A developer built a guard that asks his phone before AI agents spend money

The gap the developer noticed

In a post on dev.to, a developer described a worry that grows as you hand AI agents more work. An agent is an AI that takes actions, not just answers questions. If one decided to buy something or upgrade a subscription, nothing in his setup would have stopped it.

His answer is a tool called Saifuban, which means "wallet keeper" in Japanese. Before an agent spends, it has to ask Saifuban whether the payment is allowed. The tool answers using rules the owner has set in advance.

How the rules work

The logic is simple. Payments under a threshold you choose are approved straight away. Anything bigger triggers a push notification on your phone, with Approve and Reject buttons right in the notification.

Some requests never reach your phone because they are refused outright. These include payments over the daily budget, payments over the per-payment limit, and payments to merchants you have not allowed. A kill switch halts every agent at once.

Rules are set agent by agent. The developer's example is a research agent limited to $5/day while a coding agent gets a bigger allowance. Amounts can be in yen or dollars, and the interface has an English mode.

Saifuban does not see card details and does not move money. It is purely a decision-maker.

Connecting it to an agent

The tool runs as a remote MCP server. MCP is a common way for AI apps to plug into outside tools, so any app that supports it can connect with a single web address. The developer lists Claude, ChatGPT in developer mode, Cursor and VS Code as examples.

You open the site, choose a budget, and paste in the address it gives you. To check it works, you ask your agent to check your remaining budget with Saifuban.

The agent then gets three tools:

• request_payment asks whether a payment is allowed and waits up to 45 seconds for your answer.
• check_payment_status looks up a request that is still pending.
• get_budget reports how much is left today.

Two problems, and one honest limit

The first problem was pending requests. If they did not count against the budget, an agent could file ten at once, and approving them all would blow through the daily limit. So a pending request now holds its amount in reserve until it is decided or expires after 24 hours.

The second came from a Reddit commenter. Asking is voluntary, so an agent that has been tricked by hidden instructions (known as prompt injection) could just skip the check. The developer agreed and added a fix. Every approved request now returns a single-use token tied to the approved merchant and amount. It expires in 24 hours and stops working if the agent is stopped.

Whatever actually moves the money is meant to present that token to Saifuban before paying. A reused token, a different merchant, or a larger amount each gets rejected.

The developer is upfront about the catch. This only becomes hard enforcement when the payment side checks the token, and today that means your own payment code rather than a third-party checkout.

Where it already bites, and what's next

One case is enforced today: spending on AI services themselves. If you store your OpenAI, Anthropic or OpenRouter key in Saifuban, the agent only ever receives a stand-in key. Requests stop when the budget runs out.

Under the hood, it runs on Supabase Edge Functions and Postgres, a database. All the rules are checked inside one database function, with a lock per agent so simultaneous requests cannot race past the budget. The site is a web app on GitHub Pages.

The developer calls it free and early. He is asking users what limits would make them comfortable letting an agent spend, and whether they would verify tokens on the merchant side. That second question is the one that decides whether this idea can grow beyond personal projects.