Agent Commerce Guard

Approval gates and receipts for AI agents that can spend money, sell services, post socially, launch tokens, deploy publicly, or touch wallets.

Agent Commerce Guard is a local-first CLI and skill pack for builders adding x402, ACP, wallets, seller runtimes, paid APIs, or social integrations to autonomous agents.

Try the free evaluator | Preview the paid package | Add the GitHub Action | Buy the private package for 1 USDC | Get support

The live evaluator includes one-click presets for wallet spend, production deploys, token launches, and marketplace jobs, so each decision path can be tested without writing a manifest first.

The checkout links to the full sample report, Base MCP purchase recipe, and support before payment, then verifies the Base USDC transaction server-side. Both the checkout and success handoff retry pending receipts automatically before the private package unlocks. A submitted transaction hash is preserved in the current URL so a refresh resumes verification instead of losing the unlock path.

The public package proof shows the exact CLI report format and file inventory before payment. Canonical tests compare the samples to the current policy engine and verify each advertised file against the paid tarball:

• https://agent-commerce-guard.vercel.app/sample-report
• https://agent-commerce-guard.vercel.app/sample-report.json
• https://fxjim.github.io/agent-commerce-guard/sample/

Install The Free Evaluator Skill

Install a non-executing preflight workflow for public, non-sensitive action manifests:

npx skills add https://github.com/fxjim/agent-commerce-guard --skill try-agent-commerce-guard

The skill enforces the hosted-data boundary, evaluates at most five actions and 20 KB through the free endpoint, and hands private workflows to the paid local package without initiating a payment.

GitHub Copilot Plugin

Install the policy-only review plugin directly from GitHub:

copilot plugin install fxjim/agent-commerce-guard:plugins/agent-commerce-guard

The plugin's skill uses /api/policy-review, returns only decisions and required evidence, and includes no checkout or payment links. Its immutable 1.0.0 source is tagged copilot-plugin-v1.0.0. The official Awesome Copilot review is ready for review after passing its automated quality gates.

Remote MCP Server

Connect an MCP client to the public, stateless Streamable HTTP endpoint:

https://agent-commerce-guard.vercel.app/api/mcp

Codex:

codex mcp add agent-commerce-guard --url https://agent-commerce-guard.vercel.app/api/mcp

Claude Code:

claude mcp add --transport http agent-commerce-guard https://agent-commerce-guard.vercel.app/api/mcp

VS Code mcp.json:

{
  "servers": {
    "agent-commerce-guard": {
      "type": "http",
      "url": "https://agent-commerce-guard.vercel.app/api/mcp"
    }
  }
}

Setup and verification: Vercel guide or GitHub Pages mirror.

The server exposes one read-only, non-destructive tool, review_agent_commerce_actions. It accepts up to five non-sensitive public actions and 20 KB, returns decisions and required evidence, and does not execute, pay, sign, deploy, post, or include purchase instructions in tool output. MCP 1.2.0 also exposes one public JSON resource, https://agent-commerce-guard.vercel.app/offer.json, so clients can discover the exact 1 USDC Base offer without mixing purchase data into policy-tool results. Server initialization points clients to that resource, requires explicit approval before payment, and requires Base transaction verification after payment. The review-before-purchase prompt joins policy review, offer inspection, explicit approval, and receipt verification without initiating a payment. Registry metadata is available in server.json. The official Registry lists io.github.fxjim/agent-commerce-guard as an active remote server.

Install The Buyer Skill

Install the free public buyer workflow for Codex, Claude Code, Cursor, and other Agent Skills-compatible assistants:

npx skills add https://github.com/fxjim/agent-commerce-guard --skill buy-agent-commerce-guard

The same skill is also available from the canonical product domain:

npx skills add https://agent-commerce-guard.vercel.app --skill buy-agent-commerce-guard

The skill preflights the public offer and requires explicit approval before any Base Account, Base MCP, x402, browser-wallet, or manual payment. Its source is available at skills/buy-agent-commerce-guard/SKILL.md. Its indexed directory page is available on skills.sh. The paid product package remains available only after a verified 1 USDC payment.

GitHub Action

Run the free hosted policy preflight in an ubuntu-latest workflow:

- uses: fxjim/agent-commerce-guard@v1
  with:
    manifest: agent-commerce-actions.json
    fail-on: deny

The manifest may be a single action, an action array, or an object with an actions array. The Action sends at most five actions and 20 KB to the public hosted evaluator, prints sanitized decisions, and can fail on denied actions or actions requiring review. It rejects obvious secret-bearing JSON keys before the request.

The Action exposes checkout-url for the private local package, x402-evaluate-url for the paid workflow API, sample-report-url for the full CLI example, package-metadata-url for the machine-readable inventory, and base-mcp-recipe-url for an authorized Base MCP assistant. The job summary links to the proof and purchase paths after every completed evaluation.

Do not submit secrets, private source, credentials, or sensitive customer data. Use the paid local package when an action manifest cannot leave the runner. See examples/github-actions/ for a complete workflow and harmless example manifest.

Launch Pass

The launch pass is available for 1 USDC on Base.