Finance controls for autonomous AI agents that can review invoices, evaluate spend policies, respond to X402-style payment challenges, and produce audit-ready decision logs.
Autonomous agents will buy data, tools, compute, and services. Companies need a control plane that decides when those agents are allowed to spend money, blocks risky or duplicate purchases, escalates high-value actions, and records every decision for finance teams.
AgentPayOps demonstrates that control layer through one vertical workflow:
- An invoice agent reviews a vendor invoice.
- The agent needs a paid vendor-risk report.
- The report endpoint returns
402 Payment Required. - AgentPayOps evaluates vendor, category, amount, approval threshold, and duplicate-purchase rules.
- The system approves, blocks, or escalates the payment.
- Transactions and reasoning are shown in an audit dashboard.
- Next.js 16 App Router
- TypeScript
- Tailwind CSS 4
- Lucide icons
- Deterministic sample data
- Policy evaluation engine
- X402-style protected endpoint with default demo mode and optional real
@x402/nextsettlement - API routes for invoice analysis, file upload extraction, policy evaluation, payment attempt, vendor-risk report, and audit data
- Invoice intake UI with sample invoices, uploaded invoice documents, extracted fields, risk findings, and required paid-data callouts
- Interactive scenario runner for approved, escalated, and blocked agent payments
- Live transaction and audit log updates when an agent scenario completes
- AI finance memo route with Gemini support and deterministic fallback
- Dockerfile and Docker Compose configuration for Vultr/Coolify deployment
- Health endpoint at
/api/health - Supabase/Postgres schema and optional persistence for agent runs, transactions, and audit events
- Public GitHub repository: https://github.com/anilandcode/AgentPayOps
- Primary Vultr/Coolify demo URL: http://st2bm9ob1tiu62tc8jatrwlk.149.28.34.93.sslip.io/
- Backup Vercel demo URL: https://agent-pay-ops.vercel.app/
- Track fit: B2B FinOps & Compliance for autonomous agents using X402-style programmable payment controls.
- Technology partners used: Vultr for the deployed VM/web backend and Gemini for finance reasoning and invoice extraction support.
- Supabase is the system of record for completed runs, transactions, and audit events when the Supabase environment variables are configured.
Browser
-> Next.js UI on Vultr/Coolify
-> /api/invoices/analyze for sample or pasted invoice text
-> /api/invoices/upload for TXT/CSV/JSON/XML plus Gemini-assisted PDF/image extraction
-> /api/payments/attempt for policy evaluation and payment decision
-> /api/vendor-risk/report for X402-style 402 challenge and paid retry
-> /api/agent/reasoning for Gemini finance memo generation
-> Supabase for transactions, audit events, and completed agent runs
The app keeps X402_MODE=demo for browser-based judging, while the same vendor-risk route can be switched to official @x402/next settlement with X402_MODE=real and a receiving address.
The demo-files/ folder contains the invoice files used in the recorded walkthrough:
| File | Expected result | Why |
|---|---|---|
Invoice_Standard_Data.txt |
approved |
Low-value software/API invoice with a vendor-risk surcharge. |
Invoice_HighValue_Compute.txt |
escalated |
High-value GPU/cloud compute invoice above autonomous approval limits. |
Invoice_High_Limit_Cloud.txt.txt |
escalated |
High-value AWS infrastructure invoice above autonomous approval limits. |
Invoice_Blocked_Vendor.txt |
blocked |
Offshore/uncategorized lead-list vendor with bypass proxy line items. |
Invoice_Duplicate_Enrichment.txt |
blocked |
Duplicate enrichment purchase pattern from an agent-initiated lead-generation flow. |
Copy .env.example to .env.local when you want live AI reasoning.
GEMINI_API_KEY=your_key_here
GEMINI_MODEL=gemini-2.5-flashIf no Gemini key is present, the app still works and returns deterministic finance memos from the policy decision.
For persistent transactions and audit logs, run supabase/schema.sql in Supabase and set:
NEXT_PUBLIC_SUPABASE_URL=your_project_url
NEXT_PUBLIC_SUPABASE_ANON_KEY=your_anon_key
SUPABASE_SERVICE_ROLE_KEY=your_service_role_keyThe vendor-risk report runs in demo payment mode by default so the browser demo works without a wallet. To enable the official X402 route wrapper for real payment clients, set:
X402_MODE=real
X402_RECEIVING_ADDRESS=0xYourReceivingAddress
X402_NETWORK=eip155:84532
X402_VENDOR_REPORT_PRICE=0.42
X402_FACILITATOR_URL=https://facilitator.x402.orgnpm install
npm run devOpen http://localhost:3000.
npm run lint
npm run buildVercel is useful for quick previews, but the final Vultr award submission should run on a Vultr VM.
Docker build:
docker build -t agentpayops .
docker run --env-file .env -p 3000:3000 agentpayopsDocker Compose:
cp .env.example .env
docker compose up -d --buildHealth check:
curl http://localhost:3000/api/healthVultr/Coolify deployment notes are in docs/deployment/vultr.md.
Supabase persistence notes are in docs/deployment/supabase.md.
Protected vendor-risk endpoint returns a payment challenge:
curl -i http://localhost:3000/api/vendor-risk/reportX402 mode/status:
curl http://localhost:3000/api/x402/statusPaid report succeeds with a mock payment proof:
curl http://localhost:3000/api/vendor-risk/report \
-H 'x-payment-proof: x402-demo-check'Clean payment attempt:
curl -X POST http://localhost:3000/api/payments/attempt \
-H 'content-type: application/json' \
-d '{"vendorName":"Veritas Risk Graph","category":"vendor-risk-data","amount":0.42,"invoiceId":"INV-2412"}'Invoice analysis:
curl -X POST http://localhost:3000/api/invoices/analyze \
-H 'content-type: application/json' \
-d '{"sampleId":"sample-cloud-escalation"}'Invoice upload:
curl -X POST http://localhost:3000/api/invoices/upload \
-F 'invoice=@./demo-files/Invoice_Duplicate_Enrichment.txt'- Record the demo video with the Vultr URL as the primary deployment.
- Add team-specific policy editing if time allows.
- Replace demo X402 mode with real settlement once an X402-capable client is available.