Fish Market

Sign up page
Landing page

Inspiration

Ask a shopping agent to buy a graphics card under $1,300 and it will find one. It may not check that the card fits your case. It may not notice that a listing that says "new" says open box on its own page. And it may obey a line hidden in a listing that tells it to pay someone else.

This is not hypothetical. In Anthropic's own browser-agent pilot (August 2025), prompt injection succeeded 23.6 percent of the time against an agent with no defenses, and 11.2 percent of the time with them.

Agents are starting to buy for us, and agents get fooled. We wanted a buyer's agent you could hand a budget to: one that checks every deal against its source, argues against a bad deal even when it is the cheapest, and cannot spend past your allowance without calling you. We started with PC parts, because a wrong socket or a card 2 mm too long is a costly mistake that code can check.

What it does

Fish Market is a marketplace where your buyer agent shops for PC parts and seller agents compete for the order in sealed rounds.

You state a goal, like "an RTX 5070 Ti that fits a 305 mm case, under $1,300". The planner turns it into parts and skips the ones you already own.
Sellers bid blind. Each part gets one sealed knockout round of up to three best-and-final stages. Sellers see a $500 band, never your budget, your allowance or each other's bids.
Smell Test screens every bid before any agent reads it. A listing that hides instructions or swaps the payee is quarantined, with the rules that fired.
The Quality Advocate checks fit and claims. It checks socket, memory type, power, connectors and clearance in code, compares the seller's claim with its own page, and looks up CPSC recalls. It can veto the cheapest bid, and every warning cites its source.
A deterministic referee ranks the offers. The same offers always rank the same way, no bid lands below its seller's floor, and the seller fee never enters the ranking.
The payee and the price are checked before payment. A business seller needs a fresh CRS identity check, and Bright Data re-reads the winning price from the store.
Above your allowance, you approve by phone. A Cartesia voice agent calls you, reads the build and the total, and answers "why not the cheaper one?" Code decides, not the voice agent: only the one-time code shown on your screen plus "approve" passes. Silence, a hang-up or a wrong code means nothing is paid.
You get a Stripe test-mode charge and a receipt. Each part is charged once, keyed to its mandate. No real money moves.

Losing sellers get a loss report: a banded price gap and the reason with its source, never a rival's price or your budget. A seller agent can adjust its next bid, but never below its floor.

What is real and what is simulated. Every bid, claim and screen carries a label:

LIVE: a real outside party, now.
MIRROR: a real, dated copy. Store listings are real public listings from Best Buy, Micro Center, B&H, Amazon and eBay, in dated snapshots.
SIM: generated by us. The seller agents that bid are ours; no outside shop has bid yet.
SANDBOX: a vendor's test mode. That covers payment (Stripe test mode) and the CRS check.

Where it runs today. The approval call is a real outbound call to the buyer's own phone. The full flow (knockout rounds, re-plan, one call, test charges) runs in our build runner against the shared market. On fishmarket.dev you can sign up and post a goal, which runs one part through one sealed round. Wiring the website's purchase step to the call is in progress.

How we built it

Agents (Fetch.ai uAgents). There are nine agents with one job each: the Buyer, the Quality Advocate, the Smell Test front door, four sellers with different strategies, the Caller and Market Pulse. Six are registered on Agentverse, and the Buyer takes goals in ASI:One over the Agent Chat Protocol.

Market (SpacetimeDB on Maincloud). Rounds, floors, rankings, mandates and approvals live in reducers written in TypeScript. Every screen and agent sees the same state. The market refuses any payment that has no recorded approval, and it enforces each seller's floor, so even a compromised agent cannot bid under it.

Smell Test (Python, FastAPI). It is agent security as an API: /v1/shield/screen, /verify-agent, /verify-mandate and a claim check, with a published rule list. It fails closed: an unset URL, a timeout or an error blocks. The rules run on every message. A Claude Haiku classifier is opt-in and never decides money.

Data and truth. Apify Store Actors build the dated listing mirrors. The fit checker runs rules over the open docyx/pc-part-dataset plus maker specs, and an unknown fit is "uncertain", which can never beat a confirmed fit. Recalls come from the CPSC public API. The price reference is the median of in-stock retail asks from two data owners; eBay sold prices are shown beside it, never blended in. We packaged five of these checks as our own Apify Actors.

Pay and trust. Each mandate binds the deal, amount, payee, expiry and a nonce, and only the market's real winner gets one. Around that sit:

the approval judge;
the Cartesia call client;
the CRS payee gate;
Visa Trusted Agent Protocol request signing (RFC 9421, Ed25519), built and tested, which runs in our scripted reference run but not yet on the live purchase;
Stripe test-mode charges, idempotent on the mandate hash, with every charging path refusing any key that is not a test key.

Web. Next.js 16, React and three.js on Vercel: the buyer, market, floor and seller screens.

Around the core:

the Seller Kit, which turns a shop's prices and floors into a seller agent config and screens its listing text first;
IT purchasing controls (PO numbers, three-way match, an audit trail);
a wind tunnel of simulated buyers and hostile agents.

Challenges we ran into

Measuring a filter honestly. We wrote Smell Test's rules against a development set, so a score on that set would flatter us. The held-out set was written before the rules froze and is never tuned on, and it is the only number we report: 13 of 20 stopped, with 2 of 10 honest listings wrongly blocked. We never pool the two sets.
A voice is not a credential. A recording or a clone of your voice must not be able to approve a payment. The credential is a single-use code on your screen, bound to one mandate. Speech-to-text can miss the code in a noisy room, and the answer is a new code, never a looser match.
Prices that lie by accident. eBay sold prices are mixed condition and pulled the reference far below retail. The baseline now uses only in-stock retail asks, needs two distinct data owners, and shows sold prices beside it but never blends them in.
Unknown is not OK. When our spec tables lack a part's length or power draw, the checker says "uncertain", and an uncertain fit can never beat a confirmed fit.
Attacking ourselves. Overnight we ran a red-team audit of our own app and turned each finding into a fix.

Accomplishments that we're proud of

Every number comes from a command in our repo, and headlines are first runs:

Smell Test, held-out attacks (rules only): 13 of 20 stopped (65%), with 2 of 10 honest listings wrongly blocked (20%).
Fit checker: 39 of 39 right on builds whose every part was checked on a maker page, and 0 false OKs across all 50 builds. The set was tuned once, so this is not held out.
Voice approval attacks: 9 of 10 denied on the first run, and 10 of 10 after one fix (not blind).
Purchasing controls: 26 of 27 planted errors caught on the first blind run, with 2 of 7 clean cases falsely flagged.
A real approval call. Cartesia calls the buyer's own phone, and only the code on their screen approves.
Our own sponsor tools:
- six agents registered on Agentverse;
- four public Apify Actors with pay-per-event pricing;
- a CRS sandbox run on Oct 24 that returned two simulated sellers verified_stable and one not_verified.

We also publish what did not work. Seller learning shows no lift to quote yet, and we have no verified savings yet because no verified purchase is recorded. The price reference is ready: a median of $1,279.99 for an RTX 5070 Ti across 8 in-stock retail asks from 2 providers.

What we learned

Money decisions belong in code. Every gate that moves money is deterministic and tested. Models help with language, never with the yes.
Labels are a feature. Saying LIVE, MIRROR, SIM or SANDBOX on every row made us more careful, and it makes the demo easier to trust.
A blind first run is worth more than a polished rerun. We report the first run as the headline and mark every fix after it as not blind.

What's next for Fish Market

Goals posted on the website run the full build: knockout rounds per part, re-plan and one call.
Outside sellers bid live through the Seller Kit and an open seller protocol.
Seller agents that sell better within their shop's policy, plus a shop-level report of the strategies that won.
Small IT buyers (10 to 50 machines), where sealed volume bids matter most.
Agents pay per call for our Actors over x402, and Visa Intelligent Commerce tokens replace the Stripe path once we have sandbox access.

For sponsor judges

Hyphenate: Autonomous Systems for Finance. For IT teams buying computer gear, we built purchasing controls that keep a person in the loop where it counts:

PO numbers;
a requester who can never approve their own order;
a three-way match of PO, invoice and receiving;
an audit trail behind every decision.

Payment is bound to the approved PO's deal, amount and payee through the same mandate code as the consumer flow, so an edited amount or a swapped payee is blocked. The ledger is double-entry in integer cents; entries are immutable and fixed by reversal. Every decision is hash-chained with its evidence. A vendor bank change blocks every payment until a different person verifies it. No model makes a control decision, and the suite has 77 tests.

We tested it blind: on 27 planted errors, frozen before any run and written without reading the engine, it caught 26 on the first run and falsely flagged 2 of 7 clean cases. The company in the demo is simulated; the rule engine is real.

Visa: Reimagining Shopping. We reimagined shopping for the moment when your agent does it for you. Sellers compete in sealed rounds, a skeptic on your side vetoes the traps, and above your allowance nothing is paid until you approve on a call with a code only your screen shows.

We implemented Visa's Trusted Agent Protocol wire format (RFC 9421 signatures, Ed25519, nonce) and verified it against a port of Visa's reference verifier. It is built and tested, and it runs in our scripted reference run. The live purchase does not use it yet: today that path charges Stripe test mode after the phone approval without a signature. It is not certified by Visa. The Stripe test charge runs on a Visa test card. Next: Visa Intelligent Commerce tokens in place of the Stripe path, given sandbox access.

Apify: Best Use of Apify and Best Actor. Apify is how Fish Market sees the real market. Store Actors build dated mirrors of public listings from Best Buy, Micro Center, B&H, Amazon and eBay, and our seller agents bid from those listings. The listings are labelled MIRROR and the bidding agents SIM.

We also built five Actors of our own, one per job in our process. Four are public on the Store with pay-per-event pricing:

PC Build Compatibility Checker;
Listing Claim Checker;
Electronics Recall Checker;
Seller Agent-Readiness Report.

The fifth, Listing Injection Screen, is private. The product runs the same code in process; the Actors are how outside agents and developers can use it. They have no outside users yet.

For Best Actor, we put forward the PC Build Compatibility Checker. It runs 12 fit rules over a build and returns the maker page behind each number, at $0.005 per build checked. The same fit engine scores 39 of 39 on builds whose every part was checked on a maker page, with 0 false OKs across 50 builds (tuned once, not held out). An unknown fit comes back "uncertain", never OK.

Spacetime: Best Use of Spacetime. SpacetimeDB is the market. Rounds, floors, rankings, mandates and approvals live in reducers on Maincloud, so every agent and every screen sees the same state. The referee is one deterministic rule in those reducers:

the same offers always rank the same way;
no bid lands below its seller's floor;
the seller fee never enters the ranking;
a payment with no recorded approval is refused.

Because the floor is enforced in a reducer and not in a prompt, even a compromised seller agent cannot undercut it.

Fetch.ai: Best Use of Fetch.ai. Fish Market's agents are uAgents, each with one job. Six are registered on Agentverse, and the repo carries the innovationlab and hackathon badges:

the Buyer;
the Quality Advocate;
the Smell Test front door;
two sellers, one that learns and one that lies on purpose (SIM, planted) so the Advocate can veto it;
one retired seller.

The Buyer takes goals in ASI:One over the Agent Chat Protocol, remembers the parts you own, runs the sealed round, and asks for approval before any payment. The Caller and Market Pulse run locally. The emailed receipt goes through ASI:One's Gmail connector from the buyer's own account, tested once live. The Buyer includes the Payment Protocol, but it refuses a payment request in chat on purpose: above your allowance, money moves only after the phone approval. The agent profiles and an ASI:One chat with the Buyer are linked under "Try it out".

CRS: Best Use of CRS API. Before any business seller is paid, Fish Market requires a fresh, verified CRS identity check of the payee, and binds that check into the payment mandate. We ran it against the CRS sandbox with the provided test identities on Oct 24 at 16:37 PDT: two simulated sellers came back verified_stable and one came back not_verified. The build runner runs this gate today; the website's purchase path does not yet. Market Pulse also answers seller-record questions from the CRS cache.

Cartesia: Best Use of Cartesia. Cartesia is the only way to approve a purchase above your allowance. A Cartesia voice agent places a real outbound call to the buyer's own phone, reads the build and its total, and answers "why not the cheaper one?" We use Cartesia's outbound calls, dynamic variables and call transcripts.

Approval is decided by code, not by the voice agent: the one-time code on your screen plus "approve" passes, while silence, a hang-up or a wrong code denies. On 10 held-out voice attacks, 9 were denied on the first run and 10 after one fix (not blind); the suite has 68 tests.

Bright Data: Best Agent/App Using Public Web Data. Fish Market runs on public web data: dated store listings, the CPSC public recall API and an open parts dataset. Bright Data's Scraper API is the last check before money moves. Right before the approval call, each winning listing's price is read again from the store, and a price that moved or a part that sold out stops the build. Without a live read, the dated MIRROR price stays and the line on screen says so.

Armadin: Best Security Hack. Agents that buy are a new attack surface, so Fish Market treats every other agent's text as untrusted:

Smell Test screens every seller message, listing title and claim before any agent reads it, and fails closed.
Mandates bind one payee, an amount cap, an expiry and a nonce, and they are single use.
A voice can never approve a payment; only a one-time code on the authenticated screen can.

Our numbers so far:

13 of 20 held-out injection attacks stopped, with 2 of 10 honest listings wrongly blocked (rules only);
9 of 10 held-out voice attacks denied on the first run.

These are results on our test sets, not proof of safety.

MLH: Best Use of Tiger Data. Tiger Data's time-series Postgres holds the market's memory. In our demo run, each round's bid prices are written to Tiger Data, and Market Pulse reads them back to answer price-trend questions. It is never on the money path.

Anthropic: Claude for Public Benefit. Fish Market is built so a small shop can win on price and quality alone. It does not need an ad budget, a marketing team or a paid ranking boost:

The referee ranks every bid by the same deterministic rule.
The seller fee never enters the ranking.
Every losing seller gets a loss report with the reason and its source, so a small shop learns what to change without guessing.
The Seller Kit turns a shop's own prices and floors into a seller agent, so the shop does not have to build one.

On the buyer side, the same rules protect people from listings that lie or try to hijack their agent. Claude Haiku 5.5 gives Smell Test a second opinion on seller text, and it never decides money. Honest status: no outside shop has bid yet; every seller agent today is ours (SIM), bidding from real, dated store listings.