The agent-native trust & payments layer

Software for agents.

Sgovr lets AI agents discover what a business can do, understand its terms - auth, pricing, rate limits - and safely transact. So they call structured, machine-native interfaces instead of scraping brittle human pages.

Get started Read the docs
  • MCP-compatible
  • Scoped mandates
  • Real settlement
  • Tamper-evident audit
sgovr-specvalid ✓
luxhotels.sgovr.json
{
  "name": "book_room",
  "sideEffects": "transactional",
  "pricing": { "model": "per_transaction", "takeRateBps": 150 },
  "auth": { "scopes": ["booking:write", "payments:charge"] },
  "rateLimit": { "rpm": 30 },
  "refundable": true
}
The gap

Agents can call APIs. They can't transact.

An open standard is emerging for the call layer. What's missing sits on top: discovery, identity, trust and payments built for agent-to-business commerce - not just tool plumbing.

✕ Agents scrape

Today an agent reverse-engineers human web pages - fragile selectors, hidden flows, no notion of price or terms until it's too late.

✕ Businesses can't transact

API owners have no agent-native way to express identity, pricing, scopes or spend authority - so they can't safely take an agent's money.

✕ No shared rails

The agent economy has no neutral layer for discovery, trust and settlement. Everyone re-implements auth, limits and audit, badly.

How it works

Three moves, one safe path

Every interaction follows the same arc - discover, understand the terms, then transact under a verified mandate.

01

Discover

Agents query the registry in natural language and get back relevance-ranked, verified providers - full-text and semantic (vector) search blended. No crawling, no guessing.

02

Understand the terms

Each provider publishes a machine-readable capability spec: actions, input and output schemas, auth scopes, pricing and rate limits. The agent reads the contract before it acts.

03

Safely transact

The gateway verifies the mandate, enforces scopes and spend caps, scores the call for fraud, settles the payment and records a tamper-evident audit trail - every time, automatically.

Architecture

A registry to discover. A gateway to enforce.

Agents discover providers through the registry, then invoke them through the gateway - which turns 'authorize and proxy' into 'authorize, settle and audit'.

Agent

Your AI agent, via the SDK or an MCP host

discover

Registry

Discover verified providers and read their terms

invoke under a signed mandate

Gateway

Verify & authorize→Score risk & enforce limits→Settle payment→Record audit & emit event

Settlement & audit

Double-entry ledger, payouts, reputation and a tamper-evident trail

Provider

Wraps an existing API - no rewrite required, reached over an authenticated hop

Risk-scored on the hot path · scoped, short-lived credentials · immutable, verifiable audit

Capabilities

Everything an agent needs to act - and a business needs to allow it

One coherent stack: the protocol, discovery, the enforcing runtime, and the trust and payments rails on top.

Capability spec

An open, MCP-compatible JSON Schema where providers declare actions, auth, pricing, side-effects and refund policy. The single source of truth for the protocol.

Registry & semantic discovery

Relevance-ranked discovery that blends full-text and semantic (vector) search, so paraphrased intent still finds the right action. One call to register, one to discover.

Scoped mandates

A signed JWT delegation: the human grants an agent a spend cap, allowed scopes and an expiry. Verified asymmetrically - ES256, EdDSA or RS256 against a JWKS in production, HMAC stub in dev. Cryptographic power-of-attorney, no long-lived secrets.

AP2 & A2A payment mandates

Native support for the Agent Payments Protocol: verifiable Intent, Cart and Payment mandates, presented over plain HTTP or the A2A (agent-to-agent) JSON-RPC transport - including streaming.

Streaming agent-to-agent calls

Long-running actions stream task-lifecycle events (accepted → working → progress → result) back to the caller over SSE via A2A message/stream. Tasks are poll- and cancel-able. Both native bm/1 and AP2 bm/2 mandates are accepted on the streaming transport.

Runtime gateway

Every call runs the same pipeline: verify mandate → scopes → rate limit → fraud score → approval hook → idempotency → reserve → proxy → capture/release → audit.

Authenticated provider hop

The gateway authenticates itself to each provider's adapter - signed HMAC, a bearer token, or a short-lived JWT attestation verified against the gateway's JWKS - so no one can skip the gateway and call the adapter directly. Mandate checks, limits and audit can't be bypassed.

Fraud & anomaly scoring

A real-time risk score on every call - velocity, spend deviation and amount - challenges or blocks suspicious activity at the gateway before any money moves. Fails open by design.

Agent reputation

A per-(agent, provider) trust score that rises with clean behaviour and falls on blocks and errors, automatically tightening rate limits for bad actors - throttled only against the providers they abuse.

Pluggable policy & approvals

A policy decision point - a built-in spend threshold or your own OPA / Rego engine - pauses high-value or high-risk calls for human approval with no code changes.

Hard spend caps

Reserve-authorize-capture makes overspend impossible: a reservation that would exceed the mandate's cap is rejected before the provider is ever called.

Real settlement

Charges run against the principal's vaulted card; the provider's account receives the net and Sgovr keeps the take-rate as a fee. Card vaulting and payouts handled for you.

Double-entry ledger

Immutable postings split every transaction into provider-net and Sgovr fee as balanced debits and credits. Reconcilable, refundable, and the source of truth for spend.

Tamper-evident audit

An append-only log where each record cryptographically chains to the one before it, mirrored to immutable WORM storage. Re-verify the whole chain on demand.

Invocation event stream

Every completed call is published to a NATS event stream - a clean tap for analytics, monitoring and downstream fraud models, off the critical path.

Domain verification

Providers prove control of their domain - by serving a did:web document or publishing a DNS-TXT challenge record - before they're marked verified. Self-serve, cryptographic onboarding instead of a manual review.

Self-serve provider portal

Providers onboard themselves through a guided console: paste a spec to validate and conformance-probe it against the live adapter, then prove domain control and flip to verified - no human in the loop.

Operations dashboards

A role-aware back-office that surfaces what each party needs to see and act on, served over a same-origin BFF.

Zero-downtime key rotation

Attestation signing keys are kept in a secrets manager and rotate at runtime: a fresh key goes active while the previous one stays in the JWKS to verify in-flight tokens, then retires. No restart, no downtime.

Step-up authentication on key operations

Key registration is a privilege-escalation surface. A config-gated email OTP gate returns 428 until the principal completes a single-use, Redis-backed challenge before any signing key lands. Every write - register, rotate, retire - is also appended to an immutable key-event log with actor and IP.

Idempotency

Every transactional call carries a client idempotency key; retries are de-duplicated at the gateway and replay the original settlement. Double-booking is impossible.

Conformance kit

A validator and conformance suite ship in the SDK so providers check their spec and replay golden transactions before they ever go live.

Trust & payments

MCP-compatible at the call layer. Trust & payments on top.

The durable moat isn't the protocol - it's the layer that makes an agent's money move safely. Spend caps, human approvals, real settlement and tamper-evident audit, built in.

Overspend is impossible

Spend is reserved against the mandate cap before the provider is ever called - not reconciled after the fact.

Fraud caught before it settles

Every call is scored for risk on the hot path; anomalous spend or velocity is challenged or blocked before any money moves.

Humans stay in the loop

Calls above a configurable threshold - or flagged as risky - pause for an approval token; the principal confirms before money moves.

Real money, real rails

Settlement runs on real payment rails with card vaulting and provider payouts, including the Agent Payments Protocol - not a simulation.

Verified, accountable agents

Providers prove control of their domain (did:web or DNS-TXT), and every agent carries a per-provider reputation score - trust is earned and measurable, not assumed.

Provably untampered

Every action is cryptographically chained and mirrored to immutable storage; one call re-verifies the entire history.

Roadmap

Designed, and coming next

The core is built and verified end-to-end. These are the next layers - already designed - that deepen the trust, payments and self-serve story.

Planned

Streaming fraud analytics

Event-driven scoring over the invocation stream, with models trained on live traffic for sharper, adaptive detection.

Planned

Discovery at scale

Approximate-nearest-neighbour vector indexing and true non-lexical recall, so semantic search finds paraphrased intent and stays fast as the registry grows.

Planned

Disputes & chargebacks

A first-class dispute workflow - evidence, reversals and resolution settled directly on the double-entry ledger.

Planned

Per-principal webhooks

Principal-registered callback endpoints, so approval requests and settlement events route straight to each customer's own systems.

Developer experience

Wire it up once. Transact everywhere.

Stdlib-light SDKs in TypeScript and Python, plus an MCP server so any MCP host - Claude, Cursor - gains every registered provider at once.

demo.ts
import { SgovrClient, mintDevMandate } from "@sgovr/sdk";
 
const sgovr = new SgovrClient();
const [hit] = await sgovr.discover("book a hotel room in Lisbon");
 
const mandate = mintDevMandate({
  agentId: "agent_demo",
  scopes: ["booking:write", "payments:charge"],
  spendCapMinor: 50_000, currency: "EUR",
  secret: process.env.SGOVR_MANDATE_SECRET!,
});
 
// reserve → proxy → settle → audit, all in one call
const booking = await sgovr.invoke(hit.providerId, "book_room", {
  roomId: "room_101", guestName: "Ada Lovelace",
  checkIn: "2026-07-01", checkOut: "2026-07-03",
}, { token: mandate, idempotencyKey: "demo-1", amountMinor: 29_800 });

Drop into any MCP host

The Sgovr MCP server exposes sgovr_discover → sgovr_get_spec → sgovr_invoke → sgovr_refund, so any agent gains every registered provider at once.

terminal
# register the SSE endpoint - no mandate in client config
claude mcp add --transport sse sgovr-sse \
  https://mcp.sgovr.eu/sse
  • Validator + conformance kit - check a spec and replay golden transactions before go-live.
  • Idempotent retries, scoped mandates and spend caps handled for you, not in your code.
  • Sensible, safe defaults out of the box - turn on real settlement, policy and audit with config.

Build for the agents that are already here.

Follow the quickstart, register a provider, and watch an agent discover, book and settle a transaction end-to-end in minutes.

Read the docs View the capability spec