@prismnetwork/mcp 0.7.0 → 0.8.1

package/README.md

@@ -13,10 +13,14 @@ claude mcp add prism -- npx -y @prismnetwork/mcp
 Then ask what you can rent. `prism_list_gpus` answers from live capacity with
 real prices. Leasing spends money, so those tools ask for a wallet and say so.
 
+Packaged for Claude Code and Codex as the [Prism plugin](https://plugins.prismnetwork.tech),
+which wires this server up and prompts for the wallet at install time.
+
 ## Tools
 
 | Tool | Wallet |
 | --- | --- |
+| `prism_budget` | no |
 | `prism_list_gpus` | no |
 | `prism_price_index` | no |
 | `prism_receipts` | no |
@@ -34,6 +38,8 @@ real prices. Leasing spends money, so those tools ask for a wallet and say so.
 | `prism_vault_delete` | yes |
 | `prism_vault_release` | yes |
 
+- `prism_budget`: the spending limits in force and what has already been spent
+  today, with the recent charges.
 - `prism_wallet`: the agent's address and USDG/ETH balances.
 - `prism_list_gpus`: GPUs available to lease, with price per second and per hour.
 - `prism_price_index`: sourced and settled pricing per GPU model, for cost estimates.
@@ -57,6 +63,29 @@ real prices. Leasing spends money, so those tools ask for a wallet and say so.
 - `prism_vault_delete`: permanently delete an item.
 - `prism_vault_release`: authorize an item into a lease that clears its trust floor.
 
+## Spending limits
+
+Two ceilings bound what this server can spend, and a refusal quotes both.
+
+| Variable | Default | What it bounds |
+| --- | --- | --- |
+| `PRISM_MAX_USDG` | 1 | Any single lease or generation. `max_usdg` on a call may lower it, never raise it past this. |
+| `PRISM_DAILY_BUDGET_USDG` | 5 | Everything in a rolling 24 hours. `0` removes the ceiling. |
+| `PRISM_LEDGER_PATH` | `~/.prism/spend.json` | Where the spend is recorded. |
+
+Spend is written before the money moves, so a crash between funding an escrow
+and answering is counted rather than forgiven, and a restart does not hand back
+a fresh day's allowance. Only an attempt that provably never reached the chain
+is reverted. Two clients pointed at one wallet share one ceiling, because they
+share the ledger file.
+
+None of this is the real limit. Fund a dedicated wallet with what you are
+willing to lose: that balance is what survives a bug in everything above.
+
+Tools that spend are annotated `destructiveHint` and carry
+`anthropic/requiresUserInteraction`, so Claude Code asks before every one of
+them even in modes that otherwise approve tools automatically.
+
 ## Vault
 
 An agent that handles a card, an identity document or a credential should not
@@ -82,7 +111,8 @@ Point your MCP client (Claude Desktop / Code) at the published server:
       "args": ["-y", "@prismnetwork/mcp"],
       "env": {
         "PRISM_AGENT_KEY": "0x<agent wallet private key>",
-        "PRISM_ESCROW": "0x62C042265991bEa17B07229322A01850974626dA"
+        "PRISM_MAX_USDG": "1",
+        "PRISM_DAILY_BUDGET_USDG": "5"
       }
     }
   }
@@ -95,11 +125,17 @@ Or add it to Claude Code in one line:
 
 ```sh
 claude mcp add prism \
-  --env PRISM_ESCROW=0x62C042265991bEa17B07229322A01850974626dA \
   --env PRISM_AGENT_KEY=0x<agent wallet private key> \
+  --env PRISM_DAILY_BUDGET_USDG=5 \
   -- npx -y @prismnetwork/mcp
 ```
 
+Codex takes the same server:
+
+```sh
+codex mcp add prism --env PRISM_AGENT_KEY=0x<agent wallet private key> -- npx -y @prismnetwork/mcp
+```
+
 ## Timing
 
 `prism_lease` and `prism_lease_and_run` block while a GPU provisions (usually one to four minutes, occasionally longer on a slow host). Configure your MCP client to allow long tool calls.

package/budget.mjs

@@ -0,0 +1,260 @@
+// What stands between a model deciding to rent a GPU and a wallet paying for it.
+//
+// The wallet balance is the real ceiling: fund the agent wallet with what you
+// are willing to lose, because nothing here can spend money that is not in the
+// account. This file is the second line, and it exists because the per-call cap
+// alone never was one. `max_usdg` bounds a single lease at 1 USDG by default and
+// says nothing about the fortieth lease in a row, which is the failure an
+// unattended agent actually produces.
+//
+// Spend is written before the money moves and reverted only when the attempt
+// provably cost nothing, so a crash between funding and reply is counted rather
+// than forgiven. The file is shared across clients on purpose: one wallet gets
+// one daily ceiling whether Claude, Codex, or a script is holding it.
+import { mkdirSync, readFileSync, renameSync, writeFileSync, openSync, closeSync, unlinkSync, statSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+
+const MICROS = 1_000_000;
+const DAY_MS = 86_400_000;
+// Entries older than this are dropped on write. Two days covers the rolling
+// window with room for a clock that stepped backwards.
+const MEMORY_MS = 2 * DAY_MS;
+const LOCK_STALE_MS = 15_000;
+const LOCK_WAIT_MS = 5_000;
+
+export class BudgetError extends Error {
+  constructor(message, detail = {}) {
+    super(message);
+    this.name = "BudgetError";
+    this.detail = detail;
+  }
+}
+
+export const usdg = (micros) => `${(Number(micros) / MICROS).toFixed(6)} USDG`;
+
+function positiveNumber(raw, fallback, name) {
+  if (raw === undefined || raw === null || String(raw).trim() === "") return fallback;
+  const value = Number(raw);
+  if (!Number.isFinite(value) || value < 0) {
+    throw new BudgetError(`${name} must be a non-negative number of USDG, got ${JSON.stringify(raw)}`);
+  }
+  return value;
+}
+
+// One .mcp.json serves every client, and they disagree about templates: Claude
+// Code expands ${user_config.x} before launch, Codex passes it through. Reading
+// the literal template as a value would turn "no wallet configured" into
+// "wallet configured and broken", so an unexpanded placeholder is nothing.
+export function stripUnexpanded(env = process.env) {
+  for (const [key, value] of Object.entries(env)) {
+    if (key.startsWith("PRISM_") && /^\$\{[^}]*\}$/.test(String(value ?? "").trim())) delete env[key];
+  }
+  return env;
+}
+
+export function defaultLedgerPath(env = process.env) {
+  if (env.PRISM_LEDGER_PATH) return env.PRISM_LEDGER_PATH;
+  return join(env.HOME || homedir(), ".prism", "spend.json");
+}
+
+// A missing budget is not an unlimited one. The default is deliberately small:
+// enough for a handful of real leases, cheap enough that discovering the plugin
+// spends money costs about the price of a coffee rather than a rent cheque.
+export function readBudget(env = process.env) {
+  const maxPerCall = positiveNumber(env.PRISM_MAX_USDG, 1, "PRISM_MAX_USDG");
+  const daily = positiveNumber(env.PRISM_DAILY_BUDGET_USDG, 5, "PRISM_DAILY_BUDGET_USDG");
+  if (maxPerCall <= 0) throw new BudgetError("PRISM_MAX_USDG must be above zero");
+  // A per-call cap above the day's allowance is a cap in name only, and the
+  // mismatch is always a configuration mistake rather than an intention.
+  if (daily > 0 && maxPerCall > daily) {
+    throw new BudgetError(
+      `PRISM_MAX_USDG (${maxPerCall}) cannot exceed PRISM_DAILY_BUDGET_USDG (${daily}); lower the per-call cap or raise the daily one`,
+    );
+  }
+  return {
+    maxPerCallMicros: Math.round(maxPerCall * MICROS),
+    // Zero means the operator explicitly removed the daily ceiling. It is not
+    // the default and it is not what a missing variable produces.
+    dailyMicros: Math.round(daily * MICROS),
+    ledgerPath: defaultLedgerPath(env),
+  };
+}
+
+// A lock rather than last-write-wins, because two clients sharing one wallet is
+// the case this file exists for. A lock older than LOCK_STALE_MS belonged to a
+// process that died; breaking it is safe and not breaking it wedges the wallet.
+function withLock(path, fn, waitMs = LOCK_WAIT_MS) {
+  const lock = `${path}.lock`;
+  mkdirSync(dirname(path), { recursive: true });
+  const deadline = Date.now() + waitMs;
+  for (;;) {
+    let fd;
+    try {
+      fd = openSync(lock, "wx");
+    } catch (err) {
+      if (err?.code !== "EEXIST") throw err;
+      let age = 0;
+      try {
+        age = Date.now() - statSync(lock).mtimeMs;
+      } catch {
+        continue; // it vanished between the open and the stat; retry immediately
+      }
+      if (age > LOCK_STALE_MS) {
+        try {
+          unlinkSync(lock);
+        } catch {
+          /* another process broke it first, which is the outcome we wanted */
+        }
+        continue;
+      }
+      if (Date.now() > deadline) {
+        throw new BudgetError(
+          `the spend ledger at ${path} is locked by another Prism process; nothing was charged. Retry in a moment.`,
+        );
+      }
+      // Busy-wait deliberately: this holds for milliseconds and the alternative
+      // is making every caller of a synchronous ledger asynchronous.
+      Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 25);
+      continue;
+    }
+    try {
+      closeSync(fd);
+      return fn();
+    } finally {
+      try {
+        unlinkSync(lock);
+      } catch {
+        /* already gone */
+      }
+    }
+  }
+}
+
+function readState(path) {
+  try {
+    const parsed = JSON.parse(readFileSync(path, "utf8"));
+    if (!parsed || !Array.isArray(parsed.entries)) return { entries: [] };
+    return { entries: parsed.entries.filter((e) => e && Number.isFinite(e.at) && Number.isFinite(e.micros)) };
+  } catch (err) {
+    if (err?.code === "ENOENT") return { entries: [] };
+    // A corrupt ledger must not read as an empty one: that would hand the
+    // caller a fresh day's budget every time the file got truncated.
+    throw new BudgetError(
+      `the spend ledger at ${path} is unreadable (${err?.message ?? err}), so spending is refused. Move or repair the file.`,
+    );
+  }
+}
+
+function writeState(path, state, now) {
+  const entries = state.entries.filter((e) => now - e.at < MEMORY_MS);
+  const tmp = `${path}.${process.pid}.tmp`;
+  writeFileSync(tmp, `${JSON.stringify({ version: 1, entries }, null, 2)}\n`, { mode: 0o600 });
+  renameSync(tmp, path);
+}
+
+export function spentInWindow(entries, now) {
+  return entries.reduce((total, e) => (now - e.at < DAY_MS ? total + e.micros : total), 0);
+}
+
+export class SpendLedger {
+  constructor({ ledgerPath, dailyMicros, maxPerCallMicros, lockWaitMs = LOCK_WAIT_MS }) {
+    this.path = ledgerPath;
+    this.dailyMicros = dailyMicros;
+    this.maxPerCallMicros = maxPerCallMicros;
+    this.lockWaitMs = lockWaitMs;
+  }
+
+  // What is left of today, for the caller to show before it asks to spend.
+  remaining(now = Date.now()) {
+    if (this.dailyMicros <= 0) return null;
+    const { entries } = readState(this.path);
+    return Math.max(0, this.dailyMicros - spentInWindow(entries, now));
+  }
+
+  status(now = Date.now()) {
+    const { entries } = readState(this.path);
+    const spent = spentInWindow(entries, now);
+    return {
+      daily_budget: this.dailyMicros > 0 ? usdg(this.dailyMicros) : "unlimited (PRISM_DAILY_BUDGET_USDG=0)",
+      spent_last_24h: usdg(spent),
+      remaining_today: this.dailyMicros > 0 ? usdg(Math.max(0, this.dailyMicros - spent)) : "unlimited",
+      max_per_call: usdg(this.maxPerCallMicros),
+      ledger: this.path,
+      charges_last_24h: entries
+        .filter((e) => now - e.at < DAY_MS)
+        .sort((a, b) => b.at - a.at)
+        .slice(0, 20)
+        .map((e) => ({
+          at: new Date(e.at).toISOString(),
+          tool: e.tool,
+          amount: usdg(e.micros),
+          ...(e.reference ? { reference: e.reference } : {}),
+        })),
+    };
+  }
+
+  // Records the spend before the money moves. Returns a handle the caller
+  // reverts only when it can prove nothing was charged.
+  commit({ tool, micros, now = Date.now() }) {
+    if (!Number.isFinite(micros) || micros <= 0) {
+      throw new BudgetError("a spend must be a positive number of micros");
+    }
+    if (micros > this.maxPerCallMicros) {
+      throw new BudgetError(
+        `${tool} would commit up to ${usdg(micros)}, past the ${usdg(this.maxPerCallMicros)} per-call cap. ` +
+          `Lower max_usdg for this call, or raise PRISM_MAX_USDG.`,
+        { required: micros, cap: this.maxPerCallMicros },
+      );
+    }
+    return withLock(
+      this.path,
+      () => {
+        const state = readState(this.path);
+        const spent = spentInWindow(state.entries, now);
+        if (this.dailyMicros > 0 && spent + micros > this.dailyMicros) {
+          throw new BudgetError(
+            `${tool} would take today's Prism spend to ${usdg(spent + micros)}, past the ${usdg(this.dailyMicros)} ` +
+              `daily cap (${usdg(spent)} already spent). Nothing was charged. Raise PRISM_DAILY_BUDGET_USDG to continue.`,
+            { spent, requested: micros, cap: this.dailyMicros },
+          );
+        }
+        const id = `${now.toString(36)}-${Math.random().toString(36).slice(2, 10)}`;
+        state.entries.push({ id, at: now, tool, micros });
+        writeState(this.path, state, now);
+        return id;
+      },
+      this.lockWaitMs,
+    );
+  }
+
+  // Only for an attempt that provably cost nothing. A funded lease whose command
+  // failed is not one of those.
+  revert(id) {
+    if (!id) return false;
+    return withLock(this.path, () => {
+      const state = readState(this.path);
+      const before = state.entries.length;
+      state.entries = state.entries.filter((e) => e.id !== id);
+      if (state.entries.length === before) return false;
+      writeState(this.path, state, Date.now());
+      return true;
+    }, this.lockWaitMs);
+  }
+
+  // Replaces the reserved figure with what was actually committed on-chain and
+  // pins the receipt to it, so the ledger reads like a statement rather than a
+  // list of intentions.
+  settle(id, { micros, reference } = {}) {
+    if (!id) return false;
+    return withLock(this.path, () => {
+      const state = readState(this.path);
+      const entry = state.entries.find((e) => e.id === id);
+      if (!entry) return false;
+      if (Number.isFinite(micros) && micros >= 0) entry.micros = micros;
+      if (reference) entry.reference = reference;
+      writeState(this.path, state, Date.now());
+      return true;
+    }, this.lockWaitMs);
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@prismnetwork/mcp",
-  "version": "0.7.0",
+  "version": "0.8.1",
   "description": "MCP server for leasing and running on Prism Network GPUs.",
   "mcpName": "io.github.prismnetwork-tech/mcp",
   "type": "module",
@@ -9,6 +9,7 @@
   },
   "files": [
     "server.mjs",
+    "budget.mjs",
     "README.md"
   ],
   "engines": {
@@ -16,16 +17,19 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.0.0",
-    "@prismnetwork/agent-sdk": "^0.5.0",
+    "@prismnetwork/agent-sdk": "^0.6.1",
     "viem": "^2"
   },
   "keywords": [
-    "prism",
-    "mcp",
-    "gpu",
     "agent",
     "claude",
-    "compute"
+    "codex",
+    "compute",
+    "gpu",
+    "gpu-rental",
+    "mcp",
+    "prism",
+    "x402"
   ],
   "homepage": "https://prismnetwork.tech",
   "repository": {

package/server.mjs

@@ -6,6 +6,9 @@ import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { CallToolRequestSchema, ListToolsRequestSchema } from "@modelcontextprotocol/sdk/types.js";
 import { DEFAULT_IMAGE, DEFAULT_TRUST_FLOOR, PrismAgent, TRUST_CLASSES } from "@prismnetwork/agent-sdk";
+import { BudgetError, SpendLedger, readBudget, stripUnexpanded } from "./budget.mjs";
+
+stripUnexpanded(process.env);
 
 const IMAGE = process.env.PRISM_DEFAULT_IMAGE ?? DEFAULT_IMAGE;
 
@@ -41,6 +44,18 @@ if (!agent) {
   );
 }
 
+// A budget the operator got wrong must stop spending, not fall back to none.
+// Reading capacity and prices is unaffected, so a typo is discoverable rather
+// than fatal.
+let ledger = null;
+let budgetProblem = null;
+try {
+  ledger = new SpendLedger(readBudget());
+} catch (err) {
+  budgetProblem = err?.message ?? String(err);
+  console.error(`prism mcp: ${budgetProblem}`);
+}
+
 function requireWallet(tool, reason = "spends money") {
   if (!agent) {
     throw new Error(
@@ -50,6 +65,32 @@ function requireWallet(tool, reason = "spends money") {
   return agent;
 }
 
+function requireLedger(tool) {
+  if (!ledger) {
+    throw new Error(`${tool} needs the spend limits, and they are unusable: ${budgetProblem}`);
+  }
+  return ledger;
+}
+
+// Records the spend before the money moves, then reconciles. An attempt that
+// never reached the chain is reverted; anything that funded an escrow keeps its
+// entry and gains the transaction that proves it, because a ledger that forgets
+// a funded lease is worse than no ledger at all.
+async function spending(tool, micros, run) {
+  const book = requireLedger(tool);
+  const id = book.commit({ tool, micros });
+  try {
+    const { value, settledMicros, reference } = await run();
+    book.settle(id, { micros: settledMicros, reference });
+    return value;
+  } catch (err) {
+    const funded = err?.body?.funding_hash;
+    if (funded) book.settle(id, { reference: funded });
+    else book.revert(id);
+    throw err;
+  }
+}
+
 function requireCommand(value) {
   if (typeof value !== "string" || value.trim() === "") {
     throw new Error("command is required: the shell command to run on the GPU, e.g. 'nvidia-smi'.");
@@ -60,8 +101,12 @@ function requireCommand(value) {
   return value;
 }
 
-function maxDeposit(args) {
-  const cap = args.max_usdg ?? 1;
+// The per-call ceiling is the operator's, not the model's: an omitted max_usdg
+// takes the configured cap rather than a hardcoded one, and a stated max_usdg
+// above it is refused when the ledger checks the commit.
+function maxDeposit(tool, args) {
+  if (args.max_usdg === undefined) return requireLedger(tool).maxPerCallMicros;
+  const cap = args.max_usdg;
   if (typeof cap !== "number" || !Number.isFinite(cap) || cap <= 0) {
     throw new Error("max_usdg must be a positive number of USDG.");
   }
@@ -106,11 +151,28 @@ function leaseId(value) {
   return id;
 }
 
+// Hints a client uses to decide what it may run unattended. `reads` is anything
+// that cannot change state or move money; `spends` is anything that can, and it
+// carries the Claude Code marker that forces a confirmation prompt on every call
+// even in modes that otherwise auto-approve.
+const reads = { readOnlyHint: true, openWorldHint: true };
+const spends = {
+  annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true },
+  _meta: { "anthropic/requiresUserInteraction": true },
+};
+
 const TOOLS = [
+  {
+    name: "prism_budget",
+    description: "Show the spending limits this server enforces and what it has already spent in the last 24 hours, with the recent charges. Needs no wallet. Check this before a long job; a lease refused for budget says the same numbers.",
+    inputSchema: { type: "object", properties: {} },
+    annotations: { title: "Spending limits", readOnlyHint: true, openWorldHint: false },
+  },
   {
     name: "prism_wallet",
     description: "Show the agent's wallet address and on-chain balances (USDG and ETH for gas) on Robinhood Chain. Check this before leasing to confirm the wallet can pay.",
     inputSchema: { type: "object", properties: {} },
+    annotations: { title: "Wallet balances", ...reads },
   },
   {
     name: "prism_list_gpus",
@@ -125,11 +187,13 @@ const TOOLS = [
         },
       },
     },
+    annotations: { title: "Available GPUs", ...reads },
   },
   {
     name: "prism_price_index",
     description: "Current GPU pricing on Prism Network by model: sourced low/median/high and settled mean, in USDG per hour. Needs no wallet. Use it to estimate what an analysis job will cost before leasing.",
     inputSchema: { type: "object", properties: {} },
+    annotations: { title: "GPU price index", ...reads },
   },
   {
     name: "prism_receipts",
@@ -140,11 +204,13 @@ const TOOLS = [
         limit: { type: "integer", description: "Max receipts to return (default 10, max 50)." },
       },
     },
+    annotations: { title: "Settled receipts", ...reads },
   },
   {
     name: "prism_leases",
     description: "List this wallet's leases on Prism Network with their current state.",
     inputSchema: { type: "object", properties: {} },
+    annotations: { title: "Your leases", ...reads },
   },
   {
     name: "prism_batch_run",
@@ -159,6 +225,8 @@ const TOOLS = [
       },
       required: ["command"],
     },
+    ...spends,
+    annotations: { title: "Rent a GPU for one command", ...spends.annotations },
   },
   {
     name: "prism_batch_result",
@@ -170,6 +238,7 @@ const TOOLS = [
       },
       required: ["lease_id"],
     },
+    annotations: { title: "Batch result", ...reads },
   },
   {
     name: "prism_infer",
@@ -183,6 +252,8 @@ const TOOLS = [
       },
       required: ["prompt"],
     },
+    ...spends,
+    annotations: { title: "Buy one LLM generation", ...spends.annotations },
   },
   {
     name: "prism_lease_and_run",
@@ -202,6 +273,8 @@ const TOOLS = [
       },
       required: ["command"],
     },
+    ...spends,
+    annotations: { title: "Rent a GPU and run a command", ...spends.annotations },
   },
   {
     name: "prism_lease",
@@ -219,6 +292,8 @@ const TOOLS = [
         max_usdg: { type: "number", description: "Hard cap on the USDG this lease may cost (default 1). Raise it deliberately for longer leases." },
       },
     },
+    ...spends,
+    annotations: { title: "Rent a GPU", ...spends.annotations },
   },
   {
     name: "prism_run",
@@ -232,6 +307,7 @@ const TOOLS = [
       },
       required: ["lease_id", "command"],
     },
+    annotations: { title: "Run a command on a lease", readOnlyHint: false, destructiveHint: true, openWorldHint: true },
   },
   {
     name: "prism_end_lease",
@@ -241,6 +317,7 @@ const TOOLS = [
       properties: { lease_id: { type: "integer" } },
       required: ["lease_id"],
     },
+    annotations: { title: "Release a lease", readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: true },
   },
   {
     name: "prism_vault_store",
@@ -258,11 +335,13 @@ const TOOLS = [
       },
       required: ["value"],
     },
+    annotations: { title: "Seal a secret", readOnlyHint: false, destructiveHint: false, openWorldHint: true },
   },
   {
     name: "prism_vault_list",
     description: "List the agent's sealed vault items: item_id, label, version and trust floor. Values are not returned and are not readable by Prism.",
     inputSchema: { type: "object", properties: {} },
+    annotations: { title: "List sealed items", ...reads },
   },
   {
     name: "prism_vault_read",
@@ -272,6 +351,8 @@ const TOOLS = [
       properties: { item_id: { type: "string", description: "The item_id from prism_vault_store or prism_vault_list." } },
       required: ["item_id"],
     },
+    _meta: { "anthropic/requiresUserInteraction": true },
+    annotations: { title: "Decrypt one sealed item", readOnlyHint: true, openWorldHint: true },
   },
   {
     name: "prism_vault_delete",
@@ -281,6 +362,8 @@ const TOOLS = [
       properties: { item_id: { type: "string" } },
       required: ["item_id"],
     },
+    ...spends,
+    annotations: { title: "Delete a sealed item", ...spends.annotations },
   },
   {
     name: "prism_vault_release",
@@ -293,10 +376,13 @@ const TOOLS = [
       },
       required: ["item_id", "lease_id"],
     },
+    ...spends,
+    annotations: { title: "Release a secret into a lease", ...spends.annotations },
   },
 ];
 
 async function handle(name, args) {
+  if (name === "prism_budget") return requireLedger(name).status();
   if (name === "prism_wallet") {
     const b = await requireWallet("prism_wallet").balances();
     return { address: b.address, usdg: usdg(b.usdg), eth_wei: b.eth };
@@ -387,22 +473,27 @@ async function handle(name, args) {
   if (name === "prism_batch_run") {
     requireCommand(args.command);
     requireWallet(name);
-    const cap = maxDeposit(args);
-    const batch = await agent.lease({
-      image: IMAGE,
-      durationSeconds: args.duration_seconds ?? 900,
-      minVramMib: args.min_vram_mib ?? 16000,
-      maxDeposit: cap,
-      command: args.command,
+    const cap = maxDeposit(name, args);
+    return spending(name, cap, async () => {
+      const batch = await agent.lease({
+        image: IMAGE,
+        durationSeconds: args.duration_seconds ?? 900,
+        minVramMib: args.min_vram_mib ?? 16000,
+        maxDeposit: cap,
+        command: args.command,
+      });
+      return {
+        reference: batch.fundingHash,
+        value: {
+          lease_id: batch.leaseId,
+          funding_tx: batch.fundingHash,
+          exit_code: batch.result?.exit_code,
+          stdout: batch.result?.stdout,
+          stderr: batch.result?.stderr,
+          truncated: batch.result?.truncated ?? false,
+        },
+      };
     });
-    return {
-      lease_id: batch.leaseId,
-      funding_tx: batch.fundingHash,
-      exit_code: batch.result?.exit_code,
-      stdout: batch.result?.stdout,
-      stderr: batch.result?.stderr,
-      truncated: batch.result?.truncated ?? false,
-    };
   }
   if (name === "prism_batch_result") {
     requireWallet(name, "reads this wallet's leases");
@@ -430,13 +521,21 @@ async function handle(name, args) {
     }
     const pendingKey = `${base}:${price}`;
     let pending = pendingInference.get(pendingKey);
+    // A kept payment was already charged and already counted. Only a new
+    // transfer touches the ledger, or a retry would bill the day twice for one
+    // generation.
     if (!pending) {
-      const paymentTx = await agent.transferUsdg(offer.pay_to, price);
-      const signature = await agent.account.signMessage({ message: paymentTx });
-      pending = {
-        tx: paymentTx,
-        header: Buffer.from(JSON.stringify({ txHash: paymentTx, signature })).toString("base64"),
-      };
+      pending = await spending(name, Number(price), async () => {
+        const paymentTx = await agent.transferUsdg(offer.pay_to, price);
+        const signature = await agent.account.signMessage({ message: paymentTx });
+        return {
+          reference: paymentTx,
+          value: {
+            tx: paymentTx,
+            header: Buffer.from(JSON.stringify({ txHash: paymentTx, signature })).toString("base64"),
+          },
+        };
+      });
       pendingInference.set(pendingKey, pending);
     }
     // A cold endpoint holds the request through provisioning; when it answers
@@ -472,14 +571,17 @@ async function handle(name, args) {
   if (name === "prism_lease_and_run" || name === "prism_lease") {
     if (name === "prism_lease_and_run") requireCommand(args.command);
     requireWallet(name);
-    const cap = maxDeposit(args);
+    const cap = maxDeposit(name, args);
     sweepExpiredLeases();
-    const lease = await agent.lease({
-      image: IMAGE,
-      durationSeconds: args.duration_seconds ?? 900,
-      minVramMib: args.min_vram_mib ?? 16000,
-      maxDeposit: cap,
-      minTrustClass: args.min_trust_class ?? "open",
+    const lease = await spending(name, cap, async () => {
+      const funded = await agent.lease({
+        image: IMAGE,
+        durationSeconds: args.duration_seconds ?? 900,
+        minVramMib: args.min_vram_mib ?? 16000,
+        maxDeposit: cap,
+        minTrustClass: args.min_trust_class ?? "open",
+      });
+      return { value: funded, reference: funded.fundingHash };
     });
     leases.set(lease.leaseId, lease);
     const summary = {
@@ -577,13 +679,16 @@ async function handleVault(name, args) {
   throw new Error(`unknown tool ${name}`);
 }
 
-const server = new Server({ name: "prism", version: "0.7.0" }, { capabilities: { tools: {} } });
+const server = new Server({ name: "prism", version: "0.8.1" }, { capabilities: { tools: {} } });
 server.setRequestHandler(ListToolsRequestSchema, async () => ({ tools: TOOLS }));
 server.setRequestHandler(CallToolRequestSchema, async (request) => {
   try {
     const result = await handle(request.params.name, request.params.arguments ?? {});
     return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
   } catch (err) {
+    if (err instanceof BudgetError) {
+      return { isError: true, content: [{ type: "text", text: `${err.message} See prism_budget.` }] };
+    }
     const body = err?.body ?? {};
     const detail = [
       body.cause,