Inspiration
Who makes sure the humans who wrote the software an AI agent stands on get paid? Traditional licensing and payment rails were built for humans clicking buttons, not autonomous agents. We wanted an agent that is not just compliant, but accountable by design.
What it does
Nebraska is an AI agent that discovers, executes and settles PayPal transactions while enforcing attribution and license-aware payments on every action it takes. It discovers PayPal products (subscriptions, orders, payouts) through an MCP server built on PayPal's Agent Toolkit; decides each action through a policy engine, with a provenance record naming the upstream code, model and licence it depends on; routes a share of every settled transaction by licence to upstream maintainers via PayPal Payouts, and refuses actions that violate a licence term before they execute; and logs every decision, refusal and settlement in an immutable audit ledger a human can read. The name comes from Nebraska's Good Samaritan law, the first law to require people to help each other.
How we built it
Next.js 14 / React / TypeScript front end with AG Grid for the decision ledger and Tailwind for the console; Next.js route handlers as the agent runtime with a TypeScript policy engine and an MCP server exposing PayPal tools; PayPal Subscriptions, Orders v2 and Payouts APIs via the PayPal Agent Toolkit using sandbox credentials; SQLite in development and PostgreSQL in production for provenance records, decisions and ledger entries; an LLM-driven decision loop constrained by a hard enforcement layer (the model proposes, the policy engine disposes); deployed on Render.
Challenges we ran into
Mapping an LLM's free-form intentions onto PayPal's concrete API surface took many iterations; attribution is an inference problem, not a lookup; keeping refusals useful rather than cryptic; plus sandbox quirks, token lifetimes and webhook retries.
Accomplishments that we're proud of
A working end-to-end loop: an agent that discovers a PayPal product, executes a real sandbox transaction, splits the value by licence to upstream maintainers, and writes an auditable record of every step, live in a console a human can interrogate.
What we learned
The hard part of agentic commerce is not the buying, it is the accounting: who is owed, who is credited, who can stop the transaction. AI safety and fair pay for open source are the same engineering problem when you refuse to separate them.
What's next
A registry of licence terms any MCP-connected agent can pull; porting the policy engine into a reusable package, and eventually other payment providers.
Built With
- ag
- agent
- css
- grid
- mcp
- next.js
- orders
- payouts
- paypal
- postgresql
- react
- render
- sqlite
- subscriptions
- tailwind
- toolkit
- typescript
