Pal-lock

Pal-Lock: escrow with an AI referee, built on PayPal. Every transaction ,done with protection

Comment

Funguo is escrow on PayPal. The seller is paid only when the item checks out.

Inspiration

It started with a scam we kept seeing around us. On Instagram and TikTok, buying something means sending money to a stranger first and hoping the goods show up. Often they do not, or a cheaper fake arrives. Honest sellers lose customers who are too scared to pay. Buyers lose money with no way to get it back.

Then a sharper question. As AI agents start shopping for people, who protects the agent? A person can open the box. An agent pays quickly, and it pays sellers it has never met.

Escrow is the old answer to paying first and hoping. The usual versions are priced for large deals, release money when a parcel is marked delivered, and need a person to settle every argument. That does not fit a purchase an agent makes in a chat. So we built escrow with an AI referee, on PayPal.

Funguo is Swahili for "key." It is a new project. All of it was built during this submission period.

What it does

Funguo sits between the buyer and the seller.

  • A person, or an AI shopping agent, pays into a PayPal authorization hold. The seller has not been paid yet.
  • If the buyer confirms the item, Funguo captures the hold in full.
  • If something is wrong, they photograph it and open a dispute. Claude (claude-opus-5-5) reads the listing and the complaint, looks at the buyer's photo and the seller's packing photo, checks the market price on Channel3, and searches known scam patterns on Elastic. It then runs one PayPal call: a full capture, a partial capture (the seller is paid less and the rest of the hold is released), or a void (the buyer is never charged). It writes down why. A ruling usually takes under a minute.
  • If its confidence is low, the evidence conflicts, the item was never shipped, or it tries to decide twice, the code stops it and a person decides. The money stays on the hold until then.
  • Every ruling is in an AG Grid ledger: the decision, the confidence, the guardrail that fired, what the agent originally wanted to do, and the PayPal ids.
  • The same Claude model can be the buyer. It gets a budget, skips risky listings, pays into the hold, looks at a photo of what arrived, and confirms or disputes. Those tools are also an MCP server, so Claude Desktop or Claude Code can shop the same way.
  • A shop with its own cart can add the hold through the Pal-Lock API, next to ordinary PayPal Checkout.

How we built it

PayPal already holds the money. We mapped our order states onto that, and Funguo never takes custody of the funds.

  • Orders v2, intent: AUTHORIZE — opens the hold on the buyer's PayPal account. A person approves it in the PayPal sandbox. An agent can authorize a sandbox card inline.
  • Payments v2 — captures the authorization, captures part of it with final_capture: true, voids it, or reauthorizes a wallet-funded hold after PayPal's three-day guarantee.
  • Orders v2, intent: CAPTURE — ordinary PayPal Checkout, offered beside the hold.
  • Every call that moves money sends a PayPal-Request-Id, so a retry cannot charge twice. Incoming webhooks are signature-checked.

The API is Node, Express, and SQLite. The front end is React. Claude, on the Anthropic API, is both agents: vision for the photos, and tool use for the price check, the scam search, and the PayPal decision. Channel3 supplies reference prices. Elastic runs the kNN search over known scam patterns. AG Grid Community is the audit ledger. Render hosts the demo.

Challenges

Letting an AI move money. The model proposes. Code between the model and PayPal decides whether that proposal may run. When a guardrail overrides it, we keep what the model wanted, so a person can see it.

Holds that outlast the guarantee. Cross-border shipping is slower than PayPal's three-day honor period. Funguo reauthorizes wallet-funded holds, so a later capture still lands on guaranteed funds.

A partial refund before any capture. That is a partial capture with final_capture: true. PayPal releases the rest of the hold, so the buyer is never charged the refunded amount.

Evidence that tries to give orders. Complaints, listing text, and words in photos come from people who want a result. The adjudicator treats them as evidence. An attempt to instruct it is logged against the party who wrote it.

What we're proud of

  • An agent that runs the PayPal call itself, with an audit trail a person can check.
  • Two agents on one payment: a Claude buyer that spots the wrong item in a photo, and a Claude adjudicator that voids the hold.
  • Anything mocked is labelled as mocked, in the interface and in the README.

What we learned

PayPal's authorize and capture model is a natural fit for escrow. Escrow is a natural fit for an agent, because the payment can wait until there is evidence.

What's next

PayPal Commerce Platform, so the platform fee is split at capture. Carrier tracking webhooks in place of the simulated shipment buttons. A real fraud corpus for the scam search. Order actions limited to the buyer, the seller, or the reviewer who is allowed to take them.

Built With

Share this project:

Updates