<p align="center"> <h1 align="center">Prokura</h1> <p align="center"><b>Verifiable authority for AI-agent payments.</b><br>Built in Frankfurt for European rails and European law.</p> </p>

<p align="center"> <a href="LICENSE"><img alt="Apache-2.0" src="https://img.shields.io/badge/license-Apache--2.0-blue.svg"></a> <img alt="status" src="https://img.shields.io/badge/status-pre--release-orange.svg"> <img alt="runtime" src="https://img.shields.io/badge/node-22-brightgreen.svg"> </p>

---

AI agents can already pay. What they cannot do is prove they were allowed to.

Prokura lets a company or person grant an agent a scoped, capped, revocable mandate; checks every payment against it before money moves; and leaves evidence that a bank, merchant or auditor can verify without trusting us.

> _Prokura_ (§ 48 HGB) is the German term for a registered commercial power of attorney. The credential borrows the idea, not the statute.

How it works

Principal ──issues──▶ Credential ──held by──▶ Agent ──intent──▶ Gate ──allow──▶ Rail ──▶ Evidence
                                                                 │
                                                          step_up · deny

|                |                                                                                                                                                |

| -------------- | ---------------------------------------------------------------------------------------------------------------------------------------------- |

| **Credential** | W3C Verifiable Credential: payees, caps, four-eyes threshold, purposes, rails, validity, sub-delegation, B2B fields (PO, invoice hash, Skonto) |

| **Gate**       | Deterministic rules, no model in the path. `allow` · `step_up` (passkey) · `deny`, with a reason code                                          |

| **Rail**       | Executed server-side. The agent never holds payment credentials                                                                                |

| **Evidence**   | Hash-chained, signed, exportable (_Nachweis_). Daily Merkle roots                                                                              |

Quick start

git clone https://github.com/prokura-network/prokura && cd prokura
cp .env.example .env     # set MOLLIE_API_KEY to your Mollie test key (test_…)
docker compose up -d     # api :8080 · approve :8081 · mcp :8082 · x402-mock :8090 · postgres
pnpm install             # Node 22 + pnpm, for the demo and verify scripts
pnpm demo                # allow · step_up · deny, each with a Nachweis
pnpm demo:rails          # one mandate, three rails: Mollie card, Mollie SEPA, x402 (USDC)
pnpm demo:revoke         # revoke mid-mandate, next payment denied MANDATE_REVOKED
pnpm verify <file>       # check a credential, Nachweis (JSON or PDF) or inclusion proof offline

The step-up payment prints a link to the approval page; open the printed enrollment link first to register a passkey. To approve on a phone, see [docs/phone-approval.md](docs/phone-approval.md). API reference: <http://localhost:8080/docs>. Public demo endpoints (feed, stats, session tokens, checkpoints, verify): [docs/public-api.md](docs/public-api.md). `x402-mock` is a development stand-in for the paid API and the licensed partner; it moves no funds.

Connect any MCP client (Claude, ChatGPT, Cursor):

{ "mcpServers": { "prokura": { "url": "http://localhost:8082/mcp" } } }

Tools: `prokura.request_mandate` · `prokura.check` · `prokura.pay` · `prokura.evidence` · `prokura.mandate`

Works with

Visa Intelligent Commerce / TAP · Mastercard Agent Pay · Google AP2 · OpenAI/Stripe ACP · x402 / MPP · Mollie · Hyperswitch · SEPA

One mandate, emitted in whatever format the rail speaks.

What Prokura is not

Not an identity issuer. Not a wallet. Not a PSP. Not a guarantor. Networks authenticate, banks settle, insurers carry risk. Prokura proves the authority behind the instruction.

Repository

packages/   schema · authority · gate · evidence · adapters · mcp · sdk
apps/       api · approve · docs
examples/   claude-desktop · browser-agent
SPEC.md     architecture, API, milestones

Principles

Deterministic before execution · agents never hold credentials · evidence over trust · protocol-neutral.

Licence

`packages/` Apache-2.0. `apps/` source-available during pre-release.

<p align="center">_{Prokura Network · Frankfurt am Main · hello@prokura.network}</p>