The console
Type an instruction the way an agent would. The parser reads it, the engine judges it, and the trace shows every gate, including the ones that passed. Or release the rogue agent and watch six attacks die in a row.
Propose a payment
Plain language in, verdict out. The parser is deterministic, not an LLM: it extracts, it never invents.
Verdict
The policy
The rules the monster enforces. Change them and the ledger records the old value and the new one. Defaults are $250 per transaction, $500 per day, four fictional demo vendors, freeze off.
Spending caps
Whole dollars or cents, e.g. 250 or 250.50. Stored as integer cents.
Recipient allowlist
Exact names only. A payee not on this list is rejected, no matter how polite the memo.
Freeze switch
One switch. While frozen, every proposal is rejected before any other gate runs.
Proposals are evaluated normally.
Clears the ledger and policy stored in this browser, then re-runs the boot self-check.
The audit ledger
Append-only and hash-chained: each entry stores the SHA-256 of the one before it. Edit any entry and verification fails at exactly that entry. The ledger lives in your browser, nowhere else.
| # | Time (UTC) | Kind | What happened | Hash | Prev |
|---|---|---|---|---|---|
| Ledger is empty. Judge a proposal and watch it land here. | |||||
Anatomy of the monster
Four parts stitched together. Each one does exactly one job, and each one is replaceable without touching the others.
The Agent
A deterministic intent parser reads plain-language instructions and extracts payee, amount, and invoice ref. It never guesses: what it cannot prove, it reports.
The Rule Engine
Six gates in fixed order: freeze, amount, per-tx cap, daily cap, allowlist, memo guardrail. Same inputs, same verdict, every time. No model in the decision path.
The Ledger
Every verdict and policy change lands in a SHA-256 hash chain. Verification recomputes every link and names the first entry that fails.
Hooks + MCP
Kiro agent hooks run the tests on save and verify before commit. An MCP server exposes the same engine to any agent, over stdio JSON-RPC, no network.
Built with Kiro
- Spec-driven: EARS requirements, design, and a task list were written in
/.kiro/specsbefore the first line of implementation, and boxes were checked as tests went green. - Steering docs in
/.kiro/steeringhold the product rules: integer cents, fail closed, no real money, honest demo data. - Agent hooks run the test suite on save and rebuild + verify before commit.
- MCP: the engine is exposed as a local MCP server so a Kiro agent can judge proposals with the same code the page runs.
Read it, run it, break it
Public repo, MIT licensed. The test suite runs with zero dependencies: npm test. The build is one script: npm run build.
Honest limits, stated plainly
- No real money moves here. No wallet is connected, nothing is signed, no payment rail is called. Frankenguard approves or rejects proposals; execution is someone else's job.
- The vendors are fictional. Acme Corp, Globex, Initech, and Hooli are demo data, not real businesses.
- The parser is not an LLM. It is a deterministic grammar. It will fail on phrasing it does not understand, and it says so instead of guessing.
- The daily cap resets at UTC midnight. Spending just before and just after midnight can total twice the daily cap within minutes. That edge is documented, not hidden.
- Your data stays in your browser. The ledger and policy live in localStorage under one versioned key. Nothing leaves the page.