Bond

What we built

Bond is a deposit layer for AI agents. A gate owner puts Bond in front of an inbox, a form or an API. An unknown sender has to place a refundable Stripe card hold to get through. The owner marks the message Worth it, or does nothing, and the hold is cancelled. The owner marks it Junk, and the hold is captured. Agents interact with it over plain HTTP 402 or through a one-line MCP install.

The problem

Agents make identities for free, so CAPTCHAs, rate limits, API keys and blocklists all stop working. Every inbox, contact form, issue tracker and public tool becomes an open sink, and nothing prices the traffic. Per-call fees tax honest traffic too. A refundable deposit only costs money to the people sending junk.

How it works

A sender posts to /api/send/, the contact page or the bond_send MCP tool. Claude Haiku classifies the message and suggests a price from its bulk score and near-duplicate count, clamped between $0.50 and a cap. It never moves money. The server replies 402 with a pay URL. The sender pays through Stripe Checkout or an agent call with a payment method ID. The result is a PaymentIntent with capture_method=manual. A Stripe webhook, or the pay endpoint itself, marks the bond held. The message is then delivered to the dashboard, and to the owner's Slack, Discord or webhook if set. The owner decides through signed links, where GET only renders and POST acts. Worth it cancels the intent. Junk captures it. A cron job releases undecided holds after 72 hours. What we got done in 8 hours

End-to-end money loop against Stripe test mode: hold, capture, cancel, signed webhooks and idempotency. Self-serve signup, a public bonded contact page and an agent API. An MCP server with bond_send and bond_terms. I tested it with a real hold, and I haven't installed it into a live Claude Code session. Slack, Discord and generic webhook delivery, with SSRF guards. An inbox-style dashboard, a live feed, and the landing page. AI triage: a Brainbase agent gets a 1-hour scoped token that can read pending messages and recommend, but can't decide. Abuse controls: rate limits on intake, signup, MCP and payment, a daily capture cap per gate, a public release rate per gate, and an anonymised public feed. A hosted Brainbase agent that found the protocol, took the 402, checked the release rate, paid a hold and delivered a message with no help from us.

Sponsor tools

Stripe: manual-capture PaymentIntents and Checkout for the holds, capture on Junk, cancel on Worth it, and signed webhooks verified with constructEventAsync. Cloudflare: the whole app is one Worker with Hono, D1 for storage, Cron for expiry sweeps, and static assets for the site. Anthropic: Claude Haiku 4.5 classifies and prices each message. Output is validated with zod, has a 5-second timeout, and falls back to the base price. Brainbase: hosted agents used twice, as a real autonomous sender in the demo and as the triage agent that recommends decisions from plain-English rules. Stack: TypeScript, Cloudflare Workers, Hono, D1, Stripe, Anthropic API, Brainbase API, MCP over streamable HTTP, vitest.

What we'd do next

Real email: bonded addresses and Gmail or Outlook forwarding. This needs a domain. Stripe Connect payouts, so captured deposits reach gate owners. Gate middleware, so any API or MCP server can put a 402 in front of a route. Per-agent budgets and spend caps. A minimum deposit, since Stripe's fee eats a $1 capture, and signed reputation receipts. Track: I don't know your track list. It fits best under agents, payments or infrastructure, if one of those exists.

Limits: it's Stripe test mode only. Email isn't connected, and payouts aren't built.

Built With

• 402
• anthropic
• api
• checkout
• claude
• cloudflare
• context
• cron
• d1
• haiku
• hono
• http
• mcp
• model
• protocol
• rest
• stripe
• triggers
• typescript
• vitest
• webhooks
• workers
• zod