Changelog

Limits that apply to every tool call, and answers from anywhere.

• PayPal — wrap PayPal's own MCP server; refunds and disputes are priced, and access tokens are minted from your app credentials
• Pricing for wrapped MCP tools — limits and budgets apply to what a call actually sends out
• overLimit: pending_approval — over a limit, ask a human instead of refusing
• Agent budgets — a daily ceiling per agent across every resource
• A request with no amount against a limited rule is held for a human, never counted as zero
• Phone approvals with shotoku telegram, and a local dashboard with shotoku ui
• Approvals record the channel they came through (terminal, dashboard, telegram)
• A human approval now lets the agent's identical retry through, once
• x402 judges the host the agent requested, not what the 402 response claims
• Runnable PayPal sandbox demo in examples/paypal

Enforcement layer: gateway and MCP wrapping mode.

• Local enforcement gateway — forward proxy that blocks requests before they leave the machine
• MCP wrapping mode — gate any upstream MCP tool server, block agent self-approval
• Fail-closed boot — gateway refuses to start without a valid policy
• Signed receipts — approved decisions carry a short-lived HMAC token for downstream verification
• Signed snapshots — tamper-evident policy + ledger state you can verify at any point

First public beta. Core authorization flow works end-to-end.

• Local-first authorization engine with policy evaluation
• Append-only JSONL decision ledger
• CLI commands: authorize, status, history, approve, deny, decision
• MCP server with authorize_action, get_decision, get_pending_approvals tools
• x402 demo integration