IntentProof

An AI agent must ask IntentProof before it sends money. If the pay instruction came from a page, email, tweet, or tool result, the payment is blocked.

Install

pip install intentproof-guard
intentproof serve

Open http://127.0.0.1:8080

The top of the page is money already approved. The form under it is a manual test.

• Block means do not pay.
• Hold means a person must approve.
• Approve means the agent may pay.

From this folder before the package is on PyPI: pip install .

In your agent

from intentproof.sdk import IntentProof, PaymentBlocked

guard = IntentProof("http://127.0.0.1:8080", "dev", agent_id="demo")
guard.tracker.note_user("pay the hosting bill")
guard.tracker.note_fetched(page_or_tool_text)

try:
    guard.pay(rail="stripe", amount="12", recipient="acme hosting", instruction="pay the hosting bill")
except PaymentBlocked:
    pass  # do not call Stripe or the wallet

note_user is what the person typed. note_fetched or note_tool_output is anything the agent read. Call the rail only when pay() returns.

intentproof summary
intentproof config
intentproof config set daily_ceiling 750

Configuration

Settings live in intentproof.toml in the current folder. If the file is missing, the defaults below are used. A GUARD_* environment variable overrides the file. Restart intentproof serve after a change.

intentproof config prints the active values.

Where it runs

When a payment is blocked, held, or approved

Amounts are US dollars.

Trusted means the recipient is on the allowlist, or a person already approved a payment to them.

Two match settings are fixed in code: the copied instruction must be at least 12 characters, and a fuzzy match must score at least 0.86. That catches a payment whose words were copied from text the agent just read.

intentproof config set daily_ceiling 750
intentproof config set api_keys your-real-key