English Français العربية

io.github.dingdawg/agent-spend-policy-mcp

Official registry Finance and payments

Local agent spend-policy checks. No funds, keys, payment authority, or network access.

Source code Documentation

Install

Add this to your client's MCP configuration (Claude Desktop: claude_desktop_config.json; Cursor: .cursor/mcp.json; VS Code and others use the same "mcpServers" shape).

NPM package @dingdawg/agent-spend-policy-mcp
Claude Code 
claude mcp add agent-spend-policy-mcp -- npx -y @dingdawg/agent-spend-policy-mcp@0.1.1
JSON configuration (Claude Desktop, Cursor, VS Code) 
{
    "mcpServers": {
        "agent-spend-policy-mcp": {
            "command": "npx",
            "args": [
                "-y",
                "@dingdawg/agent-spend-policy-mcp@0.1.1"
            ]
        }
    }
}

Documentation

From the project's README on GitHub, refreshed weekly. Links open on GitHub.

Contents
  1. DingDawg Agent Spend Policy MCP
  2. Safety boundary
  3. Install
  4. Tool
  5. Agent contract
  6. Development

DingDawg Agent Spend Policy MCP

A small, local MCP server that deterministically evaluates whether a proposed agent spend action matches a supplied policy.

It returns one of ELIGIBLE, DENY, or STEP_UP, with a stable reason code. ELIGIBLE is local policy evidence only. It is not payment authorization.

Safety boundary

This package does not hold funds, private keys, payment credentials, customer data, or settlement authority. It does not sign, send, settle, custody, or record payments. It makes no network requests.

A production payment adapter needs separate, independently verified controls for authenticated policy/action provenance, canonical payload hashing, durable atomic budget reservation and replay protection, customer-controlled signing, rail validation, and settlement reconciliation.

Install

npx -y @dingdawg/agent-spend-policy-mcp

Configure it as a local stdio MCP server:

{
  "mcpServers": {
    "dingdawg-agent-spend-policy": {
      "command": "npx",
      "args": ["-y", "@dingdawg/agent-spend-policy-mcp"]
    }
  }
}

Tool

evaluate_spend_policy accepts an evaluation time, a policy, a proposed action, and the already-spent amount. All money is passed as integer micro-unit strings, never JavaScript floating-point numbers.

The caller supplies the clock and already-spent value; therefore this tool is safe for dry runs and local evidence, not a replacement for a trusted payment or accounting system.

Agent contract

The versioned machine-readable contract is capabilities.json. It describes the only tool this package exposes, its required inputs, its three possible outcomes, and its non-negotiable safety boundary.

  • Transport: local stdio MCP
  • Tool: evaluate_spend_policy
  • Required inputs: evaluationTime, policy, action, and alreadySpentMicros
  • Outputs: ELIGIBLE, DENY, or STEP_UP, each with a stable reason code
  • Side effects: none
  • Credentials, payment execution, custody, signing, settlement, and network access: not supported

The manifest is package-source evidence for this release, not a promise of a hosted agent-discovery endpoint. ELIGIBLE remains local policy evidence only, not payment authorization.

Development

npm install
npm test
npm run pack:check

Frequently asked questions

What is io.github.dingdawg/agent-spend-policy-mcp?

Local agent spend-policy checks. No funds, keys, payment authority, or network access.

How do I install io.github.dingdawg/agent-spend-policy-mcp?

It runs on your machine. In Claude Code: claude mcp add agent-spend-policy-mcp -- npx -y @dingdawg/agent-spend-policy-mcp@0.1.1. For other clients, paste the JSON configuration from this page into their MCP settings.

Does io.github.dingdawg/agent-spend-policy-mcp need an API key?

Its registry entry lists no required key or secret. Some features may still need an account with the service it connects to.

Is io.github.dingdawg/agent-spend-policy-mcp open source?

Yes. Its code is on GitHub under the MIT license.

Who maintains io.github.dingdawg/agent-spend-policy-mcp?

It is published by DingDawg. AI.tn lists it but does not maintain or endorse it.

From the official MCP Registry. Listing is not an endorsement: review a server's code and permissions before giving it access to your data.