Every payment an agent wants to make passes through SafePay before any money moves.
Policy you write in plain words, a live-web check of the payee, reasoning about whether the payment serves the agent's task, one-tap human approvals, a kill switch per agent, and a signed hash chain of every decision. Measured against 17 real attacks, not asserted.
The fraud an agent with a wallet walks into
An agent that pays invoices inherits all of it, at machine speed and without a clerk's doubt. SafePay's rules are these attacks by name: lookalike payee, changed bank details, duplicate invoice, instructions hidden in the invoice. Sources: FBI IC3 2025 Internet Crime Report; AFP 2025 Payments Fraud and Control Survey.
How a payment travels
The layers, cheapest and strictest first
Per-payment and daily caps, categories, allow and block lists, an approved vendor directory that catches lookalike domains and inflated invoices, and "ask me before anything over X". A breach is a hard block, no model call spent. Written in plain words, drafted by Nemotron, reviewed by you, and signed in your browser with a key the server never holds.
Tavily pulls fresh, neutral evidence about the payee and the model judges it: a first-hand scam complaint or a payee with no footprint raises a hold. Sources are kept with the decision, one click away.
NVIDIA Nemotron on Nebius reads the task the agent was given and judges whether this payment serves it. The attack a rule set misses: a cloud-invoice agent steered into a casino payout.
Every decision, approval, policy change, order and settlement is a link in a hash chain, HMAC-signed. A payout that reaches PayPal without a decision is flagged as outside the firewall and the operator is alerted on Telegram.
Proof, not promise
| Benchmark mode | Attacks caught | Legit allowed |
|---|---|---|
| policy only (rules, no model, no web) | 9 / 17 | 8 / 8 |
| full (policy + Tavily + Nemotron) | 16 / 17 | 8 / 8 |
| strict (full + hold unknown vendors) | 17 / 17 | 8 / 8 |
17 realistic attacks on a wallet-holding agent (prompt injection in invoices and vendor pages, goal mismatches, lookalike recipients, inflated amounts, slow drains, bursts, a duplicate invoice, a "we changed our bank details" payee change) plus 8 real invoices. Reproducible: benchmark/attacks/ in the repo.
Plug it in
As a library (pip install safepay), as an MCP server any agent can call (seventeen tools), in front of PayPal's own MCP server with one config line (safepay-mcp-proxy), as the approver in front of the PayPal Agent Toolkit, or as this console. Payments go out through PayPal Payouts, or as captures on a budget authorized with PayPal (a mandate), in the sandbox; the host is pinned so no real money can move.
Early access
SafePay is open source. If your agents already pay vendors, or are about to, we will put this guardrail in front of their PayPal payouts with you, by hand, and shape the product around what breaks.