ENES
Get started
DOCS2026.10

Search TilcAI Docs

20 guides found · showing the first 8

Get startedWhat is TilcAI

Infrastructure for commerce between AI agents, people and businesses. Connect an intent to rules, authorization and verifiable payments…

Get startedQuickstart

Connect your backend and discover its routes before preparing a payment. This example only reads health and routes. It does not create …

Get startedFrom intent to receipt

A purchase and a payment have different lifecycles. TilcAI aims to connect them while distinguishing authorization, settlement and fulf…

IntegrateSDK · TypeScript

A Node.js client for payments, accounts, vault, monitoring and x402. ESM and CommonJS, typed, with no required runtime dependencies. ti…

IntegrateMCP for agents

Expose TilcAI payments to an MCP client. The stdio server talks to the API; the wallet signs outside TilcAI MCP. tilcai-mcp · v0.2.0 · …

IntegrateHTTP API

Reference for routes implemented in tilcai-infrastructure. Availability depends on your instance environment and enabled modules. Authe…

ConceptsArchitecture

Three planes separate conversation, authority and financial execution. The model helps with intent; rules and the signer control money.…

ConceptsBusinesses and offers

The business retains authority over pricing, availability and fulfillment. The buyer agent does not invent an offer. A verifiable offer…

↑ ↓ to navigate · Enter to open · Esc to close
GitHub
Resources

Security and limits

Reviewed 20 Oct 2026·2 min

Spending authority needs an explicit boundary. Conversation is not a signature, and technical integration is not an audit.

Implemented controls

  • Tenant authentication and scopes; environment-specific resources and credentials.
  • Attempt idempotency, unique burn hash, CCTP nonce and persisted reconciliation.
  • Verification of the Circle message and exact authorization; vault limits and pause.
  • Mainnet guards and separation between integration API and signer.
  • Fail-closed start: if the TILCAI_API_KEYS keys cannot be synced, the process does not start, instead of going on accepting a key the operator retired. Logs never show key values.
  • Readiness separate from liveness: /ready does not announce payment capability without an authenticated relayer configured for the right network.

What remains open

Nothing described here has been audited. Whether Cloud Run keeps a single writer during deployments and restores still has to be validated in staging: during a rollout two instances coexist, one per revision (see Operations and deployment). Independent audit, a complete mainnet contract registry, tested account recovery, limited agent delegation, concurrent-load validation, and operational backup and recovery remain open. Reputation is not an established production control.

If a request times out

Keep paymentId and hashes; query and reconcile. Do not generate a second payment to resolve an uncertain one. Relayer notifications and screenshots do not replace on-chain evidence or authenticated bank confirmation.

Out of scope for now

Autonomous trading, wrapped-asset bridges, purchases without a commercial adapter and fiat conversion without a verified provider. CCTP moves native USDC and does have documented routes, including Avalanche Fuji and Monad Testnet to Stellar Testnet and Avalanche C-Chain to Stellar Public Network.

Availability depends on your instance. Check /health and /v1/routes before integrating.

TilcAI Docs · 20 Oct 2026Sources and versions ↗