Agent Commerce Gateway
Self-hosted gateway that lets AI agents discover, call and pay for your existing HTTP API.
A TypeScript gateway you run in front of an API you already have. You describe each endpoint and its price in YAML, and the gateway exposes it over HTTP, MCP or experimental A2A, charging with x402 or experimental MPP. The Builder describes it as non-custodial: payments go straight to the merchant wallet and the gateway holds neither the buyer's nor the merchant's private key. It sells API calls, not goods, and has no storefront.
- I already run an HTTP API and want agents to pay per call in USDC without adding payment code to my backend
- I want one config file to publish the same endpoints as MCP tools and as an A2A agent
- I want payments to land in my own wallet instead of a platform balance
- A2A, ACP, MPP and AP2 are experimental, off by default, and may break in minor releases; the README says to pin an exact version
- A2A is a subset: synchronous SendMessage with one structured data part, with no streaming, push, REST or gRPC binding, or A2A authentication
- Agent routes are unauthenticated by design and there is no rate limiting, so a free resource is an open proxy to your backend; put quotas in your API or at the edge
- Fixed prices only: pricing.type dynamic is rejected at config load
- Receipts live in SQLite; PostgreSQL is on the roadmap, so a shared store across instances is not available out of the box
- One payment rail serves each resource; a buyer cannot choose between rails per request
- MCP, x402 and AP2 need optional peer packages pinned to exact versions; a missing peer stops the gateway or fails its health checks
- Use the scoped package @devlab.group/agent-commerce; the skill warns that an unrelated npm package is named agent-commerce
- Public-network settlement suites do not run in CI; they run by hand from a funded wallet
Last activity Nov 2, 2026. Fit: adaptable 3, operable 2.
Editions
Self-hosted · Free open source
- Clone
git clone https://github.com/devlab-group/agent-commerce - Install
npm install -g @devlab.group/agent-commerce
Managed by DEVLAB · Free closed source
- HostedOpen the hosted app
Adaptable: what is yours to change
Make it yours
Config only23 things to edit
Copy config.example.yaml to config.yaml or run agent-commerce init. The resources block sets business behavior: which backend endpoints are sold, the price of each, which protocols expose it, and which payment rail it takes. The merchant, payments and protocols blocks set the merchant identity, wallet, network and enabled adapters. ${VAR} placeholders in the YAML read from the environment, so the env vars below are mostly deployment values. agent-commerce import openapi drafts the resources block from an OpenAPI file.
- Env vars
AGENT_COMMERCE_CONFIGGATEWAY_PUBLIC_BASE_URLGATEWAY_PORTADMIN_TOKENDASHBOARD_ORIGINMERCHANT_API_BASE_URLMERCHANT_WALLETRECEIPT_STORE_PATHX402_NETWORKX402_RPC_URLX402_FACILITATOR_URLX402_FACILITATOR_TOKENMPP_CHALLENGE_SECRETLOG_LEVEL- Config files
config.example.yamlconfig-demo.yaml.env.exampledocker-compose.ymlexamples/simple-paid-api/config.yamlexamples/paid-mcp-tool/config.yamlexamples/acp-checkout/examples/base-sepolia/examples/base-mainnet/- Prompt files
- none
- Accounts you need
- A wallet address to receive paymentsA remote facilitator on public networks, such as x402.org; a Coinbase CDP account only when facilitator.auth.type is cdp
Source
- github.com/devlab-group/agent-commerce
- Apache-2.0 license
- Last commit Nov 2, 2026
- 70 stars
Operable: what an agent can drive
Interface
OfficialMCP serverpublished by the builderlocal
How an agent can drive an Operable Listing, in five levels: native (built for the agent as the primary interface), official (the Builder ships an agent interface), wrapped (a third party wraps the software's API), config (an agent can only drive it by editing files), gui (screen control only). An interface is official only when it is published by the same organization that ships the software. GUI-level Listings are allowed and sorted last.
A2A Protocol
Experimentalpublished by the builder
- Role
- Other agents can call it
- Version
- 1.0
- Bindings
- JSONRPC
- Agent Card
/.well-known/agent-card.jsonon each deployment- Source
- github.com/devlab-group/agent-commerce/blob/master/docs/protocols/a2a.mdsrc/protocols/a2a/constants.ts pins binding JSONRPC and negotiation version 1.0 (spec revision 1.0.1), src/gateway/run.ts registers the adapter when protocols.a2a.enabled is true, tests/conformance/a2a drives it with the official @a2a-js/sdk, and that SDK is a dev dependency only, with no outbound A2A client in src/.
Reach describes the interface above, not A2A.
Reach
Partial coverage. 4 of 10 jobs reachable through the stated interface.
| Job | Through the interface | Evidence |
|---|---|---|
| Expose API endpoints as tools agents can discover and call | Reachable | docs/protocols/mcp.md: resources with expose: [mcp] become MCP tools named by resource id, listed through tools/list |
| Charge for a tool with x402 and deliver after settlement | Reachable | docs/protocols/mcp.md: an unpaid call returns the x402 v2 PaymentRequired; the proof goes in _payment or _meta["x402/payment"] |
| Charge for a tool with MPP | Reachable | docs/protocols/mcp.md lists the MPP challenge, credential and receipt carriers; README labels MPP experimental and off by default |
| Require an AP2 mandate before a paid resource settles | Reachable | docs/protocols/mcp.md: the tool schema gains an optional _authorization object; README labels AP2 experimental and off by default |
| Serve the same resources to other agents over A2A | Not reachable | A separate adapter at /a2a in src/protocols/a2a, not part of the MCP endpoint; see the a2a field |
| Run ACP checkout operations | Not reachable | config.example.yaml: ACP serves REST routes under /acp with a bearer token, and the ACP MCP binding is not implemented |
| Generate resource definitions from an OpenAPI document | Not reachable | CLI only: agent-commerce import openapi in src/cli/commands/import-openapi.ts; the MCP adapter has no such tool |
| Read receipts and the payment ledger | Not reachable | README: /api/receipts, /api/events and /api/payment-attempts are operator HTTP routes behind server.adminToken; the MCP adapter serves only resource tools |
| Check a deployment's health and settlement terms | Not reachable | CLI only: agent-commerce doctor in src/cli/commands/doctor |
| Reconcile and resolve uncertain payments | Not reachable | agent-commerce reconcile and resolve in the CLI, plus POST /api/payment-attempts/:id/resolve over HTTP; nothing over MCP |
Code stack
- Languages
- TypeScript
- Frameworks
- Fastify
- Package manager
- npm
- Database
- SQLite
- Hosting target
- DockerNode.js 22 or later
- Built
- Unknown (recorded, never ranked)
Skills
One skill, labeled experimental by the Builder, that puts the gateway in front of an API on Base Sepolia using the init, validate, start and doctor commands. It leaves secrets, prices and payment signing to the user.
- Kind
- bundled
- Paths
skills/agent-commerce/SKILL.md.claude-plugin/- Install
npx skills add devlab-group/agent-commerce --skill agent-commerce
Evidence and confidence
| Field | Where it was seen | Confidence |
|---|---|---|
| formFactor | A Fastify server you run as a separate process (src/gateway/run.ts, agent-commerce start); the dashboard lives under demo/ and is not part of the package | 90% |
| executionModel | package.json dependencies include no model provider; the gateway validates, charges and proxies requests with no model at runtime | 95% |
| operability | docs/protocols/mcp.md and src/protocols/mcp are published by devlab-group, the org that ships the gateway; README marks MCP Supported | 70% |
| effort | config.example.yaml resources block sets price, exposure and payment rail; docs/configuration.md is the reference; .env.example names the deployment variables | 90% |
| editions | LICENSE and GitHub API report Apache-2.0; acg.devlab.group offers 'Managed by DEVLAB' as a service with no published price | 80% |
| active | GitHub API: default-branch commit 2026-11-02 (b1fd31f, release 2.6.0); npm shows 2.6.0; 70 stars, 4 forks; issues and pull requests from outside accounts such as #25 and #26 | – |
| provenance | One of the last 100 commits carries a Cursor Agent co-author trailer and the repo has no agent instruction files; that is not enough to classify it | – |
| a2aRole | No A2A client in src/; a search for A2AClient, a2a-js and agent-card.json finds only the server adapter, config and tests | – |
| reach | 80% |
Open questions
- Is mcp the right stated interface? It serves buying agents. An Adopter's own agent configures and runs the gateway through the CLI and the bundled skill, which would reach the last four jobs in the Reach list but not the buying jobs
- Operability is set to official because MCP is one of several adapters the Builder publishes; native is arguable, since the gateway has no product UI and exists to serve agents
- Reach and A2A were read from docs and source; the gateway was not run and no live Agent Card was fetched, and each deployment serves its own card
- Provenance could not be determined from the repo
- Managed by DEVLAB has no public price or scope beyond the homepage; the Builder asks buyers to get in touch
- No commercial product is named as a replacement by the Builder, so alternativeTo is empty
- Filed under agent-infrastructure because it is a gateway (adr/0012). It sells API access to paying agents, so ecommerce is a fair second reading
Sources
- github.com/devlab-group/agent-commerce sourcing:ecommerce:a2a-topic
- acg.devlab.group analysis:ecommerce
- github.com/devlab-group/agent-commerce/blob/master/docs/protocols/a2a.md analysis:ecommerce