Agent Has to Ask

Our agent can pick the cart. You still own the charge. The store sees what you allowed, checks the limit and only opens checkout after that check passes.

Comment

Inspiration

Checkout with an agent usually collapses into one click: the agent talks to the page, asks to buy, and a session appears. The person whose card is about to move never sees a clean “this is what it asked for.” The merchant never has a clean “this is why we said yes.”

We split that into three questions a human can actually answer:

  1. What did the agent ask to buy?
  2. What will this store allow?
  3. Does the server still say yes?

Until those are separate, an agent shopping for you is a blank check.

What we built

Agent has to ask is a public KnowYourAgent demo for agent-assisted checkout. The agent can request a purchase. It cannot approve one.

The page shows a short-lived signed permission: who the agent is, which cart, which wallet, what it may buy, when it expires, and the spend cap. A browser agent gets two tools:

  • kya_validate_trace — check that permission in the browser
  • kya_verify_agent — send the cart to the merchant for a read-only preflight

The server checks the signature, audience, agent, scope, expiry, currency, cart, wallet, and amount. Then it says one of three things a person can read:

  • Accept
  • Review
  • Decline

Checkout runs the same check again on the server before it creates a simulated session. No card is captured. No production order is written. After the decision you can inspect the record: trace ID, preflight ID, cart fingerprint, and why it landed where it did.

How we built it

Next.js, TypeScript, React, signed JWT traces, Web Crypto, and WebMCP tool registration. The page registers tools on the browser’s model context. The merchant adapter stays on the server and keeps the last word.

Challenges

The hard part was not wiring tools. It was refusing to let the browser become the thing that authorizes payment.

A browser tool can help an agent ask. It must not be the authority that charges. We also kept the flow usable when WebMCP is missing: a person can still read the permission and run the same server preflight by hand.

What we learned

Agent checkout needs a human-shaped boundary. The agent files a request. The merchant enforces policy. The server decides. The record has to explain what happened and why — to the shopper, not just to the protocol.

Built With

Share this project:

Updates

Submission history