Exhibit

Click once for a real PayPal sandbox chargeback: GPT-5.6 argues it from the records, a checker strikes what they don't show, a simulated reviewer cross-examines it, then it's filed or refunded.

Comment

Try it: The dispute desk · Open a real sandbox chargeback · Proof: measured on GPT-5.6 · AG Studio dashboard · Code on GitHub

For judges, in 30 seconds

  • Who it's for: small online sellers who take PayPal and lose chargebacks they could win, because the proof is scattered and writing it up takes an hour.
  • What it does: one click opens a real PayPal sandbox chargeback. Exhibit gathers the records from PayPal's APIs, an AI argues the case with every sentence citing a record, a checker strikes anything a record doesn't show, a simulated PayPal reviewer cross-examines the filing, and it's filed through the Disputes API with a Bates-stamped PDF, or refunded when the seller would lose.
  • Measured: the right call on 56 of 56 labelled cases (a stronger rules engine: 50); on held-out cases decided by what a buyer or seller wrote, 12 of 18 against 2 for the rules; 8 of 8 runs on four prompt-injection emails resisted; 1,015 of 1,051 true sentences with one fact changed were struck before filing.

What only Exhibit does

  • No mock mode. Every case on the desk is a real sandbox dispute against a real card payment, opened, argued, filed and resolved through PayPal's own APIs.
  • A cross-examination before PayPal sees it. A second AI, playing PayPal's reviewer, reads only the filed PDF and objects sentence by sentence; Exhibit answers from the records or concedes on the record, and the checker strikes any answer it can't back. You can take the reviewer's chair yourself.
  • Disputes over purchases made by a buyer's AI agent, decided in code. The cardholder's signed intent, the agent's signed cart and the PayPal order are checked against published keys; an AI buyer agent makes those purchases, and a listing with an injected instruction tests it.
  • PayPal is the source of truth. Where a case stands is read from PayPal's evidence, adjudications and fund movements, and a webhook argues a new case before the seller opens it.

Inspiration

When a buyer disputes a card payment, PayPal gives the seller a deadline to answer (ten days on these cases, from the case's own seller_response_due_date), and a card chargeback costs a $20 fee on top of the sale (PayPal's merchant fees page). LexisNexis puts the cost to a US ecommerce merchant at $4.61 for every $1 of fraud, and Mastercard expects 261 million chargebacks worldwide in 2025, rising to 324 million by 2028. The proof a seller needs usually exists: a tracking number, a signed delivery scan, an email thread. But it's scattered across PayPal, the store, the carrier and the inbox. So sellers ignore cases they'd win, or fight cases they can't win and lose the fee too. Chargeback services exist, but they take a share of every case they win, so their incentive is to fight. We wanted a desk that does the paperwork, says honestly which cases to refund, and never states a fact in front of a PayPal reviewer that a record doesn't back.

What it does

  • Opens a real sandbox chargeback in one click. Pick one of seven stories and Exhibit takes a real card payment to a demo shop, adds a tracker, and has the card issuer file a chargeback through PayPal's sandbox. Two of the stories are purchases a buyer's AI shopping agent made.
  • Argues it before you arrive. A PayPal webhook (CUSTOMER.DISPUTE.CREATED, signature verified with PayPal) wakes Exhibit; the case page says when PayPal delivered it and how many seconds later it was argued.
  • Gathers the records as lettered exhibits: the order, the payment with the issuer's address and security-code checks, the tracker and any refund from PayPal; carrier scans, inbox, listing, checkout policy and customer history from the store; and for agent purchases, the signed mandates and Exhibit's checks on them.
  • Argues it. GPT-5.6 weighs points for each side, recommends fighting or refunding, and writes the response one sentence at a time. Each sentence cites the exhibits that prove it and quotes the words it relies on.
  • Checks every sentence. Every amount, date, time, id, ZIP, carrier, signer and card number must appear in the exhibits the sentence cites, the quoted words must be there word for word, figures in one clause must come from one record, and a denial its record contradicts is struck. A sentence with nothing to check is marked unverified, not passed. A struck sentence gets one chance to be re-cited; it's used only if the checker then keeps it.
  • Cross-examines the filing. The simulated reviewer reads only what PayPal holds (the Bates PDF) and raises up to four objections; Exhibit answers or concedes, and every answer goes through the same checker. The hearing is shown as a transcript with OBJECTION, SUSTAINED and OVERRULED stamps.
  • Files the seller's choice in one click: provide-evidence with the response, tracking or refund details and a Bates-stamped PDF, or accept-claim for a full refund. In the sandbox nobody at PayPal reads the evidence and the simulator rules for whichever side it's asked to, so Exhibit asks it to rule the way the simulated reviewer decided, and each case says whether PayPal ruled at Exhibit's request or closed the case by itself.
  • Handles agent-made purchases. The PayPal order carries ap2: plus the SHA-256 of the signed cart in custom_id. Exhibit verifies both Ed25519 signatures against keys published at /.well-known/exhibit-keys.json, compares cart, intent and PayPal order in code, and says who is responsible: the cardholder, the agent platform or the merchant.
  • Lets a seller's own agent run the desk through an MCP server: list, read, argue, file, cross-examine, plus preflight_cart and verify_mandate for buyer agents.
  • Shows it all on a desk in AG Grid, an AG Studio dashboard with custom widgets and an analyst agent, and a proof page with the measured eval.

Every sentence pinned to its proof: threads tie each sentence of the response to the PayPal and store records it cites.

How we built it

How Exhibit is built: PayPal holds every case, GPT-5.6 argues, cross-examines and shops, and deterministic code checks every sentence and mandate.

  • PayPal (sandbox):
    • Orders v2: one-call card checkout with PayPal's test cards, the cart digest in custom_id, and trackers.
    • Payments v2: captures (fees, issuer checks) and refunds.
    • Disputes v1: list, get, provide-evidence (multipart, with a PDF), accept-claim, adjudicate, and the filed document download.
    • Webhooks: CUSTOMER.DISPUTE.CREATED, UPDATED and RESOLVED, each verified with verify-webhook-signature.
    • The sandbox process-chargeback endpoint opens cases by script, with the codes the simulator takes (C2 for "not as described", where the network's own code is Visa 13.3).
    • A job keeps two cases per story opened ahead, because PayPal reviews a new chargeback for five to eight minutes before the seller can respond. It retires stock that PayPal closed or whose deadline is near; a case that missed its deadline shows as missed, never as "your move".
  • AI: GPT-5.6 on Azure OpenAI (Responses API) behind one interface that also runs Claude Haiku 4.5 on Amazon Bedrock (SigV4-signed, no SDK). One forced tool call per brief, the shape checked in code; the reviewer, the answerer, the repair step, the buyer agent and the AG Studio analyst use the same interface. A rules engine argues through the same checks when no model is available.
  • The checker is deterministic TypeScript. The odds come from the tally's weights, not from the model.
  • Eval (scripts/eval.ts, scripts/eval-review.ts, results committed in data/): 28 labelled variants × 2 customers, a stronger rules baseline, a held-out set written without the prompt, prompt-injection emails, an ablation, 3 seeds, a pressure set and 10 kinds of mutation.
  • App: Next.js 15 and React 19 on Vercel; AG Grid Community 36; AG Studio 3.0 (custom widgets in React and SVG, the Studio Agent Framework's runner talking to our model through our server); MCP over Streamable HTTP; pdf-lib; Google Cloud Storage reached keylessly through Vercel's OIDC token; GitHub Actions for CI and a refill schedule; 98 unit tests.
  • Design: the materials of litigation paperwork: the blue backing sheet of court filings, exhibit stickers, Bates numbers, pleading paper and a red ink stamp.

A GPT-5.6 buyer agent made this purchase under a signed intent; PayPal's webhook arrived and Exhibit argued the case 9 s later.

Challenges we ran into

  • Creating disputes programmatically. The buyer-side create-dispute call needs consent we couldn't script, and card payments failed on a sandbox business account registered outside the US. The fix was a US sandbox business account, one-call card checkouts and the sandbox chargeback simulator.
  • Chargebacks allow only two moves. Fight or refund in full; the model's schema only offers what PayPal's links allow.
  • A reviewer that gave up too easily. The first version of the cross-examination conceded 18 of 19 objections and lost 6 of 12 cases that should be fought. Both roles now know PayPal's own proof-of-delivery standard (tracking that shows "delivered", the date and the city or postal code; a signature only over $750), and the reviewer matches the right call in 27 of 28. We tuned on the same cases, and /proof says so.
  • Our own checker was wrong sometimes. On GPT-5.6's 380 sentences it struck 4; three of those were the checker's mistakes ("no record showing a signature" read as claiming one, a quote spanning lines of a record). Each is fixed and has a test.
  • Losing our own store. In October the case store was suspended and its notes were lost. We stopped trusting our own notes: where a case stands is read from PayPal's record, and lost cases are rebuilt from it.

Cross-examined before PayPal sees it: a visitor's objection answered from the exhibits and overruled; a fair point conceded and the sentence withdrawn.

Accomplishments that we're proud of

  • A dispute is opened, argued, checked, cross-examined, filed and resolved entirely through PayPal's APIs, with no human in the sandbox UI.
  • 56 of 56 right calls on GPT-5.6, the same on each of three seeds; a careless drafter told to slip in facts no record holds wrote six, and the checker struck all six.
  • An AI buyer agent that refused a listing's injected instruction to overspend, and mandate checks that catch the cart when a scripted agent follows it.

What we learned

  • PayPal's dispute lifecycle in detail: which HATEOAS links appear in which state, how long the sandbox takes to hand a case over, and that it closes cases on its own.
  • Structured output plus a deterministic checker beats prompting a model to "be accurate". And measure the checker too: our eval found its mistakes.
  • Knowing when to refund is half the value.
  • Your own database is a cache. The platform's record is the truth.

What's next for Exhibit

  • Connect a real store (Shopify, WooCommerce) and real carrier tracking in place of the demo shop.
  • Inquiry-stage tools: messages and partial-refund offers, which PayPal allows before a case becomes a claim.
  • A held-out set labelled by working chargeback analysts.

Built by Rohan Borade and Aatmaja.

Built With

  • ag-grid
  • ag-studio
  • azure
  • azure-openai
  • ed25519
  • github-actions
  • google-cloud
  • gpt-5.6
  • model-context-protocol
  • next.js
  • openai
  • paypal
  • paypal-disputes-api
  • paypal-orders-api
  • paypal-payments-api
  • paypal-sandbox
  • paypal-tracking-api
  • pdf-lib
  • react
  • typescript
  • vercel
Share this project:

Updates

Submission history