PayPulse Guard

Let any AI agent chase your PayPal invoices, inside limits it can’t change: a mandate in code, a signed budget for autopilot, and your signature for everything else.

Comment

Inspiration

Late payment is the normal case for small businesses, not the exception. 59% of US small businesses have invoices more than 30 days overdue (Intuit QuickBooks, 2026). AI agents are good at chasing payments. What stops people is trust: an agent that can discount an invoice or concede a dispute can also be talked into giving money away. We wanted to see how little you need to trust the model if the system around it is built properly.

What it does

Reads PayPal: unpaid invoices, open disputes, and each client’s own payment history, live from the PayPal sandbox. The agent proposes, never acts: an LLM agent decides what each invoice needs (a reminder or a settlement discount) and writes the client message, but it has no way to execute anything. A guard checks every proposal against a mandate written in code. Each proposal ends one of three ways: Blocked: the agent is told exactly which rules it broke. Autopilot: it’s inside limits the owner signed once, so it runs on PayPal immediately. Signature: otherwise it waits for the owner’s signature, which covers that exact payload and nothing else. Any agent, same guard: it’s also an MCP server, so Claude or any other agent can do the chasing with a key that can only propose. In the demo, Claude Desktop asks for 20% off and is refused, with five reasons. Attacks itself: an attack panel runs five ways a compromised agent would try to cheat, including rewriting its own autopilot, and every one is refused. Analytics: a page built with AG Studio shows what each agent did and why the guard said no. Its AI assistant builds new charts when you ask.

How we built it

PayPal (sandbox): Invoicing v2 (list, get, create, send, remind, cancel) and Disputes v1 (list, accept-claim). Every write carries a PayPal-Request-Id derived from the signed payload, so a retry can never run twice. Webhook signatures are verified. AI: gpt-6.1-terra, called with tool use. It gets four read-only tools and one propose_action tool, and the guard’s verdict comes back to it as the tool result, so it can correct itself. Guard: mandate checks in plain TypeScript. Approvals are an HMAC over the proposal ID and a SHA-256 hash of the exact payload, valid for five minutes and usable once. Everything is written to a hash-chained audit ledger. Autopilot: an HMAC-signed standing mandate covering reminders, a discount cap, a budget and an expiry. It’s re-verified on every use, and disputes are never covered. It applies AP2’s Intent Mandate idea to the merchant side. MCP server: written by hand over Streamable HTTP, plus a stdio bridge for Claude Desktop. Agent keys can be scoped, and there is no execute tool. Analytics: AG Studio 3.1, with our own adapter so its multi-agent assistant runs on the same model through the server. App: Next.js 16. No PayPal, LLM or MCP SDKs; everything is plain fetch. 22 end-to-end checks.

Challenges we ran into

The model’s API: gpt-6.1-terra rejects tool calls when reasoning is on for this endpoint. The app retries with reasoning off and remembers that for the model. Missing payment dates: PayPal’s invoice list leaves them out, so working out each client’s usual lateness needs one extra lookup per paid invoice, which we cache. Discounting a sent invoice: PayPal doesn’t allow it. A settlement is a replacement invoice, then send, then cancel the old one, and it has to be safe to retry. The model followed its prompt too literally: with no history it sent reminders before any discount. We made the escalation rule explicit: 14 days late from a client who usually pays 3 days late gets a settlement.

Accomplishments that we're proud of

No agent, ours or anyone else’s, ever holds a write capability, so a prompt injection is a nuisance, not a loss. Autonomy is something the owner grants in signed, bounded pieces. The demo proves it by attacking itself.

What we learned

The guard matters more than the prompt: a model can be talked round, and code can’t. And real data makes the agent specific. Once it could see each client’s own payment pattern, its decisions stopped being generic

What's next for PayPulse Guard

Put the guard in front of PayPal’s own MCP server and Agent Toolkit. Passkey signing from your phone, instead of a PIN. Refunds and dispute evidence under the same mandates. Payment plans. Use payment history to decide which invoices are worth paying out early.

Built With

  • ag-studio
  • claude
  • gpt-6.1-terra
  • model-context-protocol
  • next.js
  • node.js
  • openai
  • paypal-disputes-api
  • paypal-invoicing-api
  • paypal-sandbox
  • react
  • typescript
Share this project:

Updates

Submission history