₿ sats

A tiny Bitcoin wallet
for humans and agents.

Run an on-chain wallet from your terminal, or give an AI agent a budget it cannot exceed. Keys stay local, spends are prepared as in-memory PSBTs, and every agent spend is checked against human-set limits before signing.

sats is experimental. Signet is the default; use small amounts and short agent grants while evaluating it.

$ curl -fsSL https://raw.githubusercontent.com/jonatns/sats/main/setup.sh | sh
sats — signet
$ sats init
wallet created (signet) · seed sealed with passphrase
$ sats receive
tb1p6h5fuzmnvpdthf5shf0qqjzwy7wsqc5rhmgq2ks9xrak4ry6mtrscsqvzp
$ sats balance
100,000 sat
$ sats send tb1p... 25k
amount 25,000 sat · fee 302 sat · confirm? y
signed · saved · broadcast ✓
$ sats agent grant claude --budget 50k --for 24h
grant “claude” · budget 50,000 sat · expires in 24h
$ sats agent serve claude
mcp server listening on stdio — tools: get_balance,
get_receive_address, get_grant, send

For humans

Signet is the default, so the complete flow can be tested without real funds. send prepares the transaction, shows its amount and fee, asks for confirmation, signs locally, saves the finalized transaction, and broadcasts. Amounts are integer sats with shorthand: 25k is 25,000 and 1.5m is 1,500,000.

$ sats init
$ sats receive
$ sats balance
$ sats send tb1p... 25k
$ sats status
$ sats history

Spends stay in memory as PSBTs; the explicit PSBT lifecycle runs on file artifacts, step by step, and sats psbt sign also signs external PSBTs from other wallets:

$ sats send tb1p... 25k --export-psbt spend.psbt
$ sats psbt inspect spend.psbt
$ sats psbt sign spend.psbt
$ sats tx broadcast <txid>

See the CLI reference for all commands, flags, configuration, and machine-readable output.

Give an agent a budget

Create bounded spending authority, then launch the MCP server as that agent. Each send is checked against the grant's expiry, per-transaction amount cap, fee cap, and remaining budget — before a signature is produced.

$ sats agent grant claude --budget 50k --for 24h --max-tx 10k --max-fee 1000
$ claude mcp add sats -- sats agent serve claude
get_balanceget_receive_addressget_grantsend

Outside that authority the agent receives a deterministic refusal, not a signature:

{
  "status": "denied",
  "reason": "over_max_tx",
  "message": "human authorization required: requested 20,000 sat; max tx 10,000 sat"
}

sats agent list shows current authority. sats agent revoke claude takes effect on the agent's next send call, including during an existing MCP session. See the MCP guide for tool contracts and integration details.

Safety model

Read the full security and trust model before using mainnet or unattended grants.

One engine, two native surfaces

sats-core is the portable wallet engine — transaction planning, authorization, seed sealing, and the signer boundary, with no filesystem, network, clock, or async-runtime dependencies. sats supplies native storage, providers, terminal output, the CLI, and the MCP server. Agents use the same preparation and safety path as humans, with the grant check added before signing.

Wallets are namespaced by network and share one sealed seed: mainnet, signet, testnet4, and regtest — mainnet is always an explicit choice. With no provider configuration, sats uses the appropriate mempool.space Esplora endpoint for chain sync, fee estimates, and broadcast. See Architecture and Providers and guards.