kiff.dev valid

KIFF

KIFF gives each AI agent a Card: which actions it may take, how much per action and in total over a window, and what happens to a call outside those limits. KIFF decides every proposed consequential action before it runs, against the business's own state and the agent's Card. A call outside the Card waits for the owner or is refused. The owner changes or revokes the Card without changing the agent, and every decision has a signed, tamper-evident receipt.

Their llms.txt

The beginning of the file, from our validated copy saved 2026-10-27T09:55:21.052Z. Cached copy · Source on kiff.dev

# KIFF

> KIFF gives each AI agent a Card: which actions it may take, how much per action and in total over a window, and what happens to a call outside those limits. KIFF decides every proposed consequential action before it runs, against the business's own state and the agent's Card. A call outside the Card waits for the owner or is refused. The owner changes or revokes the Card without changing the agent, and every decision has a signed, tamper-evident receipt.

Agents now refund, credit, book, cancel and change accounts on their own. Each action costs almost nothing, so teams ask for many more of them, and a person approving each one becomes the whole cost. Payment networks now give agents credentials capped per payment. A payment cap knows one payment. KIFF covers what it cannot see: actions that are not payments, totals over time across agents, the state of the order or account, who answers when the agent goes over, and a record the agent's vendor did not write. In one line: payment networks cap a payment; KIFF caps the agent.

## Key facts

- What a Card says: which actions the agent may take (refund an order, not cancel a subscription); the most per action; totals per window, counted as a number of actions or a sum of one parameter (for example €500 and 10 refunds a day); what happens outside it (hold for the owner, or refuse); an optional expiry. One agent holds a Card by default; a Card can also be shared by up to 20 agents drawing on one balance, and each decision still names the agent that asked. An agent holding several Cards is bound by the tightest.
- How a call is checked, three ways: (1) the MCP gateway at `mcp.kiff.dev`, the agent's key asks KIFF before forwarding; default `sealed` connections give KIFF the downstream credential, while configured `verify` and `relay` connections require an execution permit at the tool or customer-run relay; (2) kiff-guard, one hook in the agent's tool loop in your own code (Python and TypeScript, eleven verified framework adapters); (3) one call to the decision API, `POST /v1/proposals/decide`, from any code. Outcomes: `allowed`, `approval_required`, `blocked`, `invalid`.
- What "allowed" means: KIFF authorized the call. Through the gateway KIFF then forwards it to the tool; elsewhere the company's own system runs it. KIFF never moves money itself.
- Outside the Card, the owner answers: a held call reaches the owner on Needs you, by email, and as a link in the agent's chat (Claude Code). The owner approves it once, revises the Card, or rejects it. Approve once lifts only the per-action limit: the call still counts toward every Card total, and if no room is left it waits as `approved_no_room` until there is room: the window resets or earlier usage ages out, or an admin revises the Card or adds room (this window only by default). The approval and the Card must still be valid when the call is retried; someone can also reject it. A person answers from a signed-in session; an admin can also grant a s
…

Related sites

Explore similar publishers →

Similar publisher descriptions and documentation. Similarity does not imply affiliation or equivalent capabilities.

Machine-readable: GET /v1/resolve?q=kiff.dev · GET /v1/domain/kiff.dev · this page as Accept: application/json or text/markdown · MCP lookup_domain

Automatically discovered from public files. Inclusion does not imply endorsement or publisher participation.

Claim my listing on Agent Web Map for kiff.dev:
1. POST https://agentwebmap.com/v1/sites/kiff.dev/claims and keep claim_id and claim_secret private.
2. Publish the verification line "AgentWebMap verification: <token>" (token from step 1) in https://kiff.dev/llms.txt, or use the DNS, meta-tag or well-known method the response describes. This only verifies the listing; your website and domain remain yours.
3. POST https://agentwebmap.com/v1/sites/kiff.dev/verify with {"claim_id": "...", "claim_secret": "..."}.
4. Save the api_key from the answer; it manages the listing (PATCH https://agentwebmap.com/v1/sites/kiff.dev).
MCP equivalent: tools begin_ownership_claim, then verify_domain, at https://agentwebmap.com/mcp. Docs: https://agentwebmap.com/docs#verify

Corrections or removal requests: contact the directory.