Purser · AI agents spend. You sign off.

Purser is the control layer between a company's AI agents and its money: an agent pays on its own within the limits the CFO set, and anything above them waits for the CFO's Face ID or passkey on the exact terms.

An approval is usually a button. In Purser it's a signature over the exact terms: change one cent and it's worthless.

Live demo: kit11.max-31b.workers.dev/try: a test company of your own on test money, in 2 minutes · the walkthrough, 4:58 (AI voice and music: ElevenLabs) · every id on /proof

• Face ID or a passkey signs the exact terms. The approval is a signature over the SHA-256 of the terms; change one cent and it no longer verifies. The owner's real approval of 7 November is checked offline by npm run verify-approval (record).
• Limits are enforced in 3 layers: Purser's code, Airwallex's card controls and Metal's on-chain mandate. Airwallex itself declined an agent's card over the CFO's limit (record); Metal refused a purchase over the mandate on chain (record). The mandates: /api/metal/mandates, a live read from Metal testnet, or the recorded 12 Nov snapshot when the chain does not answer (the answer says which).
• The audit chain is anchored on chain. Every event goes into a hash-chained log; its head is in a value-0 Metal testnet transaction, and npm run verify-anchor prints MATCH (record).

Test money only: Metal testnet, Airwallex sandbox, Visa via Airwallex Airi (sandbox), Claude. Check it yourself, offline, no keys: npm ci · npm run judge -- --check · npm run verify-approval (what each does)

Enterprise

What a finance team gets beyond the demo; test money today, each with where to check it.

• Purser Cloud: a console per company with Overview, Agents, Invoices & books, Transactions, Tokenisation and Settings; a public test preview where Try as guest opens a demo company read-only (purser-try.max-31b.workers.dev, docs/cloud.md).
• Approval alerts: WhatsApp, e-mail, Slack and Teams tell the CFO a payment waits; an alert never carries anything that approves. Built and tested with stand-ins, not sent live yet; WhatsApp goes live once Twilio keys are set (docs/cloud.md).
• Zero trust and step-up: agents act only through a fixed set of tools that code checks; sensitive console settings ask for a fresh passkey check (docs/security.md, cloud/src/stepUp.ts).
• Security contact: security.txt and SECURITY.md; the layers a payment must pass on /security.
• MCP connector: 14 read tools, and proposing an invoice's payment, never approving it; in the MCP Registry as io.github.agamemnon-coder/purser (Connect any AI).
• Tests: the suite's count is written from its last full run by npm run test-count (summary, the line below); CI runs it on every push.

How it works

Airwallex's AgentOS says its "components do not initiate money-out actions (transfers, FX conversions, or payouts) on your behalf" (docs, read 13 November 2026). Purser is the control layer for when agents do move money on Airwallex: within limits the CFO signs, and above them only with the CFO's passkey on the exact terms.

flowchart LR
  A["Claude agent<br/>proposes a payment"] --> P["CFO policy<br/>Purser's code"]
  P -- "within the limit" --> R["Airwallex · Metal · Visa via Airi<br/>each with its own limit"]
  P -- "above it" --> F["CFO's passkey<br/>Face ID on iPhone<br/>signs the exact terms"]
  F --> R
  R --> B["Books<br/>posted to T:0 and Moneybird (sandboxes)"]
  B --> L["Hash-chained audit log"] --> N["Its head anchored on Metal testnet<br/>npm run verify-anchor"]

For judges: 3 minutes

What it is: the control layer between a company's AI agents and its money on Airwallex and Metal, built for Starter Kit 11 (x402 Business Agents) and entered for the Metal Award and the Visa Award. The Kit 11 scenario, run live on 3 November.
1. Try it: a test company of your own; approve the exact terms with your passkey, then change them: refused.
2. Proof: one id per rail in docs/in-depth.md, every run in docs/runs/.
Offline: the quick start, under 2 minutes, no keys.
Simulated: the customer, the supplier, the merchants' charges, the settlement and the second approver; test money only.

What's live, what's simulated

Each row from its run record; test money throughout. Every run, newest first: docs/runs/.

This is the beginning of the README. Read the rest at the original. Read the full README ↗