AI agents, and is available via pip or Docker.

Before your AI spends real money, it passes through SpendShield. An open-source payment safety layer for Python and MCP. Give your AI agent a spend-capped digital identity KYA , run every payment through four deterministic gates, defend against prompt injection, and keep secrets in an encrypted vault. On August 9, 2026, my automation system ran a test order. I sent dry: true , expecting a price preview. The server only honored ?dry=1 — 4 orders of ¥99 were charged for real, and the money was gone. This is not just my problem. AI agents are about to order food, top up accounts, and call paid APIs on your behalf. When AI starts spending real money, who puts a gate in front of it? I turned my scar into a library. | Pillar | What it does | |---|---| 🔑 Identity KYA | Every agent gets a digital identity with its own budget/blacklist/limits. Unregistered agents are denied by default. | 🎯 Intent alignment | New recipients and large amounts always require human sign-off — stops prompt-injected agents from spending without you. | 🔐 Secret vault | Keys encrypted at rest AES-256 , master key never on disk. Key access passes the gates and is fully audited. | Every spend passes all of them. Rules are code, not AI opinion — agents cannot argue, trick, or inject their way past. | Gate | Default | Effect | |---|---|---| 🧪 dry run | On | Preview only. Nothing executes until you say so. | 💰 budget | Unlimited | Hard ceiling. Over budget means denied. | 🚧 max amount | Unlimited | Per-transaction cap. | 🙋 approval | Off | Human sign-off — console, Telegram, or webhook. | 📜 audit | On | Every attempt recorded, exportable JSON. | pip install spendshield Or run it with Docker MCP server : docker build -t spendshield . docker run -it spendshield 💡 Pre-built image on GHCR is coming soon requires a workflow-scoped GitHub token to publish the CI pipeline . python from spendshield import SpendShield, KeyVault guard = SpendShield budget=200, dry run=True, whitelist= "McDonald's" @guard.protect "order" def place order amount, to : return call real api amount, to place order amount=99, to="McDonald's" = DryRunBlocked: dry run mode, nothing executed guard.dry run = False for i in range 4 : place order amount=99, to="McDonald's" 3rd order blocked by BudgetExceeded guard = SpendShield dry run=False guard.register agent "mcd bot", budget=50, max amount=30, blacklist= "unknown vendor" , whitelist= "McDonald's" , rate limit={"window s": 60, "max calls": 3} @guard.protect "order", agent="mcd bot" def place order amount, to : return call real api amount, to python python -c "from spendshield import KeyVault; print KeyVault.generate key " export SPENDGUARD MASTER KEY= never commit this vault = KeyVault "vault.json" vault.store "mcd sk", "sk live xxx" guard = SpendShield key vault=vault guard.register agent "mcd bot", whitelist= "mcd sk" sk = guard.get secret "mcd sk", agent="mcd bot" passes identity + intent gates Claude Code, OpenClaw and any MCP-compatible agent can call the guard directly: spendshield-mcp --policy spendshield.yaml Tools: spend protect / spend status / spend audit / spend reset / secret get x402 https://x402.org is the open payment protocol for the internet HTTP 402 — how AI agents pay for APIs. SpendShield is the guardrail in front of it: x402 lets agents pay, SpendShield stops them paying recklessly. python from spendshield import SpendShield from spendshield.adapters.x402 import X402PaywallGuard, protect x402 payment guard = SpendShield budget=50, dry run=True pw = X402PaywallGuard guard Server side: every paid resource passes the gates before settlement pw.authorize resource "weather-api", price="0.01", asset="USDC", pay to="0x..." pw.confirm payment "weather-api", price="0.01", pay to="0x..." after settlement Client side: gate the payment before your agent pays protect x402 payment guard, amount=0.01, to="weather.example.com", agent="research bot" Budget, blacklist, rate limits, human approval, identity KYA and audit all apply to x402 payments — new recipients require human sign-off, unregistered agents are denied. 30 tests covering gates, identity, intent alignment, vault, and edge cases. python3 -m pytest tests/ - 🐛 Found a bug? Open an issue https://github.com/felixpg13-glitch/spendshield/issues/new?template=bug report.md - 💡 Have an idea? Suggest a feature https://github.com/felixpg13-glitch/spendshield/issues/new?template=feature request.md - 🔒 Security vulnerability? See SECURITY.md /felixpg13-glitch/spendshield/blob/main/SECURITY.md — report privately, not in a public issue. - ⭐ Found it useful? Star the repo so other people who got burned by "test orders" find it. MIT — take it. May no one get burned by a "test order" twice in the AI era.