Spending caps and action whitelists are evaluated first, so a denied action leaves no signed record — the ledger is a record of what was allowed, not of what was attempted. Verification is the other half: a provider checks a receipt with one public GET and no account, which is what lets both sides trust the same proof. Read the policy on startup and pre-check anything expensive.
A Python server in front of Openterms. Before an agent calls an API it requests a receipt; the policy engine evaluates the action first, and a denied action never gets one. Receipts are Ed25519-signed over canonical JSON with a SHA-256 hash, and anyone can verify them from public keys.
- A signed receipt issued before an action, carrying provider verification headers — `issue_receipt`
- Receipt verification, direct and by canonical hash, both public — no API key needed to check one — `verify_receipt`, `verify_receipt_by_hash`
- The active guardrails, meant to be read on startup, and a pre-check on a hypothetical action — `get_policy`, `simulate_policy`
- The audit trail of every allow, deny and escalate — `policy_decisions`
- Recent receipts, workspace balance and per-receipt pricing — `list_receipts`, `check_balance`, `get_pricing`
- Receipt statistics for an API you operate, behind provider auth — `provider_activity`
Self-host or use the hosted instance. Self-hosting needs `pip install flask pyjwt cryptography pyyaml` and `python run.py`, serving on `http://localhost:5000`, or `docker compose up --build`; storage is SQLite with no external dependencies. The MCP server runs `openterms_mcp_server.py` under `python3`, with `OPENTERMS_API_URL` pointing at your instance or the hosted one, and `OPENTERMS_API_KEY` for your workspace. Receipt issuance is free — no wallet, no deposit.
Build from source — clone the repository and build it, then point your client at the binary