AgentGate

Inspiration

Visa just shipped the Trusted Agent Protocol: AI shopping agents can now sign their requests so a merchant knows who is at the door. That solves identity. It doesn’t solve intent. A perfectly signed agent can still be a scalper, a card tester, or a legitimate assistant that just read a poisoned product page and got hijacked.

Merchants today classify bots by user-agent string and IP address, both trivially spoofed. So they either block every agent and lose real sales, or let them all in and eat the fraud. Visa built the ID check. We built the bouncer.

What it does

AgentGate is a merchant-side firewall for AI shopping agents. It sits in front of a checkout API and, on every request:

Verifies identity using Visa TAP–shaped RFC 9421 HTTP Message Signatures with Ed25519 keys. Replays, tampering, expired windows, wrong tags, and unknown keys are rejected. Unsigned checkouts never reach scoring. Scores behavior with 12 rules covering velocity, card testing, cart patterns, drift from the consumer’s own purchase history, and a cluster rule that links many agent keys sharing one card or address. Decides in real time: allow, challenge, or block, with plain-English reasons a merchant can read.

The challenge path is the core idea. An unusual-but-maybe-legitimate purchase is routed to the consumer’s own Guardian agent on Fetch.ai, which asks the human to approve or deny. The shopping agent never holds the Guardian token, so a hijacked agent cannot approve its own purchase.

Around the gateway: a merchant dashboard with a live decision feed, security test matrix, precision/recall and threshold sliders; an Apify Actor that scans storefront pages for hidden prompt injections; a Claude investigator with one read-only tool over the decision log (“why was the last block flagged?”); and a Shopper agent on Agentverse so the whole flow runs inside an ASI:One conversation.

How we built it

Gateway: Python + FastAPI. Ed25519 verification with cryptography, a rebuilt RFC 9421 signature base, nonce replay protection (checked only after the signature so forgeries can’t burn real nonces), a rule-based scorer, a policy table, and a SQLite decision log. A mock key directory at /.well-known/http-message-signatures-directory stands in for Visa’s and swaps to a real one by configuration. Agents: Two Fetch.ai uAgents on Agentverse speaking the Agent Chat Protocol — the Shopper (signs and sends requests) and the Guardian (receives challenges via a bearer-token webhook and asks the human). Simulator: Scripted traffic with known ground truth — good agents, spoofed agents, a 50-bot scalper swarm, a hijacked verified agent, and a slow-and-low scalper — so every decision is measurable. Dashboard: Live feed and metrics served by the gateway; five scenario buttons reproduce the full evaluation. Apify: A public Actor that scrapes product pages and flags injection patterns (hidden off-screen text, instruction-like phrasing), plus an adapter that feeds products to the shopper. Investigator: Claude Sonnet with a single read-only tool over the event log. Deployment: Gateway and dashboard on Vultr behind HTTPS, with automatic recovery after reboot. Design: Dashboard flows and decision states mocked in Figma before building.

Challenges we ran into

Getting RFC 9421 exactly right. Rebuilding the signature base byte-for-byte is unforgiving; one ordering mistake and every valid request fails. Replay protection without a DoS vector. If nonces are consumed before the signature is checked, an attacker can burn a legitimate agent’s nonces with forgeries. We check the signature first. Separating identity from intent. A verified signature feels like “trusted.” Making verification necessary but never sufficient took several iterations of the scorer. The hijacked-agent problem. If the shopping agent can answer its own challenge, the challenge path is theater. Splitting the Guardian into a separate agent with its own token was the fix. Drift rules need a baseline. new_address, new_category and big_basket compare against past purchases, so a brand-new shopper’s first order has nothing to drift from. Slow-and-low scalping defeats every velocity rule by design. Only the cluster rule catches it, and not perfectly.

Accomplishments that we're proud of

6 / 6 signature attacks blocked (unsigned, replay, tamper, expired, wrong tag, unknown key). 200 / 200 scalper grabs caught from a 50-bot signed swarm. Hijacked verified agent: challenged → human denied → blocked; self-approval refused with a 401. 99.5% precision / 99.1% recall across all five scenarios — one false alarm in 17 good orders. Gateway latency p50 0.18 ms, p95 0.41 ms; 923 req/s from a single client under 2,000-checkout load. A full end-to-end demo that runs inside an ASI:One chat: “buy me headphones” → signed checkout → Guardian challenge → human decision → Claude explains why. A public Apify Actor that correctly rated a poisoned product page high and a safe one low, both read as the same SKU.

What we learned

Identity and behavior are different questions; a trust layer for agentic commerce needs both. The human-in-the-loop has to be a separate principal from the agent being judged, or it adds nothing. Rule-based scoring with clear reasons was more useful to a merchant than a model would have been in 36 hours — every block comes with a sentence you can act on. Prompt injection is a supply-chain problem for shopping agents: the storefront itself is untrusted input. Honest disclosure matters. Our traffic is synthetic, the key directory is a mock, the hijack is staged by a labelled switch, and latency is from one laptop. Saying so made the real results more credible.

What's next for AgentGate

A real Visa directory behind the verifier, persistent challenge and nonce state, a learned layer on top of the 12 rules, broader prompt-injection coverage in the Actor, and a merchant onboarding flow that drops AgentGate in as a single reverse proxy in front of any checkout.