velvetAI

velvetAI - AI agents can book your appointments, but only you can approve and pay.
Ask AI (Google Gemini) finds live availability in the merchant's time zone.
50+ automated attack scenarios: prompt injection, replay, forged payments - all blocked.
Live merchant schedule built with Bryntum Scheduler.

Inspiration

AI agents are about to book things for us — haircuts, classes, appointments. But nobody wants an AI spending their money without asking. We built the missing safety layer: agents do the work, humans hold the wallet.

What it does

velvetAI is a booking and deposit platform for local services. An AI concierge (Google Gemini) or any MCP-connected agent can search live availability and place a 5-minute hold. The agent can never confirm or pay. It hands the customer an approval link; only the signed-in human reviews the exact service, time, deposit and cancellation policy, approves, and pays the deposit with PayPal. Merchants see everything on a live Bryntum schedule.

How we built it

PayPal Orders v2 + PayPal JS SDK v6 for deposits; bookings confirm only after a server-verified capture, with webhooks and an outbox worker reconciling uncertain outcomes
Google Gemini via the Vercel AI SDK, with tools that can only quote and hold — never commit or pay
Model Context Protocol (MCP) server so external agents get the same safe, limited tools
Auth0 for human login, roles and machine-to-machine agent credentials
PostgreSQL 17: GiST exclusion constraints make double-booking impossible; FORCE Row-Level Security isolates every tenant
ES256-signed booking intents so approved terms can't be altered
React 19 + Vite frontend (Vercel), Fastify 5 API (Render), Bryntum Scheduler for the merchant view

Challenges we ran into

Making payment confirmation trustworthy when replies get lost, preventing races when many agents hit the same slot, and keeping the AI accurate about dates and time zones (we resolve all dates server-side).

Accomplishments that we're proud of

20 concurrent agents racing for one slot: exactly 1 wins, 19 are rejected — enforced by the database
50+ automated attack scenarios (prompt injection, replayed approvals, forged payments, cross-tenant access), all blocked
A clean separation: AI prepares, human approves, PayPal settles

What we learned

Agentic commerce needs hard boundaries in the system itself, not just in prompts. Giving the AI no tool that can move money is safer than asking it not to.

What's next

Demand forecasting with smart deposits, a one-click judge/demo reset UI, a fault-injection demo, and onboarding real merchants.

Built With

auth0
bryntum
fastify
gemini
mcp
node.js
paypal
paypal-js-sdk
paypal-orders-api
postgresql
react
render
typescript
vercel
vercel-ai-sdk

Submitted to

PayPal AI Hackathon

Created by

I led product and architecture for velvetAI; designing the "AI prepares, human approves, PayPal settles" flow, the Ask AI concierge with Google Gemini, the human-only approval page, and the PayPal Orders v2 / JS SDK v6 deposit flow. I set up Auth0 and the PayPal sandbox, coordinated two parallel AI-assisted coding tracks (including the Bryntum schedule and race test), tested the end-to-end golden path, and produced the demo video and submission. It was my first time orchestrating AI coding agents on a project this size, intense, but I learned a huge amount about agentic commerce and payment safety.

Ayushi Kandpal
I owned the repository and the hosted deployment — the Fastify API on Render, the React web app on Vercel, and the PostgreSQL database — including environment configuration, migrations, seeding the judge demo tenant, and wiring Auth0 and PayPal for production URLs. Getting a full-stack app with webhooks, background workers and row-level security running on free hosting tiers taught me a lot about real-world deployment.

Har Kandpal