MCP 服务器

spendnod

Enables human-in-the-loop authorization for AI agent transactions, allowing real-time approval or denial of purchases based on configurable spending limits, vendor blocklists, daily caps, and category restrictions.

README

SpendNod

Your AI agent wants to buy something — should it ask you first?

SpendNod is a human-in-the-loop authorization gateway for AI agent transactions. Set spending limits, vendor blocklists, daily caps, and category restrictions. Approve or deny from your phone.

Quick Start

Claude Code

claude mcp add spendnod --transport http https://api.spendnod.com/mcp

ChatGPT

Settings → Apps → Developer Mode → Create app → paste https://api.spendnod.com/mcp

Any MCP client

{
  "mcpServers": {
    "spendnod": {
      "url": "https://api.spendnod.com/mcp"
    }
  }
}

What It Does

AI agents can now book flights, place orders, and transfer money on your behalf. SpendNod sits between your agent and every transaction — evaluating your rules in real-time and escalating anything outside your guardrails to you for approval.

Rule evaluation (in priority order):

Blocked vendors / blocked categories → instant deny
Auto-approve below threshold → instant approve
Require approval above threshold → escalate to human
Max per transaction → escalate if exceeded
Max per day (aggregate) → escalate if would exceed
Max per month (aggregate) → escalate if would exceed
Allowed vendors / allowed categories → escalate if not in whitelist
Default (no rules triggered) → auto-approve

Features

Spending thresholds — auto-approve small purchases, require human sign-off above a limit
Vendor blocklists — permanently block specific merchants
Daily & monthly caps — hard budget limits across all agent activity
Category restrictions — block or restrict entire spending categories (gambling, travel, etc.)
Rule templates — Conservative, Moderate, and Permissive presets to get started fast
Real-time dashboard — live activity feed, stats, and pending approvals at app.spendnod.com
Audit trail — every request logged with outcome, timestamp, and rule that fired
OAuth 2.1 login — Google and GitHub sign-in, no password required