Spend Controls for Anthropic Claude Agents

# install
pip install sipi-bot
# run the MCP server (stdio)
python -m spendfirewall.mcp_server

Why Claude agents need spend controls

Claude agents are particularly capable tool-users — they can chain tools, write and execute code, and call shell commands. That capability cuts both ways: a Claude Code agent that can run aws ec2 run-instances or call a paid data API can spend real money, fast. The failure modes that matter:

• Tool-call retry loops — a flaky tool fails, Claude retries, each retry is a paid call. 40 retries in 90 seconds is how $4,000 disappears at 2am.
• Agentic coding spend — Claude Code agents provisioning infrastructure (cloud, databases, SaaS) can rack up $40–$400 in a 20-minute session if left unchecked.
• Novel vendor discovery — agents that find new vendors during tool use (or that have been prompt-injected) will happily spend at unapproved merchants.
• Handoff chains — multi-agent systems where each step in the chain triggers a paid call compound spend linearly.

The three-decision model

sipi.bot returns one of three decisions for every proposed spend, in under 5ms:

• APPROVED — passes every active rule. The agent proceeds. Logged.
• BLOCKED — violates a hard rule (over cap, unknown merchant, velocity breach, restricted category, off-hours). No money moves.
• FLAGGED — crosses an approval threshold. Routed to a human-in-the-loop queue and held until resolved.

The FLAG path is what makes sipi.bot usable in production. A binary cap either blocks too much (breaking the agent's workflow) or allows too much (the $12,400 morning). Flagging routes the ambiguous cases — a $500 compute buy at 3am from a vendor you've used before — to a human without blocking the routine ones.

Rules that matter for Claude agents

Velocity limit

Claude's tendency to retry failed tools means velocity is your most important rule. Cap the number of transactions per hour and the retry loop dies on the Nth attempt.

{"rule_type": "velocity", "params": {"max_count": 10, "window_minutes": 60}, "action": "BLOCKED"}

Time windows

Most runaway Claude Code incidents happen during unattended overnight sessions. Flag or block all agent spend outside business hours.

{"rule_type": "time_window", "params": {"allowed_hours": "9-18"}, "action": "FLAGGED"}

Merchant allowlist

Block spend at any vendor you haven't explicitly approved — your defense against prompt-injection-driven spend and novel-vendor discovery.

{"rule_type": "merchant_allow", "params": {"allowed": ["anthropic.com", "aws.amazon.com", "stripe.com"]}, "action": "BLOCKED"}

Anthropic rate limits vs sipi.bot