Agent payment security audit

Can a compromised agent move money outside policy?

Nine questions about how your agent pays. The verdict builds as you answer, across eight dimensions. Leave anything you do not know, it comes back as the exact question to ask your team.

Runs entirely in your browser. Nothing you type is sent anywhere.

or run it locally with npx @olurabian/audit

Your setup

9 of 9 answered

Example agent loaded. A common setup, a rail key in the runtime and caps that bite only at settlement. Edit any answer and watch the verdict move.

What does the agent buy, and how often? API credits, compute, data, vendors, on-chain.

What it buys

How often

Typical spend optional

Note shown in the report, never scored

What can the agent's runtime reach? List every tool, MCP server, SDK, and key in the agent's process.

Tools and SDKs

MCP servers

Payment credentials present in the agent's process, prompt, memory, or tools

How many distinct ways the runtime can move money optional

Where does the payment credential live? In the agent's process or prompt or memory, or behind a separate service or signer.

Credential location

Who executes the payment? The agent calls the rail itself, or it submits an intent to something that executes.

Executor

When a spend is approved, is it bound to a specific payee and amount, or can the agent supply any in-policy value?

Binding

What limits exist and where are they enforced? Per-action, daily, per-vendor. Checked before the spend or only at settlement.

Cap per spend optional

Cap per day optional

Where caps are checked

Budget is reserved the moment a spend is approved, not when it settles

Is there human approval for large spends? None, in-band where the agent decides, or out of band where a person approves the exact spend.

Approval

Approval threshold optional

Is there a record of every decision and the amount actually settled, and can it be tampered with?

A record of every decision exists

The record is tamper-evident, hash-chained or signed

The amount actually settled is in the record

How often does the agent's tool or dependency set change, and is the money-path re-checked when it does?

How often tools or dependencies change

When the money path is re-checked

Live verdict

Advisory with caps, forgery open and misdirection open

Single pathEXPOSED

CustodyEXPOSED

Mediated executionEXPOSED

Intent-bindingEXPOSED

No splittingEXPOSED

Human approvalEXPOSED

Provable auditEXPOSED

Continuous verificationEXPOSED

8 exposed0 partial0 closed0 unknown

What an attacker can do

Forgery openMisdirection open

The runtime holds a payment credential, the credential lives in the agent's runtime, and the agent calls the rail itself, so a poisoned instruction can forge a spend. The agent chooses the who and the how-much within policy and the agent approves its own requests, so the agent can misdirect a spend it is allowed to request.

Blast radius

One poisoned tool result pays any address, up to $500.00, with nothing between the agent and the rail.

Shortest path to closed

A payment-governance layer sits between the agent and the rail. The credential moves behind it, the agent submits intents, and the layer is the only path that can pay. Purse enforcement mode is one such layer.
The layer binds every grant to a payee and an amount, enforces caps before the spend, and reserves budget the moment a grant is minted, so an in-policy request cannot be misdirected and parallel small spends cannot outrun the day's limit.
Spends above a threshold wait for a person's approval given out of band, on a channel the agent cannot reach.
Every decision and the settled amount sit in a hash-chained receipt store that anyone can verify with plain SHA-256.
The money path is re-checked whenever the agent gains a tool, MCP server, or dependency, with an alarm on drift. A watcher can do the checking, the practice stays with you.

Advisory with caps, forgery open and misdirection open8 exposed, 0 closed, 0 unknown