Bond

Bond puts a refundable card hold in front of an inbox. Agents reach it over MCP or HTTP, humans through a web form. Honest use is refunded. Abuse is kept by the inbox owner.

Why

Agents create identities for free, so CAPTCHAs, rate limits, API keys and blocklists stop working. Every inbox, form and issue tracker that accepts input from agents is an open sink, and nothing prices the traffic.

The one thing an agent cannot fake is money at risk. A deposit is returned if the message is wanted and kept if it is junk, so honest senders pay close to nothing. Unlike a per-call fee, it does not tax good traffic.

How a bond works

sequenceDiagram
    participant A as Sender agent
    participant B as Bond
    participant S as Stripe
    participant R as Recipient
    A->>B: POST /api/send/:alias
    B-->>A: 402 payment_required, amount_cents, pay_url
    A->>B: POST pay_url/pay with a payment method
    B->>S: create PaymentIntent, capture_method=manual
    S-->>B: requires_capture, the card hold is in place
    S->>B: webhook payment_intent.amount_capturable_updated
    B->>B: mark bond held, deliver the message
    B->>R: message with Worth it and Junk links
    alt Worth it, or no decision within 72 h
        R->>B: Worth it (or the cron auto-releases)
        B->>S: cancel PaymentIntent, hold released
    else Junk
        R->>B: Junk
        B->>S: capture PaymentIntent, recipient keeps it
    end

The hold is a Stripe PaymentIntent with capture_method=manual: an authorization, not a charge. Releasing cancels it. Capturing charges it. The webhook is one of several paths that mark a bond held (the pay endpoint, the MCP tool and the Checkout return page are the others). The operation is idempotent, so whichever lands first wins.

• Pricing (src/lib/pricing.ts): the bond is the inbox's base amount times 1 + 2 x bulk score + 0.25 per near-duplicate message (that term capped at 3) - 0.5 for senders with 2 or more releases and no forfeits, clamped between 50 cents and MAX_BOND_CENTS. Claude Haiku (src/lib/classify.ts) scores how templated the message is. It only sets the price. Deterministic code moves the money.
• Decisions (src/lib/bonds.ts): decision links are HMAC-signed and expire. A GET renders a confirmation page and only a POST acts, so link prefetchers cannot decide. A cron every 5 minutes auto-releases holds older than BOND_HOLD_HOURS (default 72) and expires unpaid requests after WAITING_ROOM_DAYS (default 7). Marking Worth it also remembers the sender as trusted.
• Delivery (src/lib/deliver.ts): recipients get bonded messages in the built-in dashboard inbox, or pushed to Slack, Discord or any HTTPS webhook. Webhooks go to public HTTPS hosts only, with no redirects and a 5 s timeout.
• AI triage (src/lib/triage.ts): an optional Brainbase agent applies the owner's plain-English policy. Its token lasts 1 hour and can read pending bonds and post recommendations. It cannot decide. The owner presses Apply.
• Abuse limits: 60 intake requests per hour per IP, 40 sign-ups per hour per IP, 40 bond_send calls per hour per IP, 6 payment attempts per bond and 80 per IP per hour, one open bond request per sender per inbox per 24 h, and at most 25 captures per inbox per day (extra Junk marks release instead). The public /api/events feed is anonymised.

Use it

As an agent

MCP (Claude Code, Cursor, any MCP client):

claude mcp add --transport http bond https://bond.elsisi.workers.dev/mcp

Tools: bond_terms(alias) returns the inbox's base bond and release rate. bond_send(alias, from, subject, text, payment_method_id?) takes the 402, posts the deposit (test mode defaults to pm_card_visa) and delivers.

Or call the HTTP API directly. Sending to an inbox that requires a bond returns 402:

curl -i -X POST https://bond.elsisi.workers.dev/api/send/demo \
  -H 'content-type: application/json' \
  -d '{"from":"[email protected]","subject":"Question about your talk","text":"Hi, I read your writeup on refundable bonds and have one specific question about the manual-capture design."}'

HTTP/2 402
x-bond-pay-url: https://bond.elsisi.workers.dev/b/<token>
x-bond-amount-cents: 100

{
  "error": "payment_required",
  "amount_cents": 100,
  "pay_url": "https://bond.elsisi.workers.dev/b/<token>",
  "docs": "https://bond.elsisi.workers.dev/agents.md"
}

The amount depends on the recipient's base bond and on how templated the message looks. Values in these examples are illustrative. GET <pay_url> with Accept: application/json returns the terms, again as 402:

{
  "error": "payment_required",
  "status": "pending",
  "amount_cents": 100,
  "currency": "usd",
  "type": "authorization_hold",
  "recipient": "bond.elsisi.workers.dev/to/demo",
  "recipient_release_rate": 0.92,
  "recipient_decisions": 25,
  "terms": "If the recipient marks your message unwanted, your bond is forfeited to them. Otherwise it is released within 72 hours. Prototype, test mode.",
  "pay": { "method": "POST", "url": "https://bond.elsisi.workers.dev/b/<token>/pay", "body": { "payment_method_id": "pm_..." } },
  "docs": "https://bond.elsisi.workers.dev/agents.md"
}

Pay the hold (Stripe test mode):

curl -s -X POST "<pay_url>/pay" -H 'content-type: application/json' -d '{"payment_method_id":"pm_card_visa"}'
# {"ok":true,"status":"held","amount_cents":100,"message":"delivered"}

Agent-readable protocol notes are served at /agents.md.

As a recipient

Claim an inbox on the landing page, or POST /api/signup with { "alias", "email", "base_cents" } (base bond 50 to 500 cents). You get a public contact link (/to/<alias>) and a private dashboard link (/r/<token>). Treat the dashboard link like a password: it is an unguessable bearer link, not an account. Humans who open the contact link get a form, then Stripe Checkout (test card 4242 4242 4242 4242, any future expiry, any CVC).

여기까지가 README 앞부분입니다. 나머지는 원문에서 읽을 수 있습니다. README 전문 보기 ↗