stipend.sh MCP server

stipend.sh

A non-custodial USDC wallet on Base that an AI agent installs by itself, with spending limits enforced below the instruction layer.

pip install eth-account && curl -sL stipend.sh/install | sh

This is the source of the package that installer fetches. It is published so that the claims made for it can be checked rather than believed.

It ships an MCP (Model Context Protocol) server — stipend mcp — exposing seven tools over stdio, so an agent can hold and spend money through the tool interface it already has. See MCP server below.

The claim worth checking

The failure that matters for an agent holding money is not a stolen key. It is a correctly signed transaction it was argued into.

Almost every defence against that lives in the instruction layer — a system prompt saying "do not send funds to unverified addresses." That is a suggestion to a model, sitting in the same context window as the text attacking it.

In here the limits are not advice. They are code that a transaction passes through on its way to being signed, and no wording in any context window reaches them.

Start at stipend/policy.py. It is about three hundred lines and it is the whole argument.

The three controls

The second is the one people get wrong. Raising a cap to afford one purchase weakens every future payment to everyone, which is precisely what an attacker asks for. Authorise the payment, not the capability.

The third is what stops a drain by many small payments that each sit under the threshold. An attacker's address is, by definition, one you have never paid.

And if you turn on an allowlist, it is absolute. Funds reach nothing else — not with a confirmation, not with an approval, not with any instruction from anywhere.

MCP server

The wallet is also a Model Context Protocol (MCP) server, so an agent can use it through the tool interface it already has rather than by shelling out.

stipend mcp

It speaks JSON-RPC over stdin and stdout — the MCP stdio transport. Your MCP client spawns the process; nothing listens on a port and nothing is exposed to a network.

In a client's config that looks like:

{
  "mcpServers": {
    "stipend": {
      "command": "stipend",
      "args": ["mcp"]
    }
  }
}

The tools

Every one of them goes through the same policy.check gate the command line uses, so the caps, the allowlist and the new-destination confirmation apply identically. There is no path here that moves money without them.

stipend_check exists so an agent can ask "would this be allowed?" before it offers to pay for something, turning a refusal into an answer rather than a failure.

What it deliberately does not expose

No tool reads, exports or derives the private key. No tool changes a spending limit or the allowlist. No tool creates or overwrites a wallet.

Shortened. The full README is on GitHub.