Agent Commerce Integration Pack

$59

Add safe commerce to an MCP server or agent API: trusted catalogue reads and server-side price resolution with price-tampering and unaudited-product guards. Buyer authorizes payment; no autonomous charging.

📁 7 files🏷 v1.0.0 (updated 2026-08-02)

Production-ready

✓ Instant download✓ Lifetime updates✓ MIT licensed✓ MIT license✓ Secure checkout (Stripe)

📋 What's Inside 7 files

✓ LICENSE—
✓ README.md—
✓ src/catalog.ts—
✓ src/checkout.ts—
✓ src/errors.ts—
✓ test/checkout.test.ts—
✓ manifest.json—

📁 File Structure 7 files

mcp-commerce-integration/
├── LICENSE
├── README.md
├── src/
│ ├── catalog.ts
│ ├── checkout.ts
│ ├── errors.ts
├── test/
│ ├── checkout.test.ts
├── manifest.json

📖 Documentation Preview README excerpt

Agent Commerce Integration Pack

Add safe commerce to an MCP server or agent HTTP API: let agents search a

catalogue, understand a product, and prepare a verified checkout link — without

ever being able to tamper with the price or silently charge a customer.

This is the battle-tested pattern behind a live, registry-listed commerce MCP

server, generalized into drop-in TypeScript modules.

The core problem it solves

If you let an agent pass a price (or a Stripe price id, amount, currency, or

product name) into your checkout call, you have a price-tampering hole: an

agent (or a malicious prompt) can buy a $199 product for $0.01. The fix is simple

but must be enforced everywhere: **resolve price server-side from trusted catalogue

data and reject any client-supplied money fields.** This pack encodes that rule.

Features

**CatalogRepository** — a shared read layer over a trusted catalogue JSON:

search, filter (domain/tags/max price), resolve by id or slug.

**createCheckoutLink** — resolves the trusted price id server-side, creates a

short-lived Stripe Checkout Session with a real expiry, and rejects any

client-supplied price/amount/currency/stripe_price_id/product_name.

**Sellability gate** — products flagged `unaudited`/`deprecated`/`not-sellable`

can never be purchased through the agent path (enforced in code).

**Redirect allowlist** — success/cancel URLs must be on an allowlisted host.

**Idempotency** — an idempotency key prevents duplicate sessions.

**Guardrail tests** — Vitest cases that prove price tampering is rejected and

unaudited products can't be checked out.

Requirements

Node.js 18+

A Stripe account + secret key (for the live checkout path)

Quick start


npm install
npm test



import { CatalogRepository } from './src/catalog.js';
import { createCheckoutLink } from './src/checkout.js';

const repo = new CatalogRepository(catalogJson);
const res = await createCheckoutLink(repo, { STRIPE_SECRET_KEY, CHECKOUT_ALLOWED_REDIRECT_HOSTS: 'yourstore.com' }, {
  productIdOrSlug: 'store:widget',
  // NOTE: no price/amount/currency accepted — resolved server-side.
});
console.log(res.checkout_url, res.expires_at);


File tree


src/
  catalog.ts    # CatalogRepository: search / filter / resolve (trusted data)

... preview truncated, see full README in product download.

`📄 Code Sample .ts preview`

src/catalog.ts/**
 * catalog.ts — a trusted read layer over your product catalogue.
 *
 * The catalogue is the ONLY source of truth for price + Stripe ids. Build it at
 * deploy time from your database/CMS and bundle it (or load it from a cache). The
 * agent never gets to set any of these fields.
 */
import { notFound } from './errors.js';

export interface Product {
  product_id: string; // stable "store:slug"
  slug: string;
  title: string;
  description: string;
  price_usd: number;
  domain?: string;
  tags?: string[];
  verification_status: 'verified' | 'community' | 'unaudited' | 'deprecated';
  agent_sellable: boolean;
  stripe_price_id: string | null; // trusted; never client-supplied
  checkout_url?: string | null; // optional fallback (pre-created payment link)
}

export interface SearchParams {
  query?: string;
  domain?: string;
  tags?: string[];
  maxPriceUsd?: number;
  includeUnsellable?: boolean;
  limit?: number;
}

export class CatalogRepository {
  private readonly byId = new Map<string, Product>();
  constructor(private readonly products: Product[]) {
    for (const p of products) {
      this.byId.set(p.product_id.toLowerCase(), p);
      if (!this.byId.has(p.slug.toLowerCase())) this.byId.set(p.slug.toLowerCase(), p);
    }
  }

`📅 Changelog`

v1.0.0 — Initial release. Last updated 2026-08-02.

Purchases include lifetime updates. Check the product page for the latest version.

`📄 Product Preview`

Try the interactive reader and demo tools below, or get the full product with all content unlocked.

📖 Interactive Reader (Free Preview)⚙ Try Demo Tools📦 Download Free Sample

`❓ Frequently Asked Questions`

What license is this under?

MIT License. You can use it in commercial, client, and internal projects. See our license terms page for details.

How do I download after purchase?

Immediately after purchase, you'll be redirected to a download page. A download link is also sent to your email.

Do I get updates?

Yes. All products include lifetime updates at no extra cost. Re-download anytime for the latest version.

What if it doesn't work for me?

DM @DatanestDigital on X and we'll make it right.

Can I get a refund?

DM @DatanestDigital on X with your order number and we'll help.

Is there support?

DM @DatanestDigital on X. We respond within 1-2 business days.



      
        Buy Now — $59
        
        Back to Products