CardBuddy: max rewards on every AI agent purchase

When your AI agent shops, CardBuddy pays with the card in your PayPal wallet that earns the most, holds anything outside your rules for approval, and pays through PayPal's Orders API.

Comment

Inspiration

We already built a card recommender that shows people which credit cards pay them the most on what they actually spend. Then AI agents started shopping. PayPal ships an Agent Toolkit and an MCP server so agents can create and capture orders, and that raised two problems nobody was solving:

  • Agents pay with whatever card they're handed. Someone who carefully puts groceries on a 6% card and dining on a 4x card loses all of it the moment an agent takes over checkout.
  • Nothing checks what an agent buys. A duplicate order, the wrong TV, or a flight on the wrong date goes straight through.

CardBuddy is the layer between the agent and your PayPal wallet that fixes both. It's for anyone who carries more than one card and lets an AI agent shop for them, and for the developers building those agents, who need a safe way to let them pay.

What it does

  • Your wallet, in PayPal. You save your cards once through PayPal's own card fields. Card numbers go straight to PayPal's vault; CardBuddy only stores vault tokens and which card each one is.
  • The right card, every time. Before any payment, CardBuddy runs every card in your wallet through our rewards engine (rates, caps, rotating categories, point values for 50+ US cards) and pays with the one that earns the most. If that card is declined, the next-best card pays.
  • Rules the agent can't skip. You set a per-purchase limit, a monthly budget, and categories that always need your OK. CardBuddy also holds duplicate orders, orders split to stay under the limit, and orders repeated at a store with a purchase already pending. Held purchases wait on an Approvals page, with an optional email to your phone.
  • A second opinion on the agent. When an agent shops somewhere CardBuddy doesn't know, the agent says the category. CardBuddy doesn't just trust it: a machine-learning model reads the store's name, so a hotel the agent labels "other" still waits for your approval.
  • Pays through PayPal. Every purchase is a real PayPal order on the vaulted card, and every receipt shows the card used, the amount earned compared to your default card, and the PayPal order ID.

In a reproducible simulated year of agent shopping (329 purchases, $21,227.56), CardBuddy earned $875.54 vs $424.55 on a 2%-everywhere default card, +$450.99, and held all three of the agent's planted mistakes, which would have spent $1,957.12 unchecked.

How we built it

  • PayPal: JS SDK Card Fields to save cards without the number touching our server; Vault API v3 (setup tokens, then payment tokens); Orders API v2 with vault_id and stored-credential flags for merchant-initiated payments, then capture. All in the PayPal sandbox.
  • AI: an MCP server with eight tools (get_wallet, recommend_card, search_store, checkout, pay, purchase_status, list_receipts, spending_rules), so Claude or any MCP agent can shop. The agent can read the rules but has no tool to change them or approve its own purchases. It also runs hosted, so cloud agents (ChatGPT and claude.ai connectors) can connect over Streamable HTTP with an API key.
  • Machine learning: a store-category model (character n-gram TF-IDF with logistic regression) trained on 964,618 real government card purchases labelled by merchant category. CardBuddy uses it to check the category an agent gives for unknown stores.
  • Server and app: Node.js with no runtime dependencies, a web app (Wallet, Approvals, Receipts, Simulation), email alerts, a demo store with four fictional shops standing in for PayPal merchants, and tests for card choice, decline fallback, alerts, the hosted server, and an end-to-end agent run.

What we built when: the rewards engine and card data come from a card recommender we built, which we started on Oct 23, 2026, during the submission period but as a separate product. CardBuddy uses them as a library to score cards. Everything else (the PayPal wallet and payments, the rules and approvals, the MCP server, the web app, the simulation and the tests) was built for this hackathon, starting Nov 3.

Challenges we ran into

  • Saving cards in the sandbox. PayPal's automatically created sandbox account couldn't save cards (HTTP 403). We had to create a fresh business account and enable vaulting and advanced card payments on the app.
  • Paying when the person isn't there. Charging a saved card for an agent needs the right stored-credential flags, so the payment is treated as merchant-initiated.
  • Never charging twice. If a payment is interrupted mid-way, CardBuddy marks it "unknown" instead of retrying, and only one payment runs at a time.
  • Agents that try to get around limits. An agent can split a $1,249 order into smaller ones, so the rules look at recent purchases at the same store, not just the one in front of them.

Accomplishments that we're proud of

  • An agent that shops end to end with real sandbox PayPal orders, from "order my weekly groceries" to a paid order on the best card.
  • Rules that live on the server, where an agent can't talk its way past them.
  • Card numbers never touch CardBuddy.
  • A simulation anyone can rerun with one command and get the same numbers.

What we learned

  • Agent payments need a policy layer outside the agent. Instructions in a prompt aren't enough; the rules have to be enforced where the money moves.
  • PayPal's Vault plus the Orders API is a strong base for agent commerce: the card stays with PayPal, and every purchase is a normal PayPal order the person can see.
  • Small rewards decisions add up. A few dollars per order became about $450 over a year.

What’s next for CardBuddy

  • Why it matters for PayPal. CardBuddy makes agent checkouts something people can trust: every card lives in PayPal Vault and every purchase is a PayPal order. As agents do more of the shopping, that keeps it running through PayPal.
  • Personal shopping agents at PayPal merchants. PayPal already lets people check out with personal AI agents at PayPal merchants. CardBuddy fits between that agent and the person's wallet, so they approve only what's unusual instead of every purchase.
  • Sign-in for each person, so the hosted connector serves many wallets instead of one demo wallet.
  • Paying through PayPal and Venmo balances when their cards earn more.

Built With

Share this project:

Updates

Submission history