# Haven

> Haven is the buy-side control layer for AI-agent payments: give your agent a budget, not your wallet. Agents pay x402 (HTTP 402) merchants autonomously within owner-set, on-chain-enforced budgets. Non-custodial — the agent never holds a key, Haven never holds funds, and every budget can be inspected and revoked without Haven.

Haven connects agents through MCP (hosted, keyless) plus a local signer. Payments settle in USDC via x402, on the chains this deployment reports as chains.deployable in /.well-known/haven.json, using ERC-7710 delegated settlement natively and EIP-3009 as the compatibility path — so a Haven agent with an open (unpinned) budget can pay any standard x402 merchant today; recipient-pinned budgets settle via ERC-7710 only. Every payment produces a receipt: which agent, what it bought, which policy allowed it, and the on-chain proof.

> Links below are paths on this same host: resolve them against the URL you fetched this file from.

## Start here

- [You are an AI agent and your user has no Haven account yet](/for-agents.md): the sequence, which steps are the human's, and exactly what to say at each hand-off
- [Your agent hit a 402 — how to pay it](/402.md): what HTTP 402 means and how an agent pays it with a budget, not a wallet
- [Something broke — an update may be needed](/releases): what changed in each Haven client package, the minimum this deployment accepts, and how to update
- [Dashboard](/): create an account (one passkey prompt), create an agent, set its budget, get the connector command

## For people

The same material as web pages, for the human you are working for:

- [For agents](/for-agents): the runbook above as a page, with the commands an agent runs and what its user does
- [For developers](/developers): the connector, the local signer and the npm packages, with the payment flow end to end
- [How it works](/how-it-works): from an empty account to an agent paying within its budget; [the protocols](/how-it-works/protocols) covers x402 and Stripe MPP

## Packages (npm)

- [@haven_ai/connect](https://www.npmjs.com/package/@haven_ai/connect): one-command local connector — installs the MCP runtime, generates the agent signing key locally
- [@haven_ai/sdk](https://www.npmjs.com/package/@haven_ai/sdk): TypeScript SDK for direct integration (payments, x402 quote/pay/resume, allowances)
- [@haven_ai/mcp](https://www.npmjs.com/package/@haven_ai/mcp): local MCP server for credential-file integrations
- [@haven_ai/signer](https://www.npmjs.com/package/@haven_ai/signer): local edge signer — the delegate key never leaves the machine
- [@haven_ai/cli](https://www.npmjs.com/package/@haven_ai/cli): terminal-native management

## Trust and verification

- [Independent exit tool](/exit): inspect and revoke every agent budget with only a wallet and a public RPC — works even if Haven disappears
- [Account recovery](/docs/account-recovery.md): signer-set management and recovery model

## Docs

- [Account recovery](/docs/account-recovery.md): signer set, backup signers, and what is unrecoverable
- [Agent key rotation](/docs/agent-key-rotation.md): re-keying a lost or exposed delegate key without re-onboarding
- [Agent Passport](/docs/agent-passport.md): the signed attestation that an agent was issued, bound, governed and is revocable
- [Delegation rail security model](/docs/security-model.md): what the on-chain envelope enforces, and what it does not

## Machine-readable

- [Capability manifest](/.well-known/haven.json): the same environment as JSON — where to sign up, which steps only a human can do, the API and its spec, the connector package this deployment hands out, the chains it serves. Generated, never hand-edited.
- [Agent-skills index](/.well-known/agent-skills/index.json): the onboarding runbook (/for-agents.md), split into small linked step files, one skill per step — plus pointers to the manifest, the OpenAPI spec and the hosted MCP URL.

## Optional

- [Full agent-readable overview](/llms-full.txt): product model, payment flow, and integration surface in one file