Give AI agents spending power. Keep control.

Name: SanestlyPay
Author: Sanestly

An open-source payment policy gateway for AI agents. Set spending limits, require human approval, control session budgets, and audit every payment decision.

Try interactive demo View on GitHub

Public playground is a mock sandbox - no real money ever moves.

sanestlypay

$ pip install sanestlypay
$ sanestlypay-gateway

POST /v1/request-payment
{"amount_usd": "150", "category": "hosting"}

<- {"decision": "REQUIRES_APPROVAL",
    "approval_id": "apv_9f2..."}

How the gateway works

Every payment request is evaluated against policy before a provider is ever called. The agent gets a decision, not a credit card.

Your agent asks. A signed request describes amount, category, merchant, and justification. It never holds card secrets.
Policy decides. The gateway answers ALLOW, DENY, or REQUIRES_APPROVAL. Approval amounts reserve session budget atomically - concurrent requests cannot overspend.
A human resolves or the provider settles. Approvals are single-use; ambiguous provider outcomes are reconciled, never guessed. Every step lands in the audit trail.

Try a real decision

This widget talks to the live SanestlyPay gateway in mock mode. Same code path as the full Playground, no registration.

The interactive Playground

Nine scenarios in a credential-free visitor sandbox: allow, approval, rejection, denied category, budget limits, idempotent replay, provider timeout with reconciliation, session abort, and webhook inspection. Edit the policy, watch the budget bar, read the audit timeline.

Mock sandbox - no real money. Visitor sandboxes are isolated and reset automatically.

SanestlyPay Playground - payment form and policy editor

Human approval flow in the SanestlyPay Playground

Allowed payment result with decision reason

Spend controls that hold up under concurrency

Built for agents that run fast and in parallel - the rules are enforced in the database transaction, not in hopeful client code.

Spending policies

Per-payment, per-session, and daily limits
Allow and deny lists for categories and merchants
Approval thresholds above amounts you choose
Policy is evaluated before any provider call

Human approvals

Scoped API keys - an agent cannot approve itself
Single-use approvals via compare-and-set
Approver dashboard with CSRF-protected sessions
Rejections release the reserved budget immediately

Session budgets

Atomic reservations hold funds while approval is pending
Kill-switch aborts a session and releases holds
Reserved, settled, and remaining amounts stay consistent

Audit and recovery

Durable audit trail for every decision
Provider timeouts reconcile instead of guessing
Recovery sweep after restarts; webhook outbox retries

Providers - honest status

SanestlyPay is mock-first. Real money only moves through providers you configure with your own credentials.

Provider	Status
Mock provider	Verified end-to-end in CI and on the public demo
Stripe Issuing	Integration implemented; needs your Stripe credentials
x402	Payer flow implemented with wallet signing; testnet verification pending

SDKs, MCP, and framework integrations

One OpenAPI contract, HMAC-signed clients, and typed errors across ecosystems. MCP tools are read-only for approvals - an agent can ask, never self-approve.

Language	Package	Distribution
Python	`sanestlypay`	PyPI
TypeScript / Node	`sanestlypay`	npm
PHP	`sanestly/sanestlypay`	Packagist
Ruby	`sanestlypay`	RubyGems
Rust	`sanestlypay`	crates.io
Java	`com.sanestly.sanestlypay`	source (Maven Central pending)
Swift	`SanestlyPay (SwiftPM)`	git tag

Plus an MCP server (uvx sanestlypay) and examples for LangChain, OpenAI tools, CrewAI, AutoGen, and LlamaIndex.

Quick start

Credential-free local run - the demo uses the same gateway code with a mock provider and a throwaway SQLite database.

terminal

git clone https://github.com/dedalik/agentpaysdk.git
cd agentpaysdk
make demo

# open http://127.0.0.1:8080/sanestlypay/demo

mcp client

{
  "mcpServers": {
    "sanestlypay": {
      "command": "uvx",
      "args": ["sanestlypay"]
    }
  }
}

Security, said plainly

SanestlyPay reduces the blast radius of a misbehaving agent. It is not a payment processor and not a custody product.

Scoped keys: agent, approver, operator - separation of duties by design
HMAC-signed requests, idempotency keys, request-size limits, webhook SSRF guards
No raw card numbers in agent-facing responses, ever
Fail-closed startup: production refuses to boot on default secrets
Live-provider settlement still requires your own verification and credentials
Independent audit report and threat model ship in the repository

Open source, MIT licensed

Self-hosted, local-first, no Sanestly account required. Issues, ideas, and pull requests welcome on GitHub.

Open the demo GitHub