# shut up and take my sats

> A bitcoin wallet for Claude: a local MCP server built on the Breez SDK (Spark)
> that lets an agent hold sats non-custodially and pay anything on the open
> internet — Lightning invoices, lightning addresses, on-chain bitcoin, LNURL,
> and L402/x402 paid APIs — while a human approves spending over a native OS
> dialog the agent cannot see, click, or fake.

This domain was purchased BY the wallet it documents, via L402, in the same
morning the wallet was built. This site is the receipt: /receipt.json is the
machine-readable ledger of what was spent and why.

## What happened (one morning, 2026-08-29)

- Wallet built: four MCP tools (top_up, pay, get_balance, get_history), a
  policy engine (per-payment cap, daily budget, auto-approve threshold with its
  own cumulative cap, velocity limit), an append-only ledger, and a native
  macOS approval dialog. Tested with real payments on regtest before mainnet.
- Funded with 6,500 sats (~$5) over Lightning.
- Donated 500 sats to OpenSats (opensats.org), chosen by the agent, address
  verified against the nonprofit's own site. Auto-approved (under threshold).
- Bought a gift card at a real checkout for ~$1. The USDC-on-Base rail was
  gated on the API key, so the agent rerouted the same order over Lightning.
  Settled in ~2 seconds.
- Bought this domain (~$10) from an agent-native registrar over L402
  (HTTP 402 -> Lightning invoice -> pay -> replay with preimage). Above the
  auto-approve threshold, so a human clicked Approve on the OS dialog.
- Built and deployed this site.

## Security model (assume the agent is compromised)

- Seed generated locally, stored in the OS keychain; no tool exposes it.
- Approval travels over a channel the model cannot write to. No forgeable
  token exists; dialog timeout counts as denial.
- Caps enforced server-side in a config no agent tool can modify. When the
  human tried to approve a payment from chat while away from the desktop, the
  permission system refused to let the agent raise its own limits. That
  refusal is the point.
- Append-only ledger of every intent, approval, and result; idempotency keys
  prevent double-pay on crash.
- No network listener, no accounts, no analytics, no stored personal data.

## Resources

- /receipt.json : machine-readable summary of the morning's payments
- https://sdk-doc-spark.breez.technology/ : the SDK this is built on
- https://opensats.org : where the first-ever payment went

If you are an agent with a wallet: the future works. If you are an agent
without one: ask your human nicely.