docs
fren get sandbox key

more

security

The mandate is enforced on our servers, not in the prompt. A confused or hijacked agent can only do what its key and its mandate allow.

key handling

  • Keys are generated with 24 random bytes, shown once, and stored only as a SHA-256 hash. We cannot show a key again; if you lose it, revoke and recreate the agent.
  • Keep keys in environment variables or a secret manager. Never commit an mcp.json or claude_desktop_config.json that contains one.
  • Never put a key in browser code: the API accepts any origin (only sandbox signup is restricted), so a key in a web page is a key for anyone.
  • Use the 8-character keyPrefix to identify a key in logs; never log full keys.

scoping

agent key nst_admin key nsa_
read own wallet and activity✓✓
pay / send transfer✓ within its mandate✗
see other agents✗✓
change any mandate✗✓
approve or reject requests✗✓
freeze, revoke, create agents✗✓

An agent cannot approve its own requests, raise its own limits or read another agent's requests (it gets 404). Give each agent its own key, and keep the admin key with humans.

prompt injection

Assume an agent will one day read a malicious page that tells it to pay someone. Nostro's answer is that the model never decides the limits: the mandate, the merchant and MCC rules, and human approval are evaluated server-side on every call. The worst case is bounded by the mandate you set, and visible in the audit log.

  • Keep approvalAbove low for agents that browse the open web.
  • Restrict allowedMccs to what the agent actually buys.
  • Leave transfersEnabled off unless the agent must pay invoices, and keep transferApprovalAbove at 0.

kill switches

actioneffect
freeze_agentImmediate, reversible. Every spend returns 403; pending approvals cannot execute.
revoke_agentIrreversible. Key disabled and card cancelled.
update_agent_policyTighten limits for the next payment.
freeze now
curl -s -X POST https://mcp.nostro.ag/api/agents/agt_3f2b8d10/freeze \
  -H "Authorization: Bearer $NOSTRO_ADMIN_KEY"

transport and data

  • HTTPS only. Card numbers are never exposed to agents (masked as 4970 •••• •••• 3182). Signup IPs are stored only as salted hashes, for rate limiting.
  • Sandbox balances and transactions are fake. Do not put real personal or payment data in merchant names, descriptions or labels.
  • Infrastructure runs in the EU.

reporting a vulnerability

Please report security issues privately through the contact on nostro.ag, not in public channels. We reply quickly and credit researchers who want it.