Every payment an agent wants to make passes through SafePay before any money moves.
Policy you write in plain words, a live-web check of the payee, reasoning about whether the payment serves the agent's task, one-tap human approvals, a kill switch per agent, and a signed hash chain of every decision. For PayPal payments and for stablecoins (PYUSD, USDC). Measured against 17 real attacks, not asserted.
The fraud an agent with a wallet walks into
An agent that pays invoices inherits all of it, at machine speed and without a clerk's doubt. SafePay's rules are these attacks by name: lookalike payee, changed bank details, duplicate invoice, instructions hidden in the invoice. Sources: FBI IC3 2025 Internet Crime Report; AFP 2025 Payments Fraud and Control Survey.
In production today: Impulsa
Impulsa, a SaaS for micro-businesses in Chile, runs SafePay's history rules on every supplier document before it is saved: a document recorded twice is stopped, a unit cost far above that product's history is held. What each owner does with an alert is measured: corrected (an error that did not get saved) or recorded anyway (an alert that was not needed).
Reading the live tallies…
Any agent, any rail
Any agent asks before it pays
SafePay Check is a remote MCP server: before its own checkout, an agent sends the merchant, the amount and the task, and gets allow, hold or block with the reasons and a signed attestation. It moves no money. Listed in the official MCP Registry as com.agentposhq.safepay/check and submitted to Meta's Muse Connector Platform for review.
PayPal and stablecoins, one guardrail
PYUSD and USDC payments pass the same rules, plus what only stablecoins need: the network named, the token issued there, a valid address for that network (a stablecoin sent to the wrong one is lost for good). After the payment, SafePay reads the transaction on the public Stellar ledger and checks it against its signed precheck: payee, Circle's USDC, amount, timing. Verified against a real AgentPOS payment on Stellar mainnet. SafePay validates; it never moves the stablecoins.
How a payment travels
The layers, cheapest and strictest first
Per-payment and daily caps, categories, allow and block lists, an approved vendor directory that catches lookalike domains and inflated invoices, and "ask me before anything over X". A breach is a hard block, no model call spent. Written in plain words, drafted by Nemotron, reviewed by you, and signed in your browser with a key the server never holds.
Tavily pulls fresh, neutral evidence about the payee and the model judges it: a first-hand scam complaint or a payee with no footprint raises a hold. Sources are kept with the decision, one click away.
NVIDIA Nemotron on Nebius reads the task the agent was given and judges whether this payment serves it. The attack a rule set misses: a cloud-invoice agent steered into a casino payout.
Every decision, approval, policy change, order and settlement is a link in a hash chain, HMAC-signed. A payout that reaches PayPal without a decision is flagged as outside the firewall and the operator is alerted on Telegram.
Proof, not promise
| Benchmark mode | Attacks caught | Legit allowed |
|---|---|---|
| policy only (rules, no model, no web) | 9 / 17 | 8 / 8 |
| full (policy + Tavily + Nemotron) | 16 / 17 | 8 / 8 |
| strict (full + hold unknown vendors) | 17 / 17 | 8 / 8 |
17 realistic attacks on a wallet-holding agent (prompt injection in invoices and vendor pages, goal mismatches, lookalike recipients, inflated amounts, slow drains, bursts, a duplicate invoice, a "we changed our bank details" payee change) plus 8 real invoices. Reproducible: benchmark/attacks/ in the repo.
Plug it in
As a library (pip install safepay), as a remote MCP server any agent can call before it pays (SafePay Check), as a local MCP server (seventeen tools), in front of PayPal's own MCP server with one config line (safepay-mcp-proxy), as the approver in front of the PayPal Agent Toolkit, or as this console. Payments go out through PayPal Payouts, or as captures on a budget authorized with PayPal (a mandate), in the sandbox; the host is pinned so no real money can move.
Early access
SafePay is open source. If your agents already pay vendors, or are about to, we will put this guardrail in front of their PayPal payouts with you, by hand, and shape the product around what breaks.