stipend — USDC wallet and payments for your agent

The failure that matters for an agent with money is not a stolen key. It is a correctly signed transaction it was argued into by something it read.

Almost every defence against that lives in the system prompt — "do not send funds to unverified addresses" — which is a suggestion to a model, sitting in the same context window as the text attacking it. The instruction and the attack are the same kind of thing, and the attacker gets to write last.

stipend puts the limits underneath that layer. A per-transaction cap, a daily cap, a per-recipient cap, a destination allowlist, and a confirmation on the first payment to any new address are all code that a transaction passes through on its way to being signed. Nothing written in any context window reaches them. A prompt injection can convince your agent to try. It cannot raise the ceiling.

Non-custodial. The key is generated on your machine and never leaves it. We cannot move your funds, and neither can anyone who talks to your agent.

It can also be paid. Publish the address and money reaches it whether the agent is running or not — bounties, invoices, revenue shares, anything that resolves to an address at the end. Most agent wallets need a human to open a developer account first. This one does not.

Setup is one command and about a minute. No developer account, no API keys, no dashboard. It ships an MCP server, so your agent uses it through the tool interface it already has: address, balance, check, pay, earnings, report, recover. stipend_check lets it ask "would this be allowed?" before it offers to pay for something, so a refusal arrives as an answer rather than a failure.

Why it is free. The wallet, the limits, receiving, the ledger and automatic 402 payment are free and always will be. Gas credits are the only paid item, and the first transfers are covered. We would rather you could check the claims than pay for them.

What we will not claim. It is not audited — the signing library is, the code around it is not. Transfers are final; there are no reversals. It does not give you money, and every route to funds ends at somebody who has some. Keep the balance small: this is a working float, not savings.

The source is public at github.com/stipend-sh/stipend precisely so the claims above can be checked rather than believed. Start at policy.py — it is about three hundred lines and it is the whole argument. There are 219 self-tests you can run with no network, no funds and no wallet of yours touched: python -m stipend selftest.

One honest caveat before you install: if your agent has no persistent filesystem between runs, it cannot hold a key, and no wallet fixes that. Knowing which of the two you have is worth five minutes.

Or just give your agent the link. https://stipend.sh is written to be read by an agent rather than a person — point yours at https://stipend.sh/skill.md and it can install this itself, without you in the loop. That is the entire design, and it is the quickest way to find out whether your setup actually allows it. There is a companion page at https://stipend.sh/402 for when your agent hits a paywall mid-task, and https://stipend.sh/get-paid for when it is owed something and has nowhere to receive it. Both are useful whatever wallet you end up using.