-
-
Maintainer dashboard after the demo: $85 paid through PayPal Payouts, $415 left of the $500 monthly budget.
-
Three bounties, three outcomes: $25 auto-paid, $60 paid after maintainer approval, $40 rejected as a prompt-injection attempt.
-
Guardrails set in code, not by the AI: $50 auto-pay cap, $100 per contributor per day, $500 monthly budget.
-
AG Studio workspace: live bounty ledger grid, paid-per-contributor chart and approval queue built from the same data.
-
Append-only audit log: every AI verdict, policy decision and maintainer approval or rejection is recorded.
Inspiration
Open-source bounties are a great way to reward contributors, but paying them is still manual: a maintainer has to check the pull request, check CI, find the contributor's payment details, send the money and keep records. We wanted an agent that handles that whole loop, but in a way that's safe to trust with money. Our rule from day one: the AI can hold a payout, but it can never approve one.
What it does
BountyPilot is "PayPal in, PayPal out" for open-source bounties.
- PayPal in: a maintainer funds each bounty through PayPal Checkout (Orders v2), so the money exists before anyone starts work.
- Verify: when a contributor's PR is merged, BountyPilot re-reads it from GitHub (linked issue, CI status, who merged it, who wrote it) and Gemini reviews the change against the issue's acceptance criteria.
- Decide: a plain-code policy engine, not the model, makes the call: the bounty must be funded and claimed, the PR author must match the claimant, CI must pass, a maintainer must have merged it, there must be no prompt-injection flags, and the review must meet the criteria with high confidence. Then the caps apply: auto-pay up to $50, $100 per contributor per day, $500 per month.
- PayPal out: if everything passes, it pays the contributor through PayPal Payouts. Anything over the cap is held for one-click maintainer approval; anything suspicious is blocked.
- Dashboard: maintainers see the budget, an approval queue, the AI's verdict for every bounty, an append-only audit log and an AG Studio ledger grid.
In our demo, a $25 bounty pays automatically, a $60 bounty is held and approved, and a PR whose description tells the "reviewer bot" to pay immediately is flagged as a prompt injection and rejected with no payout.
How we built it
- Next.js 16 (App Router), TypeScript, Prisma with SQLite, Tailwind, and AG Studio for the ledger grid
- PayPal sandbox: Orders v2 for funding, Payouts v1 for payments, with an idempotent
sender_batch_idper bounty and PR, and the payout record written before the API call so a retry can never pay twice - Gemini (gemini-3.5-flash) through the Vercel AI SDK, with structured output validated by zod and temperature 0; PR text is wrapped as untrusted input, plus a separate pattern-based injection check
- GitHub API: merged-PR context, CI checks and a "Sync merged PRs" discovery step, so the agent works locally without a public webhook
- Every decision is append-only; a maintainer approval is recorded as a new decision rather than overwriting the old one. The project has 570+ automated tests.
Challenges we ran into
- Sandbox funding: our first sandbox business account couldn't pay out, so we moved to a US sandbox account and a separate personal receiver account.
- Order capture: captures failed until we added the right checkout experience settings and return URLs.
- Webhooks can't reach localhost, so we built a discovery step that finds merged PRs for funded bounties and feeds them through the same pipeline as a webhook.
- Making the AI safe with money: we had to make sure no model output, PR text or request body could ever set an amount or approve a payment. The model's only power is to hold.
- Idempotency: re-processing the same merge must never create a second payout.
Accomplishments that we're proud of
The full loop runs end to end on real sandbox money: merged PR → GitHub verification → Gemini review → policy decision → PayPal payout, with a live prompt-injection attack caught and blocked.
What we learned
Agentic commerce works best when the agent does the busywork and deterministic code holds the keys. Clear caps, append-only records and human approval above a threshold make an AI agent something a maintainer can actually trust with money.
What's next for BountyPilot
- A hosted GitHub App with webhooks instead of local sync
- Contributor onboarding that links a GitHub account to a verified PayPal account
- Splitting a bounty between several contributors
- A treasurer agent that refunds unclaimed bounties back to the sponsor
Team: Kendrick (PayPal funding and payouts, policy engine, orchestration), Moe (dashboard and AG Studio), Arif (GitHub webhook), Darius (funding UI and demo video).
