-
-
8
-
7
-
5
-
6
-
1
-
2
-
4
-
3
Inspiration
AI agents are moving from answering questions to spending real money — shopping assistants, subscription managers, autonomous procurement bots. But there's a gap nobody's solved: LLMs can be manipulated by prompt injection — hidden text in a product description or review can trick an agent into overspending, even while it appears to behave normally. It's ranked the #1 risk in OWASP's Top 10 for LLM Applications (2025). Meanwhile, Google's AP2, OpenAI/Stripe's ACP, Coinbase's x402, and India's own NPCI Unified Agent Protocol are all racing to standardize how agents pay — but none of them prove an agent literally can't overspend once manipulated. We wanted to build and prove that guarantee, not just claim it.
What it does
Provable Agent solves two connected problems for an online merchant, both enforced by one shared safety layer:
Problem 1 — Grow merchant revenue. A conversational AI shopping agent that intelligently upsells based on real co-purchase data (mined from 5,000 synthetic transactions across 150 products), but never exceeds the customer's stated budget.
Problem 2 — Make the merchant safely shoppable by other AI agents. Unknown, external AI systems — built by someone else, never seen before — can register a cryptographic identity (KYA) and transact autonomously through a custom-built MCP server, under the exact same enforcement as human customers.
The core architectural principle tying both together: the LLM proposes, a cryptographic Mandate Verifier — completely outside the LLM's control — decides. The verifier recomputes every cart total from raw line items (never trusting a caller-reported number), checks a signed mandate's per-transaction cap, total budget, category, expiry, and revocation status, and enforces a real-time velocity limit against burst attacks. Every allow and deny is written to a hash-chained, ES256-signed audit trail, live-verifiable on demand.
How we built it
FastAPI backend, React/Vite/Tailwind frontend, Dockerized end-to-end. Cryptography via ES256/ECDSA for mandate and audit signing, SHA-256 hash-chaining for the tamper-evident ledger. LLM layer is swappable (Gemini primary, Groq fallback) via a single environment variable. Payments run against Razorpay's real test-mode API — genuine orders, HMAC-SHA256-verified webhooks, real refunds — not a simulation. External agent commerce runs through a hand-rolled JSON-RPC 2.0 MCP server after the reference SDK conflicted with our stack.
We grounded major design decisions in IEEE research — from prompt-injection defense literature to blockchain audit-trail design to real-time fraud-detection patterns — rather than intuition alone.
Challenges we ran into
Real bugs, found and fixed through actual adversarial testing, not assumed away: spend was initially double-counted between cart-add and payment; an unauthenticated endpoint could forge negative-spend audit entries; refund approvals had no check preventing an agent from approving its own refund; both checkout-layer and webhook-layer replay attacks could double-commit spend; and a live counting bug on our own Security Dashboard (denials-by-reason not summing to the total denial count) was traced to two denial categories silently missing from the top-level counter — found, root-caused, and fixed with a hard runtime assertion so it can't silently drift again.
Accomplishments we're proud of
A live, side-by-side attack demo where a naive prompt-only agent gets fooled by injected instructions while our verifier-protected agent — same LLM, same malicious input — stays safe every time. A tamper test where directly editing the database to raise a spending limit still gets denied, because the cryptographic signature no longer matches. A Security Dashboard where anyone can click a button, trigger a real attack against our live backend, and watch the exact matching denial counter increase within two seconds. 70+ deterministic tests proving the core safety guarantees hold with zero LLM calls involved.
What we learned
Safety that depends on an LLM "usually" behaving isn't safety — it's luck. The only durable guarantee comes from enforcement that sits structurally outside the model's control, verifiable by math and cryptography rather than trust.
What's next
Anti-replay nonce hardening for external MCP agents, chain-head anchoring for stronger tamper-resistance, and exploring compatibility with AP2-style signed mandates as those industry standards mature.
Log in or sign up for Devpost to join the conversation.