Sato Kit

@satohub/kit

0.1.1 preview.

Sato Kit wraps the tools agents already use (viem, signers, x402) with a prepare -> execute contract: an action prepares an unsigned intent, a policy pre-flight explains any refusal, the transaction is simulated, and execute({ intent_id }) hands it to your signer and appends a hash-chained sato.receipt/v1 line.

What it is not: not a wallet, not a custodian, not an agent framework, and not a guarantee. It never holds funds and ships no keys.

• Fork by default. A policy's network defaults to fork; mainnet needs an explicit opt-in.
• Pre-flight vs enforcement. The kit's policy check runs before an intent is returned and says which rule refused and why. It does not enforce anything once a key is in play. Enforcement lives in the signer (e.g. a CDP policy compiled from the same file).
• `scan.payto_changed`. The scan block of policy.json records payto_changed (caution | refuse | off), but it is enforced only by hosts that implement it. The offline guard in satohub-core (scanRecipient) does not enforce it today: a changed x402 payTo needs the payee's earlier value, which the offline check is not given.
• Swaps are venue-neutral. Any venue is accepted. Sato Swap is the labelled default and its fee is disclosed on every response, with a no-Sato-fee quote alongside; venue: "direct" skips Sato entirely.

Contracts (sato.action/v1, sato.policy/v1, sato.receipt/v1) live in src/spec (see VENDORED.md).

Install

npm install @satohub/kit viem

npx -y @satohub/kit@0.1 --help

Node 20 or later. viem is a peer; every framework SDK below is an optional peer, installed only if you use its subpath.

Honest limits

• Pre-flight, not enforcement. evaluatePreflight runs before an intent is returned and names each refused rule with its limit and the observed value. Once a key is in play the kit enforces nothing: enforcement is the signer's (a CDP, Privy or Turnkey policy compiled from the same policy.json, OWS's policy engine, or a Safe's owners). viemLocalSigner enforces only its mainnet refusal.
• x402 execution scope. x402.prepare reads what an x402 resource asks to be paid and returns a priced, policy-checked intent. execute does not send x402 payments: it sends EVM transactions, EIP-712 typed data (Safe proposals) and Solana transactions only. Pay through your x402 client.
• AgentKit's own analytics call. AgentKit's @CreateAction decorator posts an invocation event to cca-lite.coinbase.com on every invoke. Actions consumed through fromAgentKitProvider still make that call; the kit neither blocks nor adds to it.
• Unknown prices refuse. When a USD value cannot be read, a max_usd_* rule refuses with unknown_price rather than guessing.
• Simulation is not a promise. A passing simulation says what the chain answered at that block.

Action reference

Generated from the registered descriptors by node scripts/gen-actions-doc.mjs (after npm run build); test/readme-actions.test.ts fails when this table drifts from the registry. "custody" is the descriptor's own answer to three sato.custody/v1 questions. toolset says whether the tool is in the default MCP profile or only under --toolsets all.

Registered actions

Meta tools

Default MCP profile, in order: chain_read, swap_quote, swap_prepare, x402_prepare, execute, status, actions_search, actions_describe.

Actions consumed from an AgentKit provider (fromAgentKitProvider) are not in this table: they are built at runtime from the provider you pass, and appear under toolset all.

Entry points

Signers

• viemLocalSigner — a key in this process. Fork/testnet by default; refuses mainnet chain ids unless allowMainnet: true (not recommended). generate: true makes a throwaway in-memory key.
• owsSigner — a structural adapter over an Open Wallet Standard account; OWS's policy engine enforces. See src/signers/OWS.md.
• cdpSigner — a structural adapter over a Coinbase CDP server account; CDP enforces its policies. Pass a compiled policy as nativePolicy to carry it with the signer (the adapter does not register it).
• solanaLocalSigner — local Solana signing for devnet and tests only; refuses any non-devnet payload and a mainnet-beta RPC, with no mainnet switch.
• humanApprove(signer, approve) — wraps any signer so a person approves each summary before it signs.

Policy compilers

compileCdpPolicy, compilePrivyPolicy and compileTurnkeyPolicy turn one sato.policy/v1 into the provider's native policy document. Each result lists what did not compile (not_compiled) with the reason, so a rule the provider cannot express is never silently dropped.

CLI

sato-kit read <action> --input '<json>'      run a read-only action

sato-kit prepare --input ' ' build an intent; nothing is signed sato-kit execute --intent hand one prepared intent to the signer sato-kit mcp [--toolsets default|all] local MCP server over stdio sato-kit doctor check config, Sato Status and template drift

Config comes from the working directory: policy.json (absent means the default policy, network fork), .sato/ (intents, intent secret, receipts), SATO_RPC_URL_ per chain, and SATO_SIGNER=viem-local-fork (fork network only) for a local signer.

MCP server

npx -y @satohub/kit@0.1 mcp runs a stdio MCP server (registry name ai.satohub/kit). The default profile is the eight tools listed above; --toolsets all adds every other registered action. Tools that sign carry anthropic/requiresUserInteraction in _meta.

Sato Status

status and sato-kit doctor read the nightly per-action results (sato.action-status/v1) published by the templates repo. When that file cannot be read, the answer says so; nothing is filled in.

Recommended .gitignore

The file intent store and the intent HMAC secret live under .sato/ by default (intents/, intent.key, mode 0600). Keep them out of version control:

.sato/

License: MIT. The bundled Onchain Action Descriptor code (dist/spec) is Apache-2.0, copyright 2026 Prime Signal LLC: see LICENSE-ODA and NOTICE.

sato-kit doctor: template drift

In a repo made by create-sato-agent (one with sato.create.json), doctor also sends sato.create.json and sato.lock.json to https://satohub.ai/api/create/drift (3 s timeout) and prints the changes it returns: a newer template version that passed its checks, a custody change in a stored Sato Check profile for a pinned package, or a pinned package version that fails the templat