acp-sandbox

An AI agent shops and pays with PayPal — and only you can approve the money.

Comment

Inspiration

AI agents are starting to shop and pay on their own. That's exciting and a little terrifying: who actually controls the money? We wanted to build the smallest possible proof that an agent can do real commerce - browse, cart, checkout - while a human stays the only one who can approve an actual payment. PayPal's sandbox is the perfect place to prove that safely, with real approval flows and zero real money at risk.

What it does

acp-sandbox is a hosted mock merchant that speaks the Agentic Commerce Protocol (ACP) - the open checkout standard from OpenAI and Stripe. It's also a hosted MCP server, so any MCP-capable agent (Claude, Cursor, ...) can connect to it directly with zero setup on the agent side.

The agent gets eight tools, including list_products, create_checkout / update_checkout, request_paypal_payment, wait_for_payment_approval, complete_checkout and cancel_checkout. It can browse the catalog, build and edit a cart, and ask a human to pay - but it can only ever hand over a PayPal approval link. The payment is captured only after the human approves it on PayPal, and only for the exact cart total. The agent cannot charge anything on its own, change the amount after approval, or reuse an approval for a different cart.

Try it (judges)

  1. Add https://acp-sandbox.flo-voice1.com/mcp as a custom connector in Claude (no sign-in).
  2. Ask: "Buy me a demo mug and two notebooks from the acp-sandbox store and pay with PayPal."
  3. Approve on PayPal with the sandbox buyer login in the repo README ("For judges"). The agent then places the order and returns the receipt and a dashboard link.

What we built during the hackathon

acp-sandbox started on Aug 26 as a mock ACP merchant: it accepted any payment data as "paid" and had no agent interface. During the submission period we added:

  • Oct 8 – Real PayPal payments. Each checkout now creates a PayPal Orders v2 order in the sandbox. The buyer approves it on PayPal, and the merchant captures it before confirming the order.
  • Oct 8 – Hosted MCP server at /mcp, so any MCP client (Claude, Cursor) can shop with zero code.
  • Oct 8 – Dashboard extended with the PayPal status and capture ID, order numbers and receipt links (the request log itself existed before).
  • Oct 23 – Tool safety annotations (read-only vs. payment actions) and a privacy page, for submission to Claude's connector directory.

How we built it

A small Node/TypeScript service exposing two surfaces over the same checkout session model: a REST implementation of the ACP checkout API (create, retrieve, update, complete, cancel), and an MCP server wrapping the same operations as agent tools, plus the PayPal-specific steps (request_paypal_payment, wait_for_payment_approval). PayPal integration uses real Orders v2 sandbox calls - create order with an idempotency key, then capture only after independently confirming on PayPal's side that the buyer approved and the capture is COMPLETED for the exact amount and currency of that session. A dashboard shows every checkout session and every request an agent sent, with the sandbox's response, for debugging and for judges to verify a run actually happened.

Challenges we ran into

Keeping the human genuinely in control, not just in appearance, took the most care: the agent only ever gets an approval link, never a way to trigger a capture itself, and the server re-verifies the PayPal order against the session's exact total before marking anything paid - a stale or foreign order id, or a mismatched amount, is rejected. We also had to make the MCP tool flow feel natural for an agent to drive without any custom client code - just a connector URL and a plain-English ask ("buy X and pay with PayPal") - which took a few iterations on tool descriptions and error messages until a real agent (Claude) could complete the whole flow unassisted except for the human approval step.

Accomplishments that we're proud of

This isn't a mocked demo. A real agent (Claude, connected over MCP with zero custom code) listed products, built a real cart, requested a real PayPal sandbox payment, waited for a human to approve it, and placed a real order - order number, real receipt, every step logged. We ran this live: a demo mug and two notebooks, $30.97, approved on a PayPal sandbox buyer account, captured, order placed. The whole loop, start to finish, with no step faked or skipped.

What we learned

The hard part of agentic commerce isn't getting an agent to want to buy something - it's building a protocol boundary an agent literally cannot cross on its own. Every design decision came back to: what's the one thing only a human can do here, and how do we make the agent's tools physically incapable of doing it instead.

What's next

Broaden beyond the mock catalog to let any merchant plug their real product data into the same ACP + MCP surface, and add more payment methods behind the same approve-it-yourself boundary.

Launching on TinyLaunch this week. If you like it, an upvote helps: https://tinylaunch.com/launch/24070-acp-sandbox

Built With

Share this project:

Updates

posted an update —

Now live on TinyLaunch

acp-sandbox is live on TinyLaunch this week. The page has a short walkthrough of the full flow: Claude calls the hosted MCP server, creates a checkout, requests a PayPal sandbox payment, a human approves it, and the agent places the order.

Try it (no signup): add https://acp-sandbox.flo-voice1.com/mcp as a custom connector in Claude. If you'd like to support it, an upvote helps: https://tinylaunch.com/launch/24070-acp-sandbox

Submission history