Spend Firewall for AI Developers

pip install sipi-bot
python -m spendfirewall.api  # self-host, serves on :8080

The developer problem

You're building an agent. The agent has tools. Some of those tools spend money — an LLM call, a cloud-provisioning command, a payment settlement, a data purchase. The agent decides when to call them. You have no deterministic guarantee that the spend is within policy. The prompt says "be cost-conscious." That is not a spending policy.

The failure modes are well-documented at this point:

• Retry loops — a tool fails, the agent retries, each retry is a paid call, 40 retries in 90 seconds.
• Novel vendor discovery — the agent finds a new vendor during tool use and spends there without approval.
• Prompt injection — untrusted input instructs the agent to route spend to an attacker-controlled destination.
• Unattended sessions — the agent runs overnight, something goes wrong, and you find out from Stripe at 9am.
• Aggregate bleed — many small purchases that individually pass every rule but collectively blow the budget.

The developer answer

One HTTP call before any action that would move money. The firewall returns APPROVED, BLOCKED, or FLAGGED in under 5ms. On BLOCKED, the agent aborts. On FLAGGED, the transaction is routed to a human-in-the-loop queue. Every decision is written to a tamper-evident audit log.

import requests

def guard(amount, merchant, category):
    r = requests.post(
        "https://sipi.bot/v1/transactions/evaluate",
        headers={"Authorization": f"Bearer {SIPBOT_KEY}"},
        json={"amount": amount, "merchant": merchant, "category": category},
        timeout=5,
    ).json()
    return r["decision"]

# wrap any paid action
if guard(amount=6200, merchant="unknown-gpu.ru", category="compute") == "APPROVED":
    do_paid_action()
else:
    abort()

Three surfaces, one engine

Framework wrappers

Five-line client wrappers for the common agent frameworks — all in the repo's /integrations directory:

• LangChain — wrap any Tool that spends.
• CrewAI — guard any crew task that triggers payment.
• OpenAI Agents SDK — register as a function_tool.
• Vercel AI SDK — guard any tool call from the edge.
• Anthropic Claude Agent SDK — native MCP.

The eval gym

The engine passes a public eval suite of 53 labeled spend scenarios across 9 categories: clean approvals, approval flags, edge cases, per-transaction blocks, daily-limit blocks, velocity blocks, merchant blocks, category limits, and time windows. Boundary cases (exactly at threshold), precedence cases (block beats flag on the same transaction), and adversarial cases (case-insensitive merchant matching, sketchy TLDs) are all covered. The full report:

• Human-readable eval report
• Machine-readable JSON
• Source for the scenarios

If you find a 54th scenario that breaks the engine, the team wants to know.

Self-host vs hosted