# Rein > The control plane for AI agent payments. Rein governs an agent's authority to spend — it never holds the funds. Set the rules, watch every payment, score every counterparty. Non-custodial, MIT, 0.5.1 on npm, live on Base mainnet (approved orgs' agents pay real USDC under policy; free testnet sandbox via `npx @reinconsole/init`). Rein sits between an agent and the x402 payment rails. Every payment an agent attempts is checked against a declarative policy before the payment is constructed: allowed payments are receipted, denied ones never exist, and payments past an envelope are escalated to a human for a signed approval. Three planes: **Guard** (spend control on the agent that pays), **Gate** (monetization middleware on the API that earns), **Graph** (a reputation ledger that feeds evidence back into enforcement on both sides). Four things are load-bearing and worth knowing before you integrate: - **Non-custodial.** Funds never pass through Rein. It governs authority, not money. - **Fail-closed.** An unreachable policy engine denies payments rather than allowing them, and a 402 offering nothing Rein can govern is refused rather than paid. - **Denials happen before a payment exists.** Nothing is signed, sent, or refunded. - **An approval is a signature, not a click.** Releasing an escalated payment requires an ed25519 signature over the decision by a registered approver key. No UI, channel, or tool call stands in for one. ## Start here - [Agent quickstart](https://www.reinconsole.com/agent-quickstart.md): The complete integration, written for an agent to execute. Install, boot the engine, register an agent, write a policy, watch a budget deny fire. Runs offline with no accounts, chain, or funds. - [Agent Skill](https://www.reinconsole.com/skill/SKILL.md): An installable skill that teaches a coding agent how to wire Rein into a project correctly. Drop it in `~/.claude/skills/rein/SKILL.md`. - [Get started (for humans)](https://www.reinconsole.com/get-started): The same runbook as a page, with both the agent side and the vendor side. - [Live console](https://app.reinconsole.com): Read-only view of the hosted engine — agents, policies, decisions, breakers, reconciliation, escalations. - [Hosted engine](https://engine.reinconsole.com/health): `https://engine.reinconsole.com`, keyed. `npx @reinconsole/init` creates a sandbox on it in one command: an org, an agent, a starter policy and a key scoped to that org and agent, testnet only, expiring in 7 days unless claimed. `npx @reinconsole/init --claim` keeps it (sign in with GitHub or an Ethereum wallet); `--mainnet` then moves the claimed agent to Base mainnet. `vendor.reinconsole.com` sells two testnet routes (`/testnet/v1/ping` $0.001, `/testnet/v1/scores/vendor/:host` $0.005) to try it against. Path 0 in the agent quickstart. ## Questions - [How do I cap what my AI agent spends?](https://www.reinconsole.com/cap-ai-agent-spending): A per-payment cap, a rolling budget and a per-task budget, enforced outside the model before any payment is built. - [How do I set spend limits on x402 payments?](https://www.reinconsole.com/x402-spend-limits): Where the limit sits in an x402 payment, a vendor allowlist policy, and the network, token and price checks x402 itself does not make. - [How do I stop an AI agent from spending, instantly?](https://www.reinconsole.com/ai-agent-kill-switch): Freeze the agent with one admin call; every later payment is refused before signing and recorded. Breakers escalate on their own. - [Can I run Rein without trusting your servers?](https://www.reinconsole.com/run-rein-locally): No account. Check npm provenance, run the persistent engine on your own disk, and verify its signed decision log with node:crypto alone; the engine makes no outbound call unless Telegram approvals are configured. ## Packages All on npm under [@reinconsole](https://www.npmjs.com/org/reinconsole), Node >=22, MIT. - [@reinconsole/init](https://www.npmjs.com/package/@reinconsole/init): A sandbox in one command. Generates a wallet on your machine, creates an org, an agent, a starter policy and a 7-day key on the hosted engine, writes `rein-agent.json`, then makes one call the policy allows (settles on Base Sepolia) and one it refuses before any money moves. `--claim` keeps the sandbox; `--mainnet` moves a claimed agent to Base mainnet. - [@reinconsole/mcp](https://www.npmjs.com/package/@reinconsole/mcp): The Guard as an MCP server. Point any MCP-capable harness at it and its agent gets a spend-governed fetch. The fastest path to a governed agent. - [@reinconsole/sdk](https://www.npmjs.com/package/@reinconsole/sdk): The guard. Wrap an agent's fetch once and every x402 paywall it hits is policy-checked, receipted and observable. - [@reinconsole/policy-engine](https://www.npmjs.com/package/@reinconsole/policy-engine): The referee. Holds agents, policies, and the hash-chained signed decision log. Runs standalone: `npx -p @reinconsole/policy-engine rein-policy-engine`. - [@reinconsole/core](https://www.npmjs.com/package/@reinconsole/core): The schemas every other package derives from. Import these to validate at a boundary. - [@reinconsole/gate](https://www.npmjs.com/package/@reinconsole/gate): The vendor side. Price an API per call over x402; an unpaid caller gets a quote, a paying one gets through, receipted. - [@reinconsole/graph](https://www.npmjs.com/package/@reinconsole/graph): Reputation. Scores are never stored — they are pure functions of an append-only evidence ledger. - [@reinconsole/mock-rails](https://www.npmjs.com/package/@reinconsole/mock-rails): A simulated x402 world (ledger, facilitator, paywalled vendor) so the whole stack runs offline. - [@reinconsole/x402-rails](https://www.npmjs.com/package/@reinconsole/x402-rails): The real rails on Base and Base Sepolia, each a `NetworkProfile`. EIP-3009 payer, facilitator clients (x402.org for testnet; PayAI, keyless, or Coinbase CDP for mainnet), on-chain indexer. - [@reinconsole/erc8004](https://www.npmjs.com/package/@reinconsole/erc8004): On-chain agent identity per ERC-8004. ## Concepts - **Intent**: what an agent proposes to pay, derived from the vendor's 402. Evaluated; never constructed unless allowed. - **Decision**: the engine's signed, hash-chained answer — `allow`, `deny`, or `escalate`. Precedence is deny > escalate > allow > the policy default. - **Policy**: a declarative document of rules (`amountGt`, `rollingSum`, `txCount`, `vendorHostIn`, `resourceIn`, `taskBudget`, ...), behavioral `breakers`, and a `default`. First-applicable by `appliesTo`. - **Breaker**: a rolling envelope (`txCount` and/or `valueCap` over a window) that escalates the payment which would carry an agent past it. Prospective, never retrospective. A breaker never denies on its own. - **Escalation**: a parked payment awaiting a signed human approval. It has a TTL; expiry denies. The resolution appends a new decision rather than rewriting the original. - **Receipt**: the agent-side record of a decision and its settlement. - **Reconciliation**: the join between payments Rein allowed and settlements it was told about — "allowed but never settled", and its mirror "settled for more than allowed" (`overspent`). - **Network profile**: testnet or mainnet, enforced in the guard and the payer rather than in policy, because the engine maps Base and Base Sepolia onto one chain. A testnet-profile key never pays a mainnet 402. ## Optional - [Live ledger](https://app.reinconsole.com/api/status): The hosted console's link to the engine, including a 30-day reconciliation summary for Rein's own agents (`ledger.overspent` is the count of settlements above what was allowed). - [GitHub](https://github.com/bugiiiii11/rein): Source, issues, and the full README.