Inspiration
My family runs a small workshop that makes lathe chucks. Like most small manufacturers in India, it buys tool bits, carbide inserts, coolant and safety gear every week by phone and WhatsApp, with no record of why something was bought. AI agents can now shop and pay, but no owner will hand an agent the company's payment account without limits. We wanted the missing piece: an agent you can actually trust with money.
What it does
SpendGuard is an AI purchasing agent for small manufacturers. The owner types what the shop needs, such as "20 HSS tool bits for the lathe". The agent searches the supplier catalogue, picks the items and the supplier, and explains its choice. Then a rule engine written in plain code decides:
- Approve: small orders from approved suppliers are paid at once through PayPal Payouts.
- Needs your OK: anything over the auto-approve limit, a price spike, a duplicate or a busy day waits in the Approvals inbox until the owner clicks Approve.
- Block: unapproved suppliers, banned categories, anything over budget or over the hard cap is never paid.
Every decision goes into an audit log with its reasons. The owner can also ask questions about spending ("How much did we spend this month, and with which suppliers?"), answered by a read-only analyst from SpendGuard's orders, with a tool for PayPal's Transaction Search API. And because SpendGuard is also an MCP server, any MCP agent such as Claude Desktop can buy through the same rules, without any way to approve or pay on its own.
How we built it
- AI agent: openai/gpt-oss-120b on Groq through its OpenAI-compatible API, in a tool-calling loop. Its tools can search the catalogue, read the budget and recent orders, and propose one order. None of them can move money.
- Policy engine: nine deterministic rules in Python, configured in policy.yaml (approved suppliers, allowed categories, monthly budget with one-month top-ups, hard cap, auto-approve limit, price check, duplicates, daily limit, required reasoning). Prices always come from the catalogue, never from the model.
- PayPal: OAuth client credentials, the Payouts API to pay suppliers from the company's sandbox business account (each order gets its own idempotency key, so a retry never pays twice), payout status checks, and Transaction Search for the spending questions.
- Backend: FastAPI, SQLModel and SQLite, with step-by-step logs of every agent call, rule and PayPal call.
- Frontend: React and TypeScript, with AG Grid for the orders and audit tables.
- MCP server: five tools for Claude Desktop or any MCP client, sharing one rules-and-payment path with the built-in agent. There is deliberately no approve or pay tool.
- Hosting: Render (free web service).
- Tests: 58 automated tests, including every rule, owner approval, double-payment protection and a real MCP handshake.
AI tools used and how
- openai/gpt-oss-120b on Groq is the purchasing agent: it understands the request, calls the catalogue, budget and order-history tools, and proposes one order with its reasoning. The same model powers the read-only spending analyst.
- Google Gemini is a drop-in backup through the same adapter (one setting).
- Model Context Protocol (MCP): SpendGuard exposes its tools to MCP agents such as Claude Desktop, so an outside AI can purchase through the same rules.
- The AI never decides whether money moves. That is always the rule engine or the owner.
Challenges we ran into
Keeping the model away from the payment call: the agent can only propose, and money moves in one function that runs only after an APPROVE decision or the owner's click. Telling the story in rupees while the PayPal sandbox pays in US dollars, solved with a fixed demo rate. Free-tier model access changed mid-build, which the model adapter made a one-line fix. And after deploying, PayPal refused payouts because a fresh database restarted order numbers at 1 and PayPal remembers every payout id; payout ids now include the order's creation time.
Accomplishments that we're proud of
All three outcomes (paid, held for the owner, blocked) work end to end against the real PayPal sandbox, and the agent has no path to money that skips the rules.
What we learned
Trust in an AI agent comes from what it cannot do. Simple, readable rules and an audit log matter more to an owner than a smarter model.
What's next
Supplier invoices through PayPal Invoicing, rules with more than one approver, real supplier catalogues, and Venmo or Braintree as extra payment rails.
