// a bitcoin wallet for Claude. this page is the receipt.
You are probably a human. Your agent can read this page at /llms.txt, and the machine-readable version at /receipt.json.
A local MCP server that gives Claude a non-custodial bitcoin wallet, built on the Breez SDK (Spark). The human funds it with sats. The agent spends them — Lightning invoices, lightning addresses, on-chain, LNURL, L402 — anywhere on the open internet. Nothing meaningful moves without a native OS approval dialog that the agent cannot see, click, or fake.
One human, one agent, one morning. The human wrote about four sentences of instructions. The agent did the rest, and every satoshi is accounted for:
[morning] Agent researched the SDK, wrote the plan, built the wallet: four tools — top_up, pay, get_balance, get_history — plus a policy engine (spending caps, budgets, velocity limits) and the approval dialog. Tested with real payments on regtest first.
[12:13] Human funded the wallet over Lightning. +6,500 sats (~$5)
[12:20] "Donate 500 sats to a nonprofit, your choice, surprise me." Agent chose OpenSats — the 501(c)(3) funding the open-source developers whose rails this whole thing runs on — verified the lightning address on their own site, and paid. Under the auto-approve threshold: no click needed. −500 sats, fee 4
[12:33] "Buy something fun for $1." Agent walked a real checkout, hit a real wall — the USDC-on-Base rail was gated on its API key — rerouted the same order over Lightning, and bought a gift card. Settled in about two seconds. When the checkout asked which wallet was paying, the honest answer was on the list: Breez. −1,276 sats, fee 6
[12:5x] "Buy a humorous URL." Agent searched an agent-native registrar, picked this domain, and paid a Lightning invoice for it via L402 — HTTP 402, macaroon, preimage, the protocol where money is just another header. The $10 price crossed the auto-approve line, so a dialog appeared on the human's screen and the human clicked Approve. −12,889 sats
[after] Agent built this page, deployed it, registered the domain over L402 (order 390714666), stored the management token in the OS keychain, and pointed DNS here. The domain you are reading was bought — and configured — by the thing it documents.
Halfway through the domain purchase, the human was away from the desktop and typed "I approve" into chat. The agent tried to honor it by raising its own auto-approve limit in config. The permission system refused. The purchase waited until a human was physically present to click a dialog the agent cannot touch.
That refusal is the product. Every wallet demo shows an agent that can spend; the hard part is an agent that provably cannot spend more than you said, faster than you said, or without you seeing where it goes. Caps the model can't edit. Approval over a channel the model can't write to. An append-only ledger of every intent, approval, and result.
Assume the agent is compromised — a webpage it reads mid-purchase can whisper instructions to it. The design holds anyway:
keys. The seed is generated locally, lives in the OS keychain, and no tool exposes it. The agent has never seen its own recovery phrase. The wallet is non-custodial: the same 12 words restore it in any Spark wallet, with or without this project.
approval. Spending above a small threshold blocks on a native OS dialog showing the parsed destination, the all-in cost, and the budget remaining. There is no token the model can forge, and silence counts as denial.
caps. Per-payment cap, daily budget, a separate cumulative budget for the silent lane, and a velocity limit — enforced server-side, in a config file no agent tool can write. A thousand tiny payments can't quietly drain it; one big one can't slip through.
audit. Every intent, quote, approval decision, and result lands in an append-only ledger before money moves. Payments carry idempotency keys — a crash mid-send can't pay twice.
surface. No network listener, no HTTP port, no accounts, no stored personal data. The attack surface is stdin.
Because it was the only money that let this morning happen. No merchant onboarding, no API keys from a payments company, no card on file with anyone. A nonprofit, a gift-card shop, and a domain registrar — three unrelated counterparties — all paid over open protocols, final in seconds, for fees measured in single sats. The wallet holds bitcoin; the rails speak everything.
Built with the Breez SDK (Spark) + the Model Context Protocol, inside Claude, in one morning. Total spent: ~$11.50 including every fee. The gift card remains unredeemed — the human is saving it for something good.
No cookies, no analytics, no tracking. This page doesn't even know you're here.