GhostMerchant

Zero-trust PayPal escrow for AI agents — authorize, probe, then capture or void.

Comment

Built with AI (please note for eligibility)

GhostMerchant was built with AI, not only themed around AI.

  • Cursor — AI coding platform used as the main IDE/agent to implement the full stack
  • LLM in Cursor (Grok) — wrote/iterated production code and debugging
  • PayPal Sandbox MCP + PayPal AI Toolkit — AI-assisted PayPal sandbox development

The app is a PayPal AUTHORIZE → probe → CAPTURE/VOID control plane for autonomous AI purchasing agents.

Inspiration

AI agents are starting to buy things — API credits, plugins, stock assets — but the default pattern is still “give the bot a virtual card.” That terrified us in a good way: one buggy loop at 3am and Finance wakes up to a five-figure bill.

We wanted the opposite of a card number in the prompt. Hold money with PayPal AUTHORIZE, verify the vendor with a canary probe, then CAPTURE or VOID. Virtual cards don’t do that. PayPal’s authorize-and-capture model does.

Inspiration also came from real ops pain: procurement teams who want agents to move fast, and security teams who refuse to let an LLM hold a PAN.

What it does

GhostMerchant is a buyer-side control plane for autonomous spend on PayPal Sandbox:

  1. Policy firewall — max order amount + velocity (orders/min) circuit breaker
  2. AUTHORIZE — create a PayPal hold (sandbox card for speed, or wallet Approve for dispute-able payments)
  3. Delivery probe — hit a vendor health endpoint before money settles
  4. CAPTURE or VOID — settle only if the probe passes (“poison pill” if it fails)
  5. Payouts — optional split of a successful capture across agent budget emails
  6. Dispute dossier — forensic pack (policy, probe, IDs, step log) for PayPal Customer Disputes

The Control Room dashboard shows a live pipeline: Policy → Authorize → Probe → Settle.

Who it’s for: finance/ops and agent builders (e.g. Priya stopping OpsBot runaway spend) — not a Shopify checkout plugin for merchants.

How we built it

  • Runtime: Node.js + Express control plane (ghostmerchant/)
  • PayPal REST (Sandbox): Orders (intent: AUTHORIZE), authorizations capture/void, Payouts, Customer Disputes, Webhooks
  • AI / tooling: Cursor + PayPal AI Toolkit skills + PayPal Sandbox MCP to design flows, call sandbox tools, and iterate the firewall safely
  • UI: vanilla Control Room (policy sliders, fire purchase, live pipeline, session table, dossier drawer)
  • Tunnel: ngrok for webhook delivery to localhost during development

Build order: dry-run conveyor → live card AUTHORIZE→VOID/CAPTURE → wallet Approve + auto-resume → payouts → real buyer dispute case → scenarios + README for judges.

Challenges we ran into

  • Wallet vs card: sandbox card settles fast but is hard to dispute; wallet path needs buyer Approve and only then becomes a clean dispute story.
  • Human Approve UX: we wrongly added a permanent “buyer email” field and an “I’ve approved” button — judges/users need Approve in PayPal, with GhostMerchant polling for APPROVED and continuing automatically.
  • In-memory sessions: restarting the server wipes the forensic dossier even though PayPal still has the capture/dispute — fine for a hackathon PoC, painful for demos.
  • Disputes lifecycle: early INQUIRY/UNDER_REVIEW often has no provide-evidence HATEOAS link yet; dossier must be ready when seller evidence is requested.
  • Webhook URL churn: ngrok URLs change; Dashboard webhook + PUBLIC_BASE_URL must stay in sync.

Accomplishments that we're proud of

  • End-to-end live sandbox AUTHORIZE → probe → VOID and CAPTURE with real PayPal IDs
  • Wallet path that auto-detects buyer approval (no fake continue button)
  • Payout batch ids after capture to agent emails
  • Real buyer dispute case tied to a GhostMerchant capture (e.g. PP-R-…)
  • Judge-facing scenarios (SCENARIOS.md) that explain the product in who/trigger/value stories

What we learned

  • AUTHORIZE is a hold, not long escrow — the product value is policy + probe between auth and capture.
  • Agent spend products must separate who Approves (human PayPal identity) from who requests the buy (the agent).
  • Sandbox dispute UX is long; plan demo time accordingly.
  • Concrete scenarios beat abstract “procurement platform” language every time.

What's next for GhostMerchant

Post-hackathon (see POST_HACKATHON_IDEAS.md in the working tree):

  1. Hosted multi-tenant API + Control Room
  2. Agent SDK / MCP purchase tool
  3. Chrome “Approve” or Slack alerts for human-in-the-loop
  4. Persist sessions so dossiers survive restarts

Built With

Share this project:

Updates

Submission history