PlanBound

Spend controls for autonomous agents

Your agent asks for a plan, not a payment.

It shops the task first — real sellers, live quotes — and comes back with one priced, reasoned plan. One approval funds a single-use envelope holding exactly that ceiling. The agent runs unattended inside it and cannot exceed it, because the money is not there to exceed.

Open the consoleRead the code

What the human receives

Plan pln_7f3a91expires in 60 min

“Vet 3 counterparty wallets before I pay them”

vetting.planbound.eth

Approach: Screen every address for sanctions first, then price risk on the ones that clear · self-checked ×2

  • dropped one dead endpoint
  • deduped two steps on the same host
  • Market diversity$0.02A thin market means the risk score is not meaningfulworldchain live 402
  • Wallet Risk X-Ray$0.05A sanctioned counterparty voids the rest of the vettingbase live 402

Total quoted$0.07

Quoted against ceiling$0.12

$0.07 quotedhatched: headroom you are approving, not spending

Not consent to a transaction — the creation of the budget.

The problem

Neither of today’s answers is consent.

An agent that spends either holds a funded key — no budget, no scope, no kill switch — or interrupts its human on every call until the interruptions stop meaning anything.

93%

of Claude Code permission prompts are approved. The popup arrives without the context to judge it, so it gets rubber-stamped.

Anthropic’s own data, cited in The Human-in-the-Loop Illusion, 2026.

24.7%

of x402 endpoints publish a price at all. No total for a task exists before it runs — the plan is the first moment anyone knows what it costs.

TOLL·402 census of 78,290 routes, 2026-07-10.

  • Allow payment of $0.004 to sanctions-screen.x402?
  • Allow payment of $0.012 to wallet-risk.x402?
  • Allow payment of $0.012 to wallet-risk.x402?
  • Allow payment of $0.020 to market-diversity.x402?
  • Allow payment of $0.004 to sanctions-screen.x402?
  • Allow payment of $0.018 to wallet-age.x402?

Six asks, no total. Each is true, cheap, and impossible to judge alone.

One plan

“Vet 3 counterparty wallets before I pay them”

Total quoted$0.07

Ceiling$0.12

One decision, priced. Approve, and the ceiling is the only money that exists.

The mechanism

One decision, then a boundary that holds itself.

Six moments. Exactly one is yours; the rest happen inside a ceiling the thing spending against it cannot renegotiate.

  1. ShopBazaar discovery, then a live 402 probe of every candidate.
  2. PlanOne priced table, with a line of why per step.
  3. ApproveThe only human moment. One decision, whole task priced.
  4. FundA single-use account minted holding exactly the ceiling.
  5. PayThe agent buys out of that account, co-signed step by step.
  6. CloseThe remainder sweeps back; receipts land on HCS.

The shaded span runs unattended, with no further approval and no way to exceed the ceiling — the agent holds no funds of its own.

Envelope

The cap is a balance, not a row in a database.

Approval mints an account funded with exactly the ceiling. No service in the middle can fail open, because there is none — the ceiling is how much money exists.

Envelope minted · Hedera testnet

Funded$0.0500

Ceiling $0.0500filled to the edge, and no further

Who can move it

1-of-[ 2-of-2(agent, policy), treasury ]

  • 2-of-2Both signatures, or the transaction does not exist.
    • agentSigns the step it wants to pay for.
    • policySigns only if the live ask still matches the approved plan.
  • treasuryFunds the envelope and reclaims the remainder at expiry. Never spends on the agent’s behalf.

The agent can propose a payment, never complete one alone.

Drift

The wall is the plan, not the balance.

A step quoted at $0.010 met a real seller asking $0.050. The gate blocked it even though the envelope held enough to pay, because the plan the human approved was not the plan the agent found. What reaches you is a diff, with a price on every way out.

Step blocked · recorded run

Seller’s live ask$0.050

Quoted $0.010Stops at $0.012 — quote plus the 20% tolerance

  • Finish

    Top up the exact shortfall. The run completes.

  • Re-plan

    Re-price what remains. What was delivered is kept.

  • Abort

    Stop here. The remainder sweeps back.

Close

Every cent of the ceiling, accounted for.

One loop end to end on Hedera testnet: quoted, approved on a phone, an envelope minted, and the seller paid out of that same account. Quoted equals paid; the remainder came back.

Plan closed · funded $0.0500

Paid + swept + float$0.0500 — the whole ceiling, nothing unaccounted

  • Paid to sellers$0.0350Two steps, settled out of the envelope account itself
  • Swept back$0.0115Returned to the treasury when the plan closed
  • Fee float$0.0035The 0.05 ℏ the sweep leaves behind so the transfer fee can be paid

Stated plainly

  • Hedera testnet, faucet funds. Mainnet purchases stay off until you turn them on.
  • The Hedera-rail seller is ours — no Hedera x402 market exists yet. Every other seller is a stranger found through the Bazaar.
  • Policy logic runs off-chain. The 2-of-2 key is what makes bypassing it impossible, not the chain.
  • The drift above is our own estimate meeting a real ask. The rest of what is and isn’t proven is in the honesty box.
Others give the agent a funded wallet and enforce the limit in their own service. We give the agent zero funds and let consensus enforce the cap.The one-sentence difference

Built on

Each piece does real work.

Not a logo wall. Every line below is something you can open, run, or check against a chain.

Hedera
  • The envelope is a Hedera account, keyed 1-of-[2-of-2(agent, policy), treasury]
  • Keeperless refund scheduled at mint, so an abandoned plan returns itself
  • The envelope pays the seller directly — cap and payment, one account, one chain
  • Every decision and receipt written to HCS
  • Sellers discovered live through the Bazaar, never a hardcoded list
  • Prices are real HTTP 402 quotes, badged live or estimate and never blurred
  • One scheme-pluggable client across Hedera, Base and Worldchain
  • The gate sits in the only path money leaves by
  • Above a set ceiling, approving demands a proof an agent cannot produce
  • Enforced server-side, not by disabling a button
  • The nullifier binds an account to one human, so a leaked link is not enough
  • Selfie Check integrated on the beta preset
The Graph
  • The approver checks a seller’s settlement history before funding it
  • Claimed-against-settled reconciled against consensus, not our own database
  • A Substreams skill anyone can install — no Rust, reaches chains Studio dropped
MCP
  • Seven tools, two transports, one implementation
  • Remote server protected by OAuth 2.1 with our own consent screen
  • Installable as a plugin from a published marketplace

Connect it

Point your agent at it.

Seven tools over the Model Context Protocol. Claude Code registers itself, sends you to our consent screen, and comes back with a token scoped to one agent — no key to copy, and nothing that can spend until you approve a plan.

Remote, over OAuth
claude mcp add --transport http planbound https://planbound.xyz/api/mcp/http

Then /mcp→ authenticate. You approve on a screen that says exactly what the agent may do, and what it may not.

As a plugin
claude plugin marketplace add idoamram/planboundclaude plugin install planbound@planbound

The tools, plus the skills — including a generic Substreams indexer for reading settlements straight off a chain.

Where this goes

The envelope is the primitive.

None of the below is built. Each one is a short step from a mechanism that is — which is the reason to say them out loud rather than the reason to claim them.

Standing policy

The policy signer already refuses to co-sign a payment that leaves the plan. Give it rules the human writes once — per-service caps, blocked categories, a daily total — and a plan stops needing an approval at all until it breaks one.

Ranked by settlement

Discovery ranks sellers by what a catalog claims. The index already knows what has actually settled to each payout address. Ranking on that turns a directory into a market with a memory — and the seller cannot write it.

Beyond one task

The same key holds a weekly allowance as easily as a single errand: one envelope, refilled on a schedule, revocable by the treasury alone. Nothing about the structure assumes the plan is short.

See a plan, priced and reasoned.

The console lists real plans with their receipts, and diffs what we claim against what actually settled on-chain.

Open the consoleRead the code