Agent Spending Without Controls — Rodrigo Coelho & Pranav Maheshwari, Edge & Node
Paid agent tools turn a skill file into spending authority. Builders need budgets, transaction logs, and counterparty screening before letting agents purchase data or services unattended.
A Claude Code session with a **paid-MCP skill file** retrieved contact details that the unconfigured session could not. Another demo requested a gift below **$10** but reported an **$11** charge; a screening simulation later rejected a flagged wallet while allowing the permitted one.
Treat payment skills like privileged production credentials. Put limits and approval policy beneath the model, record every tool charge, verify counterparties, and reconcile the final amount against the user's stated cap.
A Claude Code session with a **paid-MCP skill file** retrieved contact details that the unconfigured session could not. Another demo requested a gift below **$10** but reported an **$11** charge; a screening simulation later rejected a flagged wallet while allowing the permitted one. Treat payment skills like privileged production credentials. Put limits and approval policy beneath the model, record every tool charge, verify counterparties, and reconcile the final amount against the user's stated cap. The compliance example used a simulated flagged wallet, and the talk primarily demonstrates the presenters' marketplace. It does not establish how reliably its controls handle prompt injection, pricing disputes, refunds, or compromised agents.
This turns agent spending from a tool capability into a privileged security boundary. The charge above the prompt’s cap demonstrates that natural-language limits are not enforcement; budgets, approvals, screening, charge logs, and reconciliation must sit beneath the model. The marketplace demos support the control pattern but leave adversarial and post-transaction failures untested.