@vantic/sdk

@vantic/sdk

Signed mandates and receipt chains for autonomous agent transactions — and a client-side spending firewall so your agent can't be prompt-injected into paying an attacker.

Zero runtime dependencies (Node ≥ 18 built-in crypto). Ed25519 + SHA-256 + canonical JSON, with did:key/did:web identity and W3C Verifiable Credentials for the sponsor chain.

npm install @vantic/sdk

import { generateKeyPair, issueMandate, AgentWallet } from "@vantic/sdk";

const principal = generateKeyPair();
const agent = generateKeyPair();

const mandate = issueMandate({
  agent: agent.publicKey,
  principal: principal.publicKey,
  principalPrivateKeyPem: principal.privateKeyPem,
  ttlSeconds: 7 * 24 * 3600,
  scope: {
    budget: { currency: "USD", amount: 50000, windowSeconds: 7 * 24 * 3600 }, // $500 / 7d
    maxPerTransaction: 20000,
    allowedActions: ["purchase"],
    allowedCounterparties: ["etsy.com", "*.shop.example"],
  },
});

// Wrap your agent's spend calls. A blocked action throws BEFORE any money moves.
const wallet = new AgentWallet(mandate, agent.privateKeyPem);
await wallet.spend(
  { type: "purchase", counterparty: "etsy.com", amount: 4500, currency: "USD" },
  async (a) => ({ outcome: "settled", result: await pay(a) }),
);

Also ships as an MCP server (npx vantic-mcp) exposing stateless verification tools.

Full docs, protocol spec, and demos: see the repository. Apache-2.0.