TrustCart Agent

What it does

TrustCart Agent is an agentic shopping demo built for the PayPal AI Hackathon. You save a purchase intent first — for example budget $50, category Camping, quantity 2. An AI agent then searches the catalog and proposes items that match that intent. It does not get to move money on its own.

Before PayPal runs, every cart goes through a two-layer policy (system rules you cannot turn off, plus your own limits), an intent gate, a prompt-injection scan on product descriptions, and a human Reviews approval inbox. After you approve, the app creates a PayPal Orders v2 sandbox payment, waits a configurable pre-charge delay (default 60 seconds, with cancel), then captures. Each paid order gets an Ed25519-signed intent mandate you can verify.

If a simulated billing mismatch appears (for example 2 units approved but 3 charged), TrustCart drafts a partial refund with evidence and lets you export the trail as JSON or PDF. The live demo is sandbox-only. No real money moves.

Inspiration

AI shopping agents are useful, but the hard question is authorization: who is allowed to spend, and how do you prove what the human actually approved?

Seller-written product text can hide instructions aimed at the model (prompt injection). An agent can also drift off-intent — for example trying to buy laundry detergent when the user only saved a Camping intent. If payment APIs sit behind the model with no clear human gate, a wrong cart can become a real charge.

TrustCart explores a practical answer: the AI may propose; the human and the server authorize. Intent is saved in the UI. Policy and price checks live on the server. PayPal create → approve → capture only runs after human approval and the pre-charge wait. Mandates and evidence exports make the decision trail reviewable after the fact.

How we built it

Stack: Next.js app with Prisma and Neon Postgres. AI is selected with AI_PROVIDER: mock (tests/replay), ollama (local), or gemini (deployed demo when quota allows). Payments use PayPal Orders v2 in the sandbox: create order → buyer approve → capture, plus partial refund.

Happy path: (1) User saves intent ($50 / Camping / qty 2). (2) AI searches camping lanterns. (3) Product descriptions are untrusted — camp-03 is flagged for injection-like text; the agent still follows quantity 2. (4) Off-intent detergent is soft-refused by the intent gate. (5) Matching cart lands in NEEDS_APPROVAL in Reviews; UI shows Layer 1/Layer 2 rule. (6) Human approves → PayPal sandbox $19.98 → 60s pre-charge wait → capture. (7) Verify Ed25519 mandate → simulate 2 vs 3 mismatch → partial refund → JSON/PDF evidence.

Layer 1 (system) is always on. Layer 2 is user limits. The model never holds payment authority; checkout re-checks the server cart and policy.

How PayPal is used: Orders v2 sandbox create → approve → 60s wait → capture; partial refund on simulated mismatch; server-computed amounts only.

How AI is used: Shopping conversation under saved intent; proposes cart only; intent gate + injection scan; no payment authority; AI_PROVIDER mock/ollama/gemini.

Challenges

Free-tier Gemini quota can interrupt the hosted demo mid-chat; Ollama was used for a reliable demo recording; production uses Gemini when quota allows. Payments and the approval inbox do not depend on the AI staying up. A KR sandbox buyer was blocked for this flow; a US Personal sandbox buyer works. Keeping agentic UX honest while refusing off-intent buys and never bypassing approval or PayPal capture rules.

Accomplishments

End-to-end sandbox path from intent through AI cart, policy, human approve, PayPal capture, mandate verify, mismatch, partial refund, and evidence export. Clear separation: AI proposes; server enforces; human approves; PayPal settles. Prompt-injection scan on untrusted product text. Soft refuse for intent mismatch. Two-layer policy with Reviews inbox. 60s cancellable pre-charge wait. Ed25519-signed mandate plus JSON/PDF evidence. Switchable AI providers for free-tier demos.

What's next

Harden Gemini quota fallback messaging without weakening payment guards. Expand catalog/mismatch scenarios. More readable audit views for non-developers. Richer PayPal sandbox refund/evidence tooling (sandbox-first).

Try it out

Demo video: https://www.youtube.com/watch?v=Df0lfUnlRK4 Live: https://trustcart-agent.vercel.app Repo: https://github.com/seulgi-i/trustcart-agent PayPal sandbox: use US Personal buyer; KR may be blocked.

Technologies: Next.js, TypeScript, Prisma, Neon Postgres, PayPal Orders v2 (sandbox), Google Gemini, Ollama, Vercel, Ed25519.

Built With

• ed25519
• gemini
• google
• neon
• next.js
• ollama
• orders
• paypal
• postgresql
• prisma
• sandbox
• typescript
• v2
• vercel