Inspiration
AI agents can already find and compare what an office needs, but nobody lets them pay. You can’t tell an agent “spend at most €150 a month, only on office supplies, and ask me above €15” and trust that it will listen. In Europe, PSD2 also says the person must authorise payments. I wanted the missing piece: a leash between the agent and the money.
What it does
Leash sits between an AI shopping agent and your PayPal. The AI proposes, the code decides. You write spending rules in plain words. AI turns them into exact rules, and you confirm them. Rex, the agent, searches real offers through Channel3 and proposes purchases. A policy engine in plain TypeScript, with no AI, approves, asks you or blocks each purchase, always with a reason. Approved purchases are charged through PayPal. Bigger ones wait for your one-tap approval. You can see your history, refund, pause the agent, disconnect PayPal or delete your data. Shop text that tries to give orders to the AI is caught, hidden and logged.
How we built it
PayPal sandbox: Vault for the mandate, Orders v2 for charges, Payments v2 for refunds, and the Agent Toolkit behind “leashed tools”. The AI is Meta Muse Spark through the Vercel AI SDK, and its only purchase tool is propose_purchase. Search runs on the Channel3 REST API. The app uses Next.js, TypeScript, SQLite and runs on Render.
Challenges we ran into
Letting an AI shop without ever letting it pay. Blocking prompt injection hidden in product descriptions. Re-checking price and rules before every charge, even hours later. Running a free public demo that is safe and sandbox-only.
Accomplishments that we're proud of
The full loop works end to end in the PayPal sandbox: mandate, charge, approval, refund and revocation. And “the AI proposes, the code decides” holds everywhere, backed by tests.
What we learned
Trust belongs in code, not in prompts. PayPal’s Vault makes agentic payments possible. Any outside text can be an attack.
What's next for Leash
Shared team budgets, real shops with delivery through PayPal, and live payments after a legal review.
Built With
- channel3
- drizzle-orm
- github-actions
- meta-muse-spark
- next.js
- node.js
- paypal
- paypal-agent-toolkit
- paypal-orders-api
- paypal-server-sdk
- paypal-vault
- react
- render
- sqlite
- tailwindcss
- typescript
- vercel-ai-sdk
- vitest
- zod
