← Back to search

io.github.CSOAI-ORG/agent-commerce-protocol-mcp

CSOAI-ORG streamable_http Scanned 25d ago

Agent Commerce Protocol MCP — bridges Stripe ACP + Google AP2 + Coinbase x402 for agent payments

B
88.9 / 100

Versions

1.0.10latest
first seen Jun 30, 2026
PermissionsTool SafetyAuthAnnotationsCode QualityStabilitySpecVuln HistoryAuthorTransparencyCommunity

Tools 7

discover_acp_merchants
annotations: none low

List Stripe-ACP-compatible merchants, optionally filtered by category. Args: category: Optional filter — "software", "groceries", "compliance", etc. Returns: {merchants: [{id, name, category, supports_protocols}]}

category string
prepare_payment_intent
annotations: none low

Build a Stripe ACP payment intent payload ready for merchant submission. Args: merchant_id: ACP merchant identifier (from discover_acp_merchants). items: List of {sku, name, quantity, unit_amount_minor} dicts. currency: ISO 4217 code, default GBP. buyer_did: Optional W3C DID identifying the buying agent (for trust chain). Returns: Payment intent payload conforming to Stripe ACP spec.

items string currency str buyer_did string merchant_id str
sign_payment_intent
annotations: none low

HMAC-sign a payment intent and prepare it for submission to the merchant. Args: intent: Payment intent payload from prepare_payment_intent(). Returns: {intent, signature, verify_url, audit_chain_entry}

intent dict
verify_acp_response
annotations: none low

Verify the merchant's ACP completion response (signature, status, intent match). Args: response: Merchant ACP response (status, signature, payment_id, etc.). expected_intent_id: Optional intent ID from sign_payment_intent for cross-check. Returns: {verified, status, issues, audit_chain_entry}

response dict expected_intent_id string
bridge_to_ap2_mandate
annotations: none low

Convert a Stripe ACP intent into a Google AP2 Mandate envelope so the same purchase can be settled through the Google + Mastercard + PayPal + Adyen AP2 coalition rails. Args: intent: Stripe ACP intent from prepare_payment_intent(). user_consent_jwt: Optional pre-signed user consent JWT (verifiable credential). Returns: AP2-compliant mandate envelope.

intent dict user_consent_jwt string
bridge_to_x402_paywall
annotations: none low

Convert a Stripe ACP intent into a Coinbase x402 HTTP-402 payment-required response, for pay-per-call agent settlement without a Stripe account. Args: intent: Stripe ACP intent from prepare_payment_intent(). Returns: HTTP-402 response shape with settlement instructions.

intent dict
list_supported_protocols
annotations: none low

List the agent-payment protocols this MCP can bridge.

Permissions 3

network medium
Server uses network capabilities via: urllib
filesystem low
Server uses filesystem capabilities via: open(), os
env_vars low
Server uses env_vars capabilities via: os.environ

Scan Findings 23

low
Tool 'discover_acp_merchants' has no annotations annotation_checker · 100%
low
Tool 'prepare_payment_intent' has no annotations annotation_checker · 100%
low
Tool 'sign_payment_intent' has no annotations annotation_checker · 100%
low
Tool 'verify_acp_response' has no annotations annotation_checker · 100%
low
Tool 'bridge_to_ap2_mandate' has no annotations annotation_checker · 100%
low
Tool 'bridge_to_x402_paywall' has no annotations annotation_checker · 100%
low
Tool 'list_supported_protocols' has no annotations annotation_checker · 100%
info
Sandbox failed to start for behavioral verification behavioral_verifier · 100%
info
pyproject.toml metadata manifest_parser · 100%
info
Tool: discover_acp_merchants manifest_parser · 90%
info
Tool: prepare_payment_intent manifest_parser · 90%
info
Tool: sign_payment_intent manifest_parser · 90%
info
Tool: verify_acp_response manifest_parser · 90%
info
Tool: bridge_to_ap2_mandate manifest_parser · 90%
info
Tool: bridge_to_x402_paywall manifest_parser · 90%
info
Tool: list_supported_protocols manifest_parser · 90%
info
Required env vars (3) manifest_parser · 80%
info
Sandbox failed to start for output poisoning scan output_poisoning · 100%
medium
Permission: network access detected permission_analyzer · 80%
low
Permission: filesystem access detected permission_analyzer · 80%
low
Permission: env_vars access detected permission_analyzer · 90%
info
No dependency files found for SBOM generation sbom_generator · 100%
medium
No build provenance detected (SLSA L0) slsa_assessor · 90%