Shotoku

At a glance

Shotoku is an open-source, MIT-licensed spending gate for AI agents. Before a payment, paid API call or MCP tool call, it checks the request against rules in a policy.yaml file. It then approves it, denies it or holds it for you, and records each decision in a local hash-chained JSONL ledger. It never holds funds or keys, so your agent's own wallet or payment rail moves the money. Try it if your agents can already spend real money.

Good fit

Developers whose MCP agents (Claude Desktop, Claude Code, Cursor) or TypeScript agents make purchases, call paid APIs or issue refunds, and who want per-vendor and daily limits plus human approval for anything unusual. The documented PayPal setup is a concrete example: refunds go through PayPal's own MCP server, and any refund over $100 waits for a tap on your phone.

Consider something else when

Skip it if you need shared team control now. Org-level policies, Slack approval routing, multiple approvers and a central ledger dashboard are listed as coming soon. Skip it too if your agents never spend money or call paid services. Note that the basic MCP setup is advisory: the agent asks only because you told it to, so you must wrap your other MCP servers before Shotoku is a real gate.

Start here

With Node.js 20 or newer, run npx shotoku-cli demo to watch four simulated spends with nothing real configured. Then run npm install -g shotoku-cli and shotoku init in a fixed folder such as ~/shotoku-home. Add the shotoku-mcp server to your agent host's config with SHOTOKU_HOME set to that folder's absolute path. Ask the agent to spend $5 on openai.com and $12 on vendor-xyz.com. Success looks like the first spend approved and the second waiting in shotoku status until you run shotoku approve.

Cost and requirements

The open-source tier is free and includes the policy engine, the hash-chained ledger, the CLI and terminal UI, the MCP server, x402 payment authorization and signed snapshots. Team is listed as coming soon and Enterprise (SSO, RBAC, compliance export packs) is by conversation; neither has a published price. You need Node.js 20 or newer and either an MCP-compatible agent or code that calls authorize() from @shotoku/core. The vendor says it needs no account and sends no telemetry.

Limits to know

Shotoku is in beta (v0.2.0-beta shipped in July 2026). The vendor calls the core authorization path stable, says it runs end to end against PayPal's sandbox, and warns that the API will change. An approval covers only the identical request, once, within 15 minutes, so repeated spends belong in policy rules. The CLI reads the ledger in its current folder, so running it elsewhere shows no pending approvals. A request with no amount against a limited rule is always held for a human.

Related work

• Tarfio (alternative)
• Edge & Node: Agent Spending Without Controls (context)
• Coinbase: Why AI Agents Will Need Their Own Bank Accounts (context)
• The Agent Payments Stack (context)

Still unclear

• How much integration work does it take for a non-MCP payment proxy or CI job to verify Shotoku's signed receipts?
• When will the Team tier ship, and what will it cost?