Purser · AI agents spend. You sign off.

Purser is the control layer between a company's AI agents and its money: an agent pays on its own within the limits the CFO set, and anything above them waits for the CFO's Face ID or passkey on the exact terms.

An approval is usually a button. In Purser it's a signature over the exact terms: change one cent and it's worthless.

Live demo: kit11.max-31b.workers.dev/try: a test company of your own on test money, in 2 minutes · the walkthrough, 4:58 (AI voice and music: ElevenLabs) · every id on /proof

• Face ID or a passkey signs the exact terms. The approval is a signature over the SHA-256 of the terms; change one cent and it no longer verifies. The owner's real approval of 7 November is checked offline by npm run verify-approval (record).
• Limits are enforced in 3 layers: Purser's code, Airwallex's card controls and Metal's on-chain mandate. Airwallex itself declined an agent's card over the CFO's limit (record); Metal refused a purchase over the mandate on chain (record). The mandates: /api/metal/mandates, a live read from Metal testnet, or the recorded 12 Nov snapshot when the chain does not answer (the answer says which).
• The audit chain is anchored on chain. Every event goes into a hash-chained log; its head is in a value-0 Metal testnet transaction, and npm run verify-anchor prints MATCH (record).

Test money only: Metal testnet, Airwallex sandbox, Visa via Airwallex Airi (sandbox), Claude. Check it yourself, offline, no keys: npm ci · npm run judge -- --check · npm run verify-approval (what each does)

Enterprise

What a finance team gets beyond the demo; test money today, each with where to check it.

• Purser Cloud: a console per company with Overview, Agents, Invoices & books, Transactions, Tokenisation and Settings; a public test preview where Try as guest opens a demo company read-only (purser-try.max-31b.workers.dev, docs/cloud.md).
• Approval alerts: WhatsApp, e-mail, Slack and Teams tell the CFO a payment waits; an alert never carries anything that approves. Built and tested with stand-ins, not sent live yet; WhatsApp goes live once Twilio keys are set (docs/cloud.md).
• Zero trust and step-up: agents act only through a fixed set of tools that code checks; sensitive console settings ask for a fresh passkey check (docs/security.md, cloud/src/stepUp.ts).
• Security contact: security.txt and SECURITY.md; the layers a payment must pass on /security.
• MCP connector: 14 read tools, and proposing an invoice's payment, never approving it; in the MCP Registry as io.github.agamemnon-coder/purser (Connect any AI).
• Tests: the suite's count is written from its last full run by npm run test-count (summary, the line below); CI runs it on every push.

This is the beginning of the README. Read the rest at the original. Read the full README ↗