BagOS

**BagOS gates every AI-initiated Solana spend: token-gated, SOL-capped, confirmed on chain.** An MCP server that can move money hands an AI assistant a signing key. The assistant decides, and the transaction is already on chain by the time a human reads about it. BagOS makes it pause. The first call to a write tool **signs nothing**. It returns a preview and a single-use confirmation token fingerprinted to the exact arguments, so a token issued for a 0.01 SOL swap cannot authorize a 10 SOL one. Nothing reaches the chain until you call again with that token. ### Every write goes through this — in order `token gate → spend caps → confirmation → simulate → sign → send → confirm` - **Hard caps** — 0.1 SOL per transaction, 1 SOL per session, enforced before the Bags SDK is called - **Single-use tokens** — expire in 5 minutes and are bound to exact arguments - **Simulate before signing** — a failed simulation aborts the write - **Confirmed, or it throws** — never a success message for a transaction that did not land - **Devnet by default** — writes are mainnet-only, so an unconfigured install cannot spend real money ### 14 tools **11 read** — never sign, never spend: heartbeat, authenticate, trade quotes, token analytics, top creators, per-token creators, claim stats, claim events, claimable fees, partner stats, social-handle → launch-wallet resolution. **1 gated** — `bags_prepare_token_metadata` reserves a mint and uploads metadata, then says plainly that nothing was launched. Completing a launch needs a Meteora fee-share split, which is your decision rather than a model's. **2 write** — `bags_execute_trade` and `bags_claim_fees`. Mainnet only, off unless you configure them. ### Proof 345 tests at 100% coverage — statements, branches, functions and lines — enforced in CI. Published from CI with SLSA provenance. Listed in the official MCP registry. Docs and live demo: https://bagos.edycu.dev

First seen 2 Oct 2026. Evidence as of 2 Oct 2026.