Step 1
Install the gate
npm install -g buzz-axiru
Node 22 or newer. Apache-2.0, no account, nothing phones home.
Open source · For Claude Code · Apache-2.0
Claude Code agents get spending tools before they get spending limits.
Add a payment MCP server to Claude Code and the agent holds every tool that server exposes. buzz-axiru sits between the agent and those tools as a gating MCP proxy: a deterministic local policy decides allow, deny, or park for human approval before money moves, and no LLM is anywhere in that decision path.
The shape of it
The agent sees the gate, not the raw payment server.
Claude Code registers one stdio MCP server: the gate. The gate spawns your payment MCP server(s) as children, re-exposes their tools, and intercepts every payment-class call for a policy decision first. Nothing about the agent's workflow changes; the tools it sees are the tools it always had. Now they answer to policy.
The distinction that matters: this is a control plane, not a prompt. Instructions are exactly what an attacker manipulates, so a spending limit that lives in the system prompt is not a spending limit. A deterministic policy decision between the agent and the rail is.
Get running
Install to verified gate in five steps.
Everything below is copy-pasteable. One property to hold onto throughout: the gate fails closed. A missing key or a downstream server that will not start refuses to serve rather than run degraded, so a setup that passes verification is a setup that is actually enforcing.
Step 2
Write a starter policy
buzz-axiru quickstart --harness claude-code
quickstart writes a starter policies.json in the current directory and prints the wiring steps for this harness. Edit the caps and the counterparty allowlist to your own numbers before anything goes live.
Step 3
Register the gate with Claude Code
The shortcut (0.5.2+): let the gate do its own wiring.
buzz-axiru adopt --harness claude-code
The manual path (works on every version): register the gate as a stdio MCP server yourself.
claude mcp add payments -- buzz-axiru
Or pin it to one project and its checked-in config by adding it to .mcp.json at the project root:
{
"mcpServers": {
"payments": {
"command": "buzz-axiru",
"args": []
}
}
}Step 4
Route the payment server through the gate
Point the downstream array in policies.json at your payment MCP server instead of registering that server with Claude Code directly. The agent should see the gate, not the raw server; a server registered directly is a server the policy never touches.
Step 5
Verify, outside and inside
buzz-axiru quickstart --check
This starts each downstream server the way serve does and reports its tool count and which tools are gated; buzz-axiru doctor runs the same diagnosis. If the output is not what you expect, stop and fix the config before letting the agent near anything real. Then verify from the inside: ask the agent to call its axiru_gate_status tool and report what it sees. An agent that cannot call the tool is not wired through the gate, whatever the config says.
What you get
A policy gate, a ledger, and a human in the loop.
The gate ships with preset controls in policies.json: a per-agent daily cap, a single-payment ceiling that routes to a named approver, a counterparty allowlist, business-hours routing, and a velocity count cap. Around them, four properties do the real work.
A gating MCP proxy
Claude Code talks to buzz-axiru, buzz-axiru spawns your payment MCP server(s) as children, merges their tools with tool_prefix namespacing, and intercepts payment-class calls. Tool-name collisions are a startup error, not a silent override.
A deterministic decision path
Pure local policy evaluation decides allow, deny, or park for human approval. No LLM in the decision path, no network call to decide, no account, no custody of funds or keys. And the gate fails closed: a missing key or a downstream server that will not start refuses to serve rather than run degraded.
A hash-chained decision log
Every decision lands in an append-only log with a SHA-256 hash chain. buzz-axiru verify checks the chain end to end from the CLI.
A human approval queue
Parked calls wait for a person: buzz-axiru pending lists them, approve grants them, and reconcile resolves an ambiguous approved execution with provider evidence instead of retrying it into a possible duplicate payment.
Scope, stated plainly: the gate governs the tools routed through it, nothing else. An agent that can read a payment key out of your .env and hit the API from the shell is outside the gate's authority; the gate bounds the tool path, and your permission settings bound the rest. Run one gate instance per agent and set BUZZ_AXIRU_AGENT_PUBKEY so caps attach to the right identity; unattributed traffic shares a single cap by design.
Try to break it
The three prompts to throw at it first.
Do not take the gate's word for it. Give your agent these instructions against a test payment server and watch what the ledger records.
Pay a counterparty that is not on the allowlist
Prompt: pay 50 dollars to vendor-x.example, where vendor-x.example is not on the allowlist. The gate returns a structured denial with a reason code; the payment server never sees the call, and the decision is the last line of the ledger.
Pay an amount above the single-payment ceiling
The call is parked verbatim and the agent gets pending_approval. Run buzz-axiru pending to see it waiting, then decide it from the CLI; the agent's retry does not execute anything.
Split it into ten smaller payments
The velocity count cap and the trailing daily cap evaluate the aggregate, not the single call. Slicing a payment under the ceiling does not slice it past the policy.
Verified status
What has been tested, exactly.
Not yet verified end to end by us. buzz-axiru speaks standard MCP over stdio and the snippets above follow Claude Code's documented MCP configuration, but we have not run Claude Code against the gate ourselves. If you do, open an issue with the result either way; the packages are new, and honest field reports are worth more to us than stars.
Next step
The gate is one package. The whole decision layer is open source.
buzz-axiru runs on the published @axiru/agent-spend-guardrails library, and the rest of the Apache-2.0 set lives on the open source page. The same gate also wires into Block's Buzz and into Codex.
Start in shadow mode first. Move to live enforcement later.