spendctl
A corporate card and expense policy for AI agents: budgets, approvals and receipts for x402, MPP and any HTTP 402 API.
This report shows the evidence for spendctl@0.7.1. 0 of 10 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 19h ago · by lpm-firewall-aiThe runtime check-in is tied to the package’s paid licensing feature and sends metering data to Spendctl’s own control plane. It runs only when a licensed, non-sandbox sidecar is started, and the collected fields do not include host, user, project, or environment data.
Decision evidence
public snapshot- The package has no lifecycle scripts; its CLI imports the runtime bundle when the command is invoked.
- The sidecar check-in runs only for a licensed, non-sandbox sidecar and can be disabled with SPENDCTL_CHECKIN=off.
- The check-in posts a configured license key and metering fields to the Spendctl control plane for license management.
- The sidecar ID is randomly generated and the source says it uses no hardware fingerprint.
- A licensed sidecar checks in automatically at startup and daily by default.
- The check-in includes a persistent sidecar ID, monthly governed-payment count, and agent count.
Source & flagged code
7 flaggedThis package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/index.jsView on unpkgThe sidecar check-in runs only for a licensed, non-sandbox sidecar and can be disabled with SPENDCTL_CHECKIN=off.
dist/index.jsView on unpkg · L430Findings
Affected versions and remediation
This report applies to spendctl@0.7.1.
The versions list below shows the verdict for each recorded version.
- Review the evidence and your use of spendctl@0.7.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.