wally

Wally is the financial control plane for autonomous agents.

Wally gives AI agents a secure way to pay for APIs, compute, storage, datasets, and other online services — using stablecoins — while keeping humans firmly in control.

Developers define budgets, spending limits, approved providers, and authorization rules. Wally handles transactions, verifies purchases, blocks suspicious activity, and records every payment in a clear audit trail.

Think of Wally as a wallet, procurement manager, and fraud guard built for the autonomous internet.

The problem

Agents need to buy things. Today that usually means:

• Sharing one API key across every tool call
• No per-agent budgets or spend attribution
• No vendor allowlists — any URL can become a payment target
• No receipts an auditor (or another agent) can verify
• No way to pause spending without killing the whole stack

Wally sits between agents and money. Agents propose payments; Wally enforces policy, routes settlement, and produces evidence.

Agent                         Wally                           Vendor / chain
  │                             │                                    │
  ├── propose payment ─────────►│ policy check + fraud scan          │
  │                             ├── escrow (optional) ──────────────►│
  │                             │◄── proof of delivery ──────────────│
  │◄── signed receipt ──────────│                                    │
  │                             │                                    │
Owner ─ approve / pause / revoke                                   │

What Wally does

Capability	Description
Programmable identity	Each agent gets a wallet binding + stable identity record
Automatic procurement	Pay for APIs, compute, storage, datasets, and services
Budget enforcement	Per-agent, per-mission, and per-day spend caps
Vendor allowlists	Only approved providers and contract addresses
Price routing	Pick the cheapest acceptable service in real time
Fraud guard	Block scams, suspicious contracts, payment manipulation
Audit receipts	Structured record for every consequential transaction
Escrow	Hold funds until work verification passes
Multichain routing	Stablecoin settlement across supported networks
Human control	Pause, approve, or revoke spending instantly

Get started

Prerequisites

• Node.js 20+
• A Cloudflare account (for deployed worker)
• RPC endpoints for chains you intend to read balances from

Local dev

git clone https://github.com/nadopenai/wally.git
cd wally
cp .env.example .env
npm install
npm run dev

The reference worker exposes a HTTP API at http://localhost:8787 and MCP-compatible tool endpoints under /mcp.

Register an agent

curl -X POST http://localhost:8787/v1/agents \
  -H 'content-type: application/json' \
  -d '{
    "name": "research-bot",
    "budgetUsd": 100,
    "dailyLimitUsd": 25,
    "singleSpendLimitUsd": 5,
    "allowedVendors": ["openai", "anthropic", "cloudflare-ai-gateway"]
  }'

Response includes an agentId and scoped credentials for payment intents.

Propose a payment

curl -X POST http://localhost:8787/v1/payments/intent \
  -H 'content-type: application/json' \
  -d '{
    "agentId": "agt_...",
    "vendor": "openai",
    "amountUsd": 2.50,
    "reason": "embeddings batch job",
    "network": "solana"
  }'

Wally returns allowed, requiresApproval, or denied with a reason. Approved intents produce a receipt hash.

MCP integration

Wally exposes tools agents can call directly from MCP clients (Claude Code, OpenCode, etc.):

Tool	Description
wally_get_balance	Read agent budget remaining across networks
wally_propose_payment	Submit a payment intent for policy evaluation
wally_list_vendors	Return allowlisted providers for this agent
wally_get_receipt	Fetch audit receipt by id
wally_request_escrow	Open milestone escrow for a delegated task

Example MCP config:

{
  "mcp": {
    "wally": {
      "type": "remote",
      "url": "https://wally.example.workers.dev/mcp",
      "headers": {
        "Authorization": "Bearer {env:WALLY_AGENT_TOKEN}"
      }
    }
  }
}

Policy model

Every agent operates under a policy bundle:

{
  budgetUsd: 500,           // total cap
  dailyLimitUsd: 100,       // rolling 24h window
  singleSpendLimitUsd: 25,  // per transaction
  allowedVendors: ["..."],  // provider ids
  allowedContracts: ["..."], // on-chain allowlist (EVM/Solana)
  requireApprovalAboveUsd: 10,
  escrowByDefault: false
}

Policy evaluation is deterministic — model output never bypasses limits.

Fraud signals

Wally blocks or escalates when it detects:

• Unknown or unreviewed contract addresses
• Allowance / approval patterns associated with drainers
• Vendor impersonation (domain mismatch, typosquat)
• Spend velocity anomalies
• Payment routing that would bypass allowlists

High-risk intents require human approval even when under the single-spend limit.

Escrow

For delegated work, Wally supports milestone escrow:

1. Agent opens escrow with acceptance criteria
2. Funds locked in policy-controlled account
3. Verifier (human, evaluator agent, or attestation) marks milestone complete
4. Wally releases partial or full payment + receipt

Escrow state is queryable; owners can cancel and return unused funds.

Official wallet registry

These are Wally's published multichain addresses for treasury, settlement, and verification.

Network	Address
Solana	97YkKbCGLwkr5ushJ2ArbsfPpsg1pE4scN1bFpqzyuNc
EVM	0x571DF0340025165Cfd8b4060C394A7F1BD7584Cc
Bitcoin	bc1qsa64vm2rgxlekwgzkn9dfphhd37p8846sfzc8e

Verify before sending. Cross-check addresses against this repo, the deployed worker config, and other official Cloudflare-adjacent channels. Never fund from a README copy alone.

Agents do not get raw private keys. Signing happens in a separate control layer after policy passes.

Repository layout

src/
  identity/      Agent DID + wallet binding
  wallet/        Solana, EVM, Bitcoin adapters (read + intent)
  policy/        Budgets, vendors, spend limits
  procurement/   Service catalog + price routing
  fraud/         Scam and contract heuristics
  receipts/      Audit journal
  escrow/        Milestone holds + release
  routing/       Stablecoin / cross-network routing
  control/       Pause, approve, revoke
  mcp/           MCP tool surface
  index.ts       Cloudflare Worker entry
docs/
  ARCHITECTURE.md
tests/

Human controls

Owners can at any time:

• Pause an agent — all new intents denied until resumed
• Approve a queued high-risk payment once or via standing rule
• Revoke vendor access or rotate agent credentials
• Freeze outbound settlement across all agents
• Export receipt journal for compliance review

Emergency controls are designed to work even if the agent is misbehaving.

Deployment

npm run deploy

Set secrets via Wrangler:

wrangler secret put OPENAI_API_KEY

See wrangler.toml for bindings. Durable Objects (planned) hold per-agent policy state at the edge.

Roadmap

Milestone	Status
Identity + policy engine	Implemented (this repo)
Receipt journal + MCP tools	Implemented
Escrow + milestone verification	In development
Durable Objects agent state	Planned
Real-time vendor price routing	Planned
Cloudflare dashboard integration	Research

Security

• Separate intent, policy, and signing layers
• No production private keys in agent context or this repo
• All spend requires vendor allowlist match
• Receipts include authorization source + evidence hash
• Report issues privately before production use with material funds

License

MIT — Copyright (c) 2026 Matt Carey

---

Built for agents that need to pay for things without burning the house down.