start

quickstart

Get a sandbox key in 30 seconds, plug Nostro into Claude Code, Claude Desktop or Cursor, and watch an agent pay, get held for approval, and get blocked.

1. get a sandbox key#

   The fastest way is the web page nostro.ag/sandbox: enter your email, copy the keys. Or from a terminal:

   shellcopy

   curl -s -X POST https://mcp.nostro.ag/api/sandbox/signup \
     -H "content-type: application/json" \
     -d '{"email":"you@company.com","company":"Acme","lang":"en"}'

   Expected response (keys are shown once, store them now). Limits: 3 sandbox workspaces per email, 10 signups per hour per IP.

   201 Createdcopy

   {
     "workspace_id": "ws_7c1e9a42b0d3",
     "admin_key": "nsa_9Hc2••••••••••••••••••••••••",
     "agent": {
       "id": "agt_3f2b8d10",
       "name": "demo-agent",
       "key": "nst_k3Jd••••••••••••••••••••••••",
       "policy": {
         "currency": "EUR",
         "perTxMax": 500,
         "dailyMax": 2000,
         "monthlyMax": 5000,
         "approvalAbove": 250,
         "allowedMccs": [],
         "blockedMerchants": [],
         "transfersEnabled": false,
         "transferApprovalAbove": 0
       }
     },
     "mcp_url": "https://mcp.nostro.ag/mcp",
     "balance": {
       "amount": 10000,
       "currency": "EUR",
       "fake": true
     },
     "sandbox": true
   }

   You get a workspace with 10 000 EUR of fake money, an admin key (nsa_, for you) and a ready-made demo-agent key (nst_, for your agent) with this mandate:

   rule	value
   per payment	500 EUR
   per day	2 000 EUR
   human approval	above 250 EUR

2. connect your agent#

   Give the agent key to your MCP client. Never give it the admin key.

   Claude CodeClaude DesktopCursorany client / curl

   Claude Code

   One command, then restart the session (/mcp shows it connected):

   shellcopy

   claude mcp add --transport http nostro https://mcp.nostro.ag/mcp \
     --header "Authorization: Bearer nst_YOUR_AGENT_KEY"

   Claude Desktop

   Settings > Developer > Edit config, then add the server to claude_desktop_config.json and restart Claude. The mcp-remote bridge carries the bearer header (Node 18+ required).

   claude_desktop_config.jsoncopy

   {
     "mcpServers": {
       "nostro": {
         "command": "npx",
         "args": [
           "-y",
           "mcp-remote",
           "https://mcp.nostro.ag/mcp",
           "--header",
           "Authorization:${AUTH}"
         ],
         "env": {
           "AUTH": "Bearer nst_YOUR_AGENT_KEY"
         }
       }
     }
   }

   Cursor

   Add to ~/.cursor/mcp.json (global) or .cursor/mcp.json (project). Do not commit a file that contains a key.

   mcp.jsoncopy

   {
     "mcpServers": {
       "nostro": {
         "url": "https://mcp.nostro.ag/mcp",
         "headers": {
           "Authorization": "Bearer nst_YOUR_AGENT_KEY"
         }
       }
     }
   }

   any client / curl

   The server is stateless Streamable HTTP with JSON responses: you can call a tool directly, no session needed.

   shellcopy

   curl -s https://mcp.nostro.ag/mcp \
     -H "Authorization: Bearer $NOSTRO_AGENT_KEY" \
     -H "content-type: application/json" \
     -H "accept: application/json, text/event-stream" \
     -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"get_wallet","arguments":{}}}'

3. make a first payment#

   Ask your agent, in plain words:

   promptcopy

   Check my Nostro wallet, then pay 49 EUR to Vercel for the Pro plan (MCC 5734).

   The agent calls get_wallet, then pay. Below the threshold, it executes:

   pay · argumentscopy

   {
     "amount": 49,
     "merchant": "Vercel",
     "mcc": "5734",
     "description": "Pro plan"
   }

   pay · resultcopy

   {
     "status": "paid",
     "transactionId": "tx_883b5610",
     "amount": 49,
     "merchant": "Vercel"
   }

   allow

4. trigger a human approval#

   Now ask for 320 EUR to AWS. It is under the 500 EUR cap but above the 250 EUR threshold, so it waits:

   pay · resultcopy

   {
     "status": "pending_approval",
     "requestId": "req_ef5c846c",
     "reason": "Au-dessus du seuil d'approbation (250 €)",
     "message": "Demande transmise à un humain de l'entreprise. Vérifie son statut avec get_request_status."
   }

   review

   Approve it with your admin key, from a terminal or from an MCP client connected with nsa_ (tool approve_request):

   shellcopy

   curl -s -X POST https://mcp.nostro.ag/api/requests/req_ef5c846c/approve \
     -H "Authorization: Bearer $NOSTRO_ADMIN_KEY"

   200 OKcopy

   {
     "id": "req_ef5c846c",
     "kind": "card_payment",
     "amount": 320,
     "status": "executed",
     "reason": "Au-dessus du seuil d'approbation (250 €)",
     "result": {
       "amount": 320,
       "status": "paid",
       "merchant": "AWS",
       "transactionId": "tx_acf5376d"
     },
     "createdAt": "2026-11-05T09:19:33.478Z",
     "decidedAt": "2026-11-05T09:20:41.561Z"
   }

   The agent sees the same result with get_request_status.

5. see a block#

   Ask for 900 EUR to Apple: above the per-payment cap, it is blocked outright, never escalated.

   pay · resultcopy

   {
     "status": "denied",
     "reason": "Dépasse le plafond par transaction (500 €)"
   }

   block

6. read the audit log#

   shellcopy

   curl -s "https://mcp.nostro.ag/api/events?limit=10" -H "Authorization: Bearer $NOSTRO_ADMIN_KEY"

   Every attempt is there, including the denied one, with its reason. See audit log.