Your passkey sets each agent's daily budget. Monad checks it on every payment, and anyone can read it before they get paid. Past the limit, the chain says no.
55 ETH, about $100k, via a compromised dashboard. The Block
Any API, site or contract can ask Monad whose agent this is, what it may still spend today, and whether this payment will go through. No API key, no Leash server in the path, no trust in the agent's own word.
Try it: curl -i https://leash-monad.vercel.app/api/forecast answers 402 until an agent pays inside its leash.
// npm i leash-monad viem import { checkAgent, leashGate } from "leash-monad"; // one read, before any work const v = await checkAgent(agent, me, "2.00"); // { status: "OVER_CAP", remainingToday: "0.0", erc8004Id: "10281", ... } // or the whole x402-style flow as middleware const g = await leashGate(req, { seller: me, priceUsd: "1" }); if (!g.allow) return res.status(g.status).json(g.body); // 402 / 403
Claude, Cursor or any MCP client gets pay and fetch_paid tools that can't spend past the daily cap your passkey set. Whatever the model is told, by you or by a prompt injection, the contract has the last word.
// npx leash-monad-mcp --new-key, leash it at /own.html, then: { "mcpServers": { "leash": { "command": "npx", "args": ["-y", "leash-monad-mcp"], "env": { "LEASH_AGENT_KEY": "0x…" } } } } // "buy a forecast from leash-monad.vercel.app/api/forecast" // → paid $1 inside the leash · 200 OK · $2.00 left today
One allowed payment, then one attempt against each rule. Each refusal is a real transaction that reverted inside the account's pay(), with the contract's own reason. Not a server saying no.
Each sale, and each agent the leash turns away, also lands in the agent's public ERC-8004 reputation, signed by the seller.
Check them all yourself: npx leash-monad verify re-reads each one from the chain. Reads only, about ten seconds.