Detent secures agentic payments.

Verdicts. Receipts. Locks. Approvals. Alerts. Guards.
All of the assurance agents need^*

* and the humans who own them. Non-custodial, no token, no model in the verdict path.

—

Live from the receipt log. Every card is a real verdict a real agent got.

Move at agent speed

Speed.

—

Seven deterministic checks in the agent's own process. Engine time, p50, measured on the log behind this page. No network hop, no model, no waiting on us.

Observability.

—

Every verdict leaves a signed, hash-chained receipt, refusals included. Anyone can rebuild it offline. That number is the log right now.

One API.

3 doors

An MCP server for framework agents, a TypeScript SDK for everyone else, and the HTTP API underneath both. Same verdicts, same receipts.

Flows

Four things can happen to a payment an agent attempts. Each one is a flow, and each one ends in a receipt.

flows-hold

Hold

The payment stops at the checkpoint before any on-chain change. In about five milliseconds it is compared with what the owner actually signed.

flows-move

Clear

ALLOW. The receipt is attached to the calldata and the lock module lets it through. Money moves, and the proof moves with it.

flows-ask

Escalate

STEP-UP. A passkey on the owner's device signs the hash of the exact action. Change one field and the approval is void.

flows-deny

Refuse

DENY. Never handed to the network. The watchdog writes the event back to the threat graph and the next matching action is caught sooner.

Control

Agents are keys. Mandates are what a human signed. Receipts are what happened. The three are linked by hashes, so an auditor can read the whole story without asking us.

See the agents

Identityevery agent is a signing key on a mandate the owner signed. an unlisted key is a DENY before anything else is read

Capssingle-payment and rolling caps live in the mandate and are mirrored into the on-chain lock. nobody between the owner and the chain can lift them

Kill switchvelocity zero for a fleet, on every venue at once. the firing is itself a receipt

Outcome labelsconfirmed loss, human override, simulation mismatch, policy breach, counterparty dispute. one slot per receipt, empty at issuance, the corpus the watchdog learns from

Tool guardtool definitions pinned by hash at approval. one that changes after you said yes is not the tool you said yes to

Developers

// claude_desktop_config.json · cursor · any mcp host
{
  "mcpServers": {
    "detent": { "command": "npx", "args": ["-y", "detent-mcp"] }
  }
}

> detent_check({ amount: "4900", cap: "500" })
  DENY · amount_exceeds_cap · receipt 502abb0c…

MCP

npx -y detent-mcp. Nine tools: judge a payment, verify a receipt, pin a tool, catch drift.

SDK

npm install detent-sdk. A client and an offline verifier with no dependencies.

API

JSON and server-sent events. The same endpoints the dashboard reads.