Docs / Spend control over MCP

Give Claude (or any MCP agent) a budget

Short answer: add the @countersign/mcp server to your MCP client's config — one paste, no install step — and the agent gains 13 tools for governed spending: a pre-flight spend guard, spending limits, human approvals, payment-challenge guards for x402 and AP2, a signed audit ledger, and a kill switch. Works in Claude, Cursor, and any client that speaks the Model Context Protocol.

The one-paste setup

{ "mcpServers": { "countersign": {
  "command": "npx", "args": ["-y", "@countersign/mcp"],
  "env": { "COUNTERSIGN_URL": "https://app.countersign.network",
           "COUNTERSIGN_API_KEY": "csk_…" } } } }

The key is self-serve: POST /signup at app.countersign.network/start returns a free key and an isolated sandbox tenant pre-seeded with a three-backend demo fleet — no account, no human in the loop. The server is stdio-only and brain-free: it talks to the hosted Core (or your self-hosted one) through the same public API you could call yourself.

What the agent can (and can't) do with it

• request_spend — the pre-flight guard. The agent asks before money moves; the answer is ALLOW, DENY with a reason, or NEEDS_APPROVAL with a hold token for a human. Fail-closed: unknown assets, unlisted venues, and a frozen fleet all deny.
• guard_x402 / guard_ap2 — hand the raw x402 402-challenge or AP2 mandate to the guard before paying or signing; spoofed and garbage options are dropped before the policy check.
• apply_policy — set per-transaction and daily caps, allowlists, approval thresholds, venue rules, and negotiation guardrails.
• freeze / unfreeze — the kill switch, fleet-wide or per-agent, across every connected rail at once.
• ledger, approvals, health, list_agents, list_approved_venues — the audit trail (independently verifiable offline) and fleet state.

What it can't do matters just as much: Countersign never holds keys, never signs, never moves funds. The MCP server carries decisions, not custody — the enforcement lives in the wallet rails and the fail-closed Core.

Why gate an LLM's spending at all?

Because the failure modes are the model's, not the wallet's: a retry loop, a misread price, a prompt-injected "pay this now." A budget stated in the prompt is advice; a policy enforced outside the model is a control. The guard makes every spend a checked API call, and the kill switch makes "stop everything" one action instead of a runbook.