LeashA gate between AI agents and PayPal
Your AI refunds.
Hoard checks the books.
PayPal's agent tools let an AI refund a payment or accept a dispute in one call. None of them asks first. Leash does: before any money leaves, Hoard checks it against your PayPal records, not the email. You decide what may go out without you.
Free. PayPal sandbox, no real money. Nothing to install.
AI already answers the refunds
Every payment gets one of four answers
- GoA $12 refund for a regular, inside the limit you set. Sent.
- Wait 15 minGoes out in 15 minutes unless you hit undo.
- Ask youNew customer, $140. Your phone buzzes.
- NopeThey already filed a PayPal case. Refunding now pays twice.
Go
Wait 15 min
Ask youHoard never reads the email. A pushy message or a fake “I'm the owner” note changes nothing: it checks the order, the payment, the tracking and the PayPal case.
Under the hood
- Judged on PayPal records, not the emailThe gate reads the order, the capture, the tracking and the dispute as PayPal has them. What the customer or the agent writes is shown to you, never used as evidence.
- Trust grows one bucket at a timeEach kind of action keeps its own last 10 outcomes, split by facts like how long the customer has been with you, how much they were refunded before and whether the order shipped. When the Wilson lower bound passes 75%, it goes out with a 15-minute undo; past 90%, alone. Always inside your limits.
- Evolve edits the playbook, never the gateEvolve rewrites the agent's playbook and tests it on cases it has not seen. The gate's rules live outside the playbook, so learning can't loosen them.
- One line to plug inThe MCP proxy uses the same tool names as PayPal's MCP server, like create_refund and accept_dispute_claim. An agent that already uses them changes one URL.
The PayPal calls Leash makes
13 endpoints across 6 PayPal APIs, all in the sandbox.
Payments v2
POST /v2/payments/captures/{id}/refundsend a refund the gate let through
Disputes v1
GET /v1/customer/disputescheck new keys, watch for new casesGET /v1/customer/disputes/{id}read a case before decidingPOST /v1/customer/disputes/{id}/accept-claimaccept a claim the gate let throughPOST /v1/customer/disputes/{id}/provide-evidencefile evidence built from PayPal recordsPOST /v1/customer/disputes/{id}/provide-supporting-infosame, when PayPal asks for this insteadPOST /v1/customer/disputes/{id}/adjudicatesandbox only: settle a demo case
Orders v2
GET /v2/checkout/orders/{id}order and its trackingPOST /v2/checkout/orders/{id}/trackadd trackingPOST /v2/checkout/ordersmake the demo shop's orders
Transaction Search v1
GET /v1/reporting/transactionsread your last 90 days at connect
Webhooks v1
POST /v1/notifications/verify-webhook-signaturecheck a dispute webhook really came from PayPal
OAuth 2.0
POST /v1/oauth2/tokenclient-credentials token
Already have an agent?
Point it at Leash instead of PayPal's MCP server. Same PayPal tools, same names. Every payment goes past Hoard first.
This is our hosted demo; create a key under Connect. Running your own Leash? Use its address and a key from it.
{
"mcpServers": {
"paypal-with-leash": {
"command": "npx",
"args": ["-y", "mcp-remote", "https://leash-paypal.vercel.app/mcp/",
"--header", "Authorization: Bearer <your Leash key>"]
}
}
}You decide what goes out alone
A new shop starts at nothing: every payment waits for your tap. The agent still does the work. It checks the order, writes the reply and gets the refund ready.
When you're ready, let small refunds go out alone and set how much in mistakes you accept a month. Reach it, and everything asks you again.
Hoard asks where you are
Approve on Telegram or by email, with one tap. Routine refunds arrive as a checklist with each customer's words next to the amount, so you read them before you approve them together.
An email button opens the payment again first. Nothing moves from a link alone.
It learns from your no, not your money
When you keep turning down the same kind of refund, Evolve has the agent rewrite its own playbook, test it on practice cases it has never seen, and ask you before using it. Hoard's rules are not in the playbook, so learning can't loosen them.
A simulated month in safe start, 20 emails a day: Hoard asked about 15 times a day at first and 9 by the last ten days. $0 went out by mistake.
| Day 1 | 14 |
|---|---|
| Day 2 | 14 |
| Day 3 | 15 |
| Day 4 | 12 |
| Day 5 | 18 |
| Day 6 | 14 |
| Day 7 | 15 |
| Day 8 | 17 |
| Day 9 | 15 |
| Day 10 | 18 |
| Day 11 | 11 |
| Day 12 | 9 |
| Day 13 | 10 |
| Day 14 | 9 |
| Day 15 | 11 |
| Day 16 | 10 |
| Day 17 | 9 |
| Day 18 | 8 |
| Day 19 | 10 |
| Day 20 | 11 |
| Day 21 | 8 |
| Day 22 | 14 |
| Day 23 | 8 |
| Day 24 | 10 |
| Day 25 | 8 |
| Day 26 | 8 |
| Day 27 | 13 |
| Day 28 | 7 |
| Day 29 | 10 |
| Day 30 | 7 |
| Your setting | Asks a day, first 10 days → last 10 | Sent by mistake in 30 days |
|---|---|---|
| Safe startNothing goes out alone | 15 → 9 | $0 |
| A small allowanceUp to $40 alone, $50 of mistakes a month | 13 → 6 | $42 |
| Trust onlyNo limit from the seller | 13 → 5 | $190 |
Simulation with the real gate and a keyword stand-in for the AI agent, so it shows how the parts work together, not what a given model does. Same emails in all three runs.
We tried to trick it
Support emails written to fool the agent: fake owners, double refunds, pushy PayPal cases. Same AI agent, with and without Leash, on cases it had never seen.
Read the full benchmark →- Without a gate
- $189 refunded by mistake on average, $553 in the worst run
- With Leash
- $0 in every run
Set up in minutes, from your browser
Look around first
A demo shop with real PayPal sandbox orders, customer emails and a PayPal case. Opens in a few seconds.
Use your own PayPal
Make a PayPal sandbox app, tick one box, paste two keys. Leash reads your last 90 days and starts in safe start.
Connect your PayPal