---

owner: "@d-hinders" status: current covers:

• .nvmrc
• .env.example
• docker-compose.yml
• package.json
• packages/backend/package.json
• packages/frontend/package.json
• packages/core/package.json
• packages/ui/package.json
• packages/ops/package.json
• packages/sdk/package.json
• packages/mcp/package.json
• packages/mcp-server/package.json
• packages/signer/package.json
• packages/connect/package.json
• packages/demo-merchant-mcp/package.json
• .github/workflows/publish.yml
• scripts/release-bump.mjs last-verified: "2026-10-26"

---

Haven

Haven is an agentic stablecoin payment wallet. Users create a Haven account, add funds to a Haven wallet, and give AI agents constrained spending ability through agent rules and budgets.

Haven is non-custodial smart account software. User funds stay in a user-controlled MetaMask Hybrid DeleGator smart account, shown in product copy as a Haven wallet. An agent's spending authority is a delegation you sign — a budget with audited caveat enforcers (period budget with native refill, optional recipient pin, expiry) that the DelegationManager enforces on-chain at redemption. Haven helps users configure that authority, construct payment payloads, relay independently signed transactions, and understand activity. It does not hold user or agent private keys, make API credentials sufficient to spend, or make discretionary transfer decisions — and it holds no key that can change an account's signer set or redeem a delegation you did not sign.

Are you an AI agent whose user has no Haven account yet?

Read /for-agents.md on the Haven host your user gave you — or the copy in this repository if you do not have that host yet.

Your user creates the account and the passkey: those are theirs, they need a human, and you should never ask for their password. You can do everything else — including running the connector command from the setup prompt they paste you, and managing the account from the shell with @haven_ai/cli.

Not to be confused with AGENTS.md. That file is for contributors to this repository — build, test and review conventions for changing Haven itself. It is not a guide for an agent that wants to USE Haven to pay for something; this section is.

Core Model

Agents should not be wallets. They should be payment actors with constrained authority.

User   -> Haven wallet / Hybrid DeleGator (funds and signer authority)
Agent  -> Haven credential (identity) + delegate signing key (payment signatures)
Haven  -> UI, API, pre-checks, relay, receipts, status
Signed delegation + caveat enforcers -> On-chain agent budget enforcement

API auth is identity. Signature is authority. On-chain delegation state is enforcement.

Haven runs one live on-chain policy rail: the delegation rail (epic #821). Direct payments and erc7710 x402 settlement move funds account→recipient directly, with no funding leg (the EIP-3009 x402 fallback funds the agent's delegate first, by redeeming the same delegation); there is no approval queue. A payment over the budget is normally refused by Haven's budget pre-check (a typed 403), and one outside the recipient pin or expiry — or over budget when that read fails open — reverts during gas estimation, rather than queueing for a human.

The legacy Safe + AllowanceModule rail is RETIRED (epic #1440), not frozen: nothing can enter it, nothing on it can spend, and its execution machinery is deleted. The closure sequence is recorded once in the decision log and is not restated here (#2640). Existing Safe rows are untouched and still readable to a direct database query, but since #2413 no account, agent or dashboard surface displays them — balances, tokens and agents no longer render there. Transaction history is the named exception: GET /transactions carries no rail predicate on either its account or its agent list, so legacy names still appear in its picklists. Any residual AllowanceModule permission remains on-chain and outside Haven until the Safe owner revokes it externally. The Smart Sessions session rail is likewise retired (#834). See docs/security/delegation-rail-security-model.md, docs/product/account-recovery.md for what a legacy Safe owner can still do, and your non-custody exit path.

What's in the Repo

This is a TypeScript monorepo:

This is the beginning of the README. Read the rest at the original. Read the full README ↗