Daraja Agent KitSafety
How the kit keeps an agent from moving real money by accident, paying twice, or leaking secrets.
The MCP server moves real money when it is configured for production. These safeguards are on by default.
| Risk | Safeguard |
|---|---|
| Moving real money by accident | Sandbox by default. In production, money tools refuse to run until DARAJA_ALLOW_LIVE_MONEY_MOVEMENT=true, and they're flagged as destructive so clients ask first |
| An agent paying out too much, or to the wrong person | Optional: DARAJA_APPROVAL_THRESHOLD asks you to approve larger payouts in the chat, DARAJA_ALLOWED_RECIPIENTS limits who can be paid, and DARAJA_READ_ONLY=true removes money tools entirely |
| Paying twice on a retry | Each money request is stored under an idempotency key. Repeating the key returns the stored outcome; only a definite failure can be re-sent |
| Reporting "accepted" as "paid" | Only a callback or a status query can produce SUCCESS |
| Malformed requests | Bodies are checked against Daraja's rules before sending, using the same validator as the skills |
| Leaked secrets | Tokens and secrets never appear in tool output, keys never go in agent config, and callback URLs carry a secret path token |
Accepted is not paid
A ResponseCode: 0 means Daraja accepted the request, nothing more. Mark an order paid only after a callback or status query reports ResultCode: 0.
Every money tool answers with one of three results. SUCCESS and FAILED are final. UNKNOWN means the outcome is not known yet: check it with a status query before doing anything else, and never resend a payout that might already have gone through.
Hardening checklist
- Keep
DARAJA_ENV=sandboxuntil you have tested end to end. - Leave
DARAJA_ALLOW_LIVE_MONEY_MOVEMENTunset unless an agent genuinely needs to move live money. - Never paste keys, passkeys, initiator passwords or SecurityCredentials into a chat. Use the setup wizard or your client's secret store.
- Keep separate secrets for sandbox and production.
Reporting a security problem
Please don't open a public issue. Report it privately through GitHub security advisories with what an attacker could do, steps to reproduce, and the affected version. Never include real credentials in a report; if you've exposed one, rotate it in the Daraja portal first.