Does TapVow hold my money?
No. Payments go from your own wallet or provider account straight to the payee. TapVow signs and checks the limit in front of them and never takes custody.
Open source release on 27 Oct 2026
One signed budget for every AI agent you run
TapVow caps what your agents spend on LLM calls and x402 stablecoin payments, from one limit you sign with a passkey. Payees you didn't approve get blocked. TapVow never holds your money.
Measured, not promised
See it run
Ten agents share one signed budget, one agent pays 0.01 USDC over x402 on the Base Sepolia testnet, a prompt-injected 50 USDC payment gets blocked, and a one-byte edit makes the receipt check fail.
Build log, 18 Oct 2026
Ten agents, one 5.00 USD cap
In 6 of 6 runs, 10 agents sharing a 5.00 USD TapVow cap spent between 4.97 and 4.99 USD.
4.99
USD of 5.00
Highest spend across 6 runs with TapVow
Without the gateway, a plain check-then-book counter went over the cap in 3 of 3 runs, up to 5.21 USD.
| Run | Setup | Spent (USD) |
|---|---|---|
| 1 | TapVow gateway | 4.969235 |
| 2 | TapVow gateway | 4.984856 |
| 3 | TapVow gateway | 4.987054 |
| 4 | Gateway with signed mandate and ledger | 4.991076 |
| 5 | Gateway with signed mandate and ledger | 4.977183 |
| 6 | Gateway with signed mandate and ledger | 4.977772 |
| 7 | Naive counter, no gateway | 5.209459 over |
| 8 | Naive counter, no gateway | 5.176887 over |
| 9 | Naive counter, no gateway | 5.200528 over |
These runs used a local fake provider with real response shapes, so no paid API was billed. Build log of 18 Oct 2026.
Payments you can open on Basescan
On 19 Oct 2026, 12 of 12 x402 payments of 0.01 USDC settled on the Base Sepolia testnet through the Coinbase CDP facilitator.
It's testnet USDC, so no real money moved, and mainnet spend is still 0. I checked each receipt again on 20 Oct straight from a Base Sepolia node. Every one shows a transfer of exactly 0.01 USDC.
How a payment gets through
-
You sign a mandate
A budget, a per-call cap, the payees you allow and an expiry, signed with your passkey. The gateway refuses anything unsigned.
-
Agents call through the gateway
Claude Code, Codex or any OpenAI-compatible client points at TapVow instead of the provider. Your real keys stay in the gateway process.
-
Every charge is checked first
Over the cap, over budget or to an unknown payee, and the call stops before it's signed or sent. A prompt-injected 50 USDC payment was blocked this way in testing.
-
You keep a signed receipt
Each charge and each denial is a signed, hash-chained ledger entry. Export the pack and
tapvow verifyprints PASS, or FAIL if anyone edited a line.
I tried 26,971 single-character edits to one ledger entry. Verify caught every one.
Running on my own agents
I run 40+ coding and research agents on one Mac. On 10 Oct one uncapped session drained a 1,000 USD credit in about 29 hours, on a key my proxy didn't cover. That's why TapVow exists.
On 18 Oct my OpenCode workers ran real DeepSeek calls through TapVow. I lowered the per-call cap with a passkey-signed edit, and the next task stopped with a signed denial before any call reached the provider.
Watch Michael explain it
Common questions
Which payment rails does it cover?
LLM API calls to OpenAI, Anthropic and OpenAI-compatible providers, and x402 stablecoin payments on Base. Stripe is planned.
What isn't done yet
Mainnet payments haven't run, so mainnet spend is 0. Nobody outside my own setup uses TapVow yet. The npm package and the GitHub repo go public on 27 Oct, and passkey signing has so far been tested with a software authenticator, not a phone.
What the waitlist stores
Your email address, the time you joined and a salted hash of your IP address. I keep the hash only to stop spam floods and never store the raw IP. Your address is used once, to tell you the code is public, and goes nowhere except Cloudflare, which hosts this site and its database. To be removed, use the form below or write to privacy@tapvow.com, and I'll delete it.