Live on NEAR testnet

The spending rule
your agent can't rewrite.

TabWrit turns a vault into capped, expiring, revocable Tabs for merchants and AI agents. A prompt injection hits the contract, not your wallet: the agent gets a budget, the owner keeps the keys, and every charge settles on NEAR.

Open your vault Inspect the Attack Lab

No wallet? Try the read-only policy check.

NEAR testnet · tUSDC has no monetary value · every charge is a real on-chain transaction · read the threat model

Demo vault
tab-demo.testnet
Contract-held
Available balance
…tUSDC
Tabs opened…
Charges settled…
Volume settled…
Your vault→Capped Tab→Merchant / AI agent→NEAR Intents payout
Contract tab-vault.…
Vault contract
tab-vault.testnet
Settlement token
tUSDC · NEP-141
Attack Lab checks
23/23 passed
x402 agent checks
13/13 passed
Cross-chain route
NEAR Intents

Security first. Then convenience.

A Tab is not a subscription contract and not a wallet. It is the missing pull-payment authorization primitive: a spending rule the blockchain enforces, with an escape hatch the owner controls.

Caps the chain cannot ignore

Per-charge, per-period and lifetime caps are checked in Rust before any token moves. A compromised agent or a buggy merchant keeper cannot exceed them, even with a valid key.

Scoped keys, not raw keys

Merchants and agents use a NEAR Function-Call Access Key restricted to vault.charge. The protocol forbids such keys from attaching deposits, so they cannot sweep the vault or touch other contracts.

Prompt injection stops on-chain

A hijacked agent that tries to pay an attacker is rejected by the receiver allowlist with RECEIVER_NOT_ALLOWED. The attack is a real testnet transaction; the funds do not move.

Preview the payee's chain

A merchant can request a live 1Click quote for USDC on Base, Arbitrum or Solana. On testnet this is quote-only; no mainnet funds move.

How it works

Three transactions. No custodian. No unlimited approval.

STEP 01

Fund your vault

Send NEP-141 tokens with ft_transfer_call. The vault credits your personal balance. You can withdraw the unspent amount at any time.

STEP 02

Open a Tab

Choose a spender, token, per-charge cap, period budget, lifetime cap, expiry and receiver policy. The contract stores the rule and emits a NEP-297 tab_created event.

STEP 03

Let the payee charge

The merchant or agent calls charge with a monotonic nonce. The contract validates the rule and moves only the allowed amount. A cross-chain payout can be quoted through 1Click; executing it requires a funded mainnet vault.

Real-world money

Subscriptions without unlimited approvals

Crypto subscriptions force users to push every renewal or grant an ERC-20 allowance that can drain the wallet. A Tab replaces both with a capped pull authorization. The merchant pulls the invoice; the user keeps the rest.

  • Monthly cap and per-charge cap are enforced on-chain.
  • Pause, resume and revoke take effect in the next block.
  • The receiver allowlist blocks redirected or phishing charges.
Agent security

Give an agent a budget, not a seed phrase

Autonomous agents need to pay for APIs, compute and data. Handing them a hot wallet key makes one prompt injection a wallet drain. A Tab gives the agent a scoped key, a hard spending envelope and a receiver allowlist; the contract is the backstop, not the prompt.

  • The MCP server exposes read tools, a scoped charge tool and an x402-style paid-fetch tool.
  • tab_pay_and_fetch pays an HTTP 402 invoice and returns data only after the on-chain receipt is verified.
  • Every charge consumes a monotonic nonce; replays fail.
  • The owner can revoke without rotating the agent's key.
  • A prompt-injected payee outside the allowlist is rejected on-chain with RECEIVER_NOT_ALLOWED.
  • NEP-366 lets the agent sign a charge off-chain and a relayer pay gas; the agent needs no NEAR.

What is actually live today

We separate the shipped testnet product from the mainnet-only cross-chain step. No screenshots of imaginary settlements.

Testnet: live

Real TabVault contract, real NEP-141 token, real wallet-signed deposits, tabs, charges, pauses, revocations and withdrawals. The final vault has 0 access keys; there is no deployer backdoor. The Attack Lab links every result to NearBlocks.

Cross-chain: quoted, not faked

The merchant checkout calls the live 1Click API for a real mainnet quote. Executing the settlement requires a funded mainnet vault; the testnet demo does not pretend otherwise.

Evidence: reproducible

pnpm testnet:e2e runs 23 real checks against the deployed contract: caps, allowlists, pause, revoke, expiry, replay, transfer rollback and conservation. pnpm test:meta adds 12 gasless checks, pnpm test:agent-attack adds 4 prompt-injection checks and pnpm test:x402 adds 13 x402 agent checks.

Stop handing out your wallet.

Write a Tab. Set the envelope. Let the payee pull only what the contract allows, and revoke it the moment the agent misbehaves.

Launch the vault