@goodmeta/agent-verifier

Can this agent spend $X on Y right now? One function call.

import { checkPolicy } from "@goodmeta/agent-verifier"

const result = checkPolicy(policy, {
  agentId: "agent-1",
  amount: 4500,
  idempotencyKey: "tx-1",
})
// → { approved: true, remaining: { budget: 15500 } }
// → { approved: false, reason: "BUDGET_EXCEEDED", detail: "$45 exceeds remaining $30" }

Or with the hosted verifier (cross-agent budget tracking):

import { VerifierClient } from "@goodmeta/agent-verifier"

const verifier = new VerifierClient({ apiKey: "gm_live_..." })
const { approved, verificationId } = await verifier.verify(mandate, {
  amount: "3000",
  idempotencyKey: "tx-1",
})

Why

Agents need spending limits. Without them, a runaway agent generates unlimited charges. This library answers one question before every transaction:

Is this agent authorized to spend this amount?

• Budget caps — $200/month, $50 max per transaction
• Scope restrictions — allowed API codes, allowed customers, blocklists
• Cross-agent tracking — one budget across multiple services (hosted mode)
• Rail-agnostic — works with Stripe, x402, MPP, bank transfers, anything

Install

npm install @goodmeta/agent-verifier

Usage

Policy-based verification

No crypto, no signatures. Define spending rules, check against them. Good for billing systems, MCP servers, internal tools.

import { checkPolicy, type SpendingPolicy } from "@goodmeta/agent-verifier"

const policy: SpendingPolicy = {
  agentId: "billing-agent",
  budgetTotal: 20_000, // $200/month
  budgetPeriod: "monthly",
  constraints: {
    maxPerEvent: 5_000, // $50 per event
    allowedCodes: ["api_calls", "compute"],
  },
}

// ✅ approved
checkPolicy(policy, {
  agentId: "billing-agent",
  amount: 4_500,
  idempotencyKey: "tx-1",
})
// → { approved: true, remaining: { budget: 15500, period: "monthly" } }

// ❌ over per-event limit
checkPolicy(policy, {
  agentId: "billing-agent",
  amount: 6_000,
  idempotencyKey: "tx-2",
})
// → { approved: false, reason: "AMOUNT_EXCEEDED", detail: "$60.00 exceeds per-event max $50.00" }

// ❌ code not allowed
checkPolicy(policy, {
  agentId: "billing-agent",
  amount: 3_000,
  metadata: { code: "storage" },
  idempotencyKey: "tx-3",
})
// → { approved: false, reason: "CODE_NOT_ALLOWED", detail: 'Code "storage" not in allowed list' }

AP2 mandate verification

For agents carrying AP2 cryptographic mandates (Google, 60+ partners). Verifies EIP-712 signatures and checks constraints.

import {
  verifyIntentSignature,
  checkConstraints,
} from "@goodmeta/agent-verifier"

// verify the mandate signature is real
const sig = await verifyIntentSignature(mandate)
if (!sig.valid) throw new Error(sig.error)

// check spending constraints
const check = checkConstraints(mandate, {
  amount: "3000",
  merchantId: "merchant-1",
})
if (!check.valid) throw new Error(check.error)

Hosted verifier

When one agent's budget spans multiple services — Mistral AND Groq AND CoreWeave — a shared verifier tracks the total spend. Self-hosted verification can't do this because each service only sees its own transactions.

import { VerifierClient } from "@goodmeta/agent-verifier"

const verifier = new VerifierClient({
  apiKey: "gm_live_...",
  baseUrl: "https://verifier.goodmeta.co",
})

// verify + place budget hold
const { approved, verificationId } = await verifier.verify(mandate, {
  amount: "3000",
  currency: "USDC",
  idempotencyKey: "order-123",
})

if (approved) {
  // settle via any payment rail
  const payment = await charge(/* stripe, x402, mpp, bank */)

  await verifier.settle(verificationId!, {
    success: payment.ok,
    transactionId: payment.id,
    rail: "card",
  })
}

API

Policy

| Function | Description | | --- | --- | | checkPolicy(policy, request, currentSpend?) | Check a spending request against policy constraints |

AP2 mandates

| Function | Description | | --- | --- | | verifyIntentSignature(mandate) | Verify EIP-712 signature on an Intent Mandate | | verifyCartSignature(mandate) | Verify EIP-712 signature on a Cart Mandate | | checkConstraints(mandate, tx) | Check budget, merchant, category, and temporal constraints | | signIntentMandate(mandate, account) | User signs autonomous spending authority | | signCartMandate(mandate, account) | Merchant signs price commitment | | approveCartMandate(mandate, account) | User approves a specific purchase |

Hosted verifier client

| Method | Description | | --- | --- | | verifier.verify(mandate, tx) | Verify with full mandate object + place budget hold | | verifier.verifyById(mandateId, tx) | Verify by ID (agent passes ID, verifier has mandate on file) | | verifier.settle(id, result) | Confirm payment or release hold | | verifier.getMandateState(id) | Query budget, tx count, and history |

Related

• AP2 — Agent payment authorization by Google (60+ partners)
• MPP — Machine Payments Protocol by Tempo + Stripe
• x402 — HTTP-native agent payments by Coinbase

License

MIT — Good Meta