# Agent Commerce Gateway

Self-hosted gateway that lets AI agents discover, call and pay for your existing HTTP API.

A TypeScript gateway you run in front of an API you already have. You describe each endpoint and its price in YAML, and the gateway exposes it over HTTP, MCP or experimental A2A, charging with x402 or experimental MPP. The Builder describes it as non-custodial: payments go straight to the merchant wallet and the gateway holds neither the buyer's nor the merchant's private key. It sells API calls, not goods, and has no storefront.

- Capabilities: adaptable, operable
- Vertical: agent-infrastructure
- Shape: product
- Form factor: api
- Execution model: deterministic
- Provenance: unknown (recorded, never ranked)
- Repo: https://github.com/devlab-group/agent-commerce (Apache-2.0), 70 stars, last commit 2026-11-02
- Last activity: 2026-11-02
- Page: apps/devlab-group--agent-commerce.html
- JSON: apps/devlab-group--agent-commerce.json

## Use it when

- I already run an HTTP API and want agents to pay per call in USDC without adding payment code to my backend
- I want one config file to publish the same endpoints as MCP tools and as an A2A agent
- I want payments to land in my own wallet instead of a platform balance

## Gotchas

- A2A, ACP, MPP and AP2 are experimental, off by default, and may break in minor releases; the README says to pin an exact version
- A2A is a subset: synchronous SendMessage with one structured data part, with no streaming, push, REST or gRPC binding, or A2A authentication
- Agent routes are unauthenticated by design and there is no rate limiting, so a free resource is an open proxy to your backend; put quotas in your API or at the edge
- Fixed prices only: pricing.type dynamic is rejected at config load
- Receipts live in SQLite; PostgreSQL is on the roadmap, so a shared store across instances is not available out of the box
- One payment rail serves each resource; a buyer cannot choose between rails per request
- MCP, x402 and AP2 need optional peer packages pinned to exact versions; a missing peer stops the gateway or fails its health checks
- Use the scoped package @devlab.group/agent-commerce; the skill warns that an unrelated npm package is named agent-commerce
- Public-network settlement suites do not run in CI; they run by hand from a funded wallet

## Editions

- Self-hosted: Free, open source
  - source: https://github.com/devlab-group/agent-commerce
  - installable: npm install -g @devlab.group/agent-commerce
- Managed by DEVLAB: Free, closed source
  - hosted: https://acg.devlab.group

## Adaptable: make it yours

Effort: config-only (23 things to edit)

Copy config.example.yaml to config.yaml or run agent-commerce init. The resources block sets business behavior: which backend endpoints are sold, the price of each, which protocols expose it, and which payment rail it takes. The merchant, payments and protocols blocks set the merchant identity, wallet, network and enabled adapters. ${VAR} placeholders in the YAML read from the environment, so the env vars below are mostly deployment values. agent-commerce import openapi drafts the resources block from an OpenAPI file.

- Env vars: AGENT_COMMERCE_CONFIG, GATEWAY_PUBLIC_BASE_URL, GATEWAY_PORT, ADMIN_TOKEN, DASHBOARD_ORIGIN, MERCHANT_API_BASE_URL, MERCHANT_WALLET, RECEIPT_STORE_PATH, X402_NETWORK, X402_RPC_URL, X402_FACILITATOR_URL, X402_FACILITATOR_TOKEN, MPP_CHALLENGE_SECRET, LOG_LEVEL
- Config files: config.example.yaml, config-demo.yaml, .env.example, docker-compose.yml, examples/simple-paid-api/config.yaml, examples/paid-mcp-tool/config.yaml, examples/acp-checkout/, examples/base-sepolia/, examples/base-mainnet/
- Prompt files: none
- Accounts you'll need: A wallet address to receive payments; A remote facilitator on public networks, such as x402.org; a Coinbase CDP account only when facilitator.auth.type is cdp

## Operable: what an agent can drive

Operability: official. Interface: mcp at https://github.com/devlab-group/agent-commerce/blob/master/docs/protocols/mcp.md (published by the builder, local).

### Reach (partial coverage)

- Expose API endpoints as tools agents can discover and call: reachable. docs/protocols/mcp.md: resources with expose: [mcp] become MCP tools named by resource id, listed through tools/list
- Charge for a tool with x402 and deliver after settlement: reachable. docs/protocols/mcp.md: an unpaid call returns the x402 v2 PaymentRequired; the proof goes in _payment or _meta["x402/payment"]
- Charge for a tool with MPP: reachable. docs/protocols/mcp.md lists the MPP challenge, credential and receipt carriers; README labels MPP experimental and off by default
- Require an AP2 mandate before a paid resource settles: reachable. docs/protocols/mcp.md: the tool schema gains an optional _authorization object; README labels AP2 experimental and off by default
- Serve the same resources to other agents over A2A: not reachable. A separate adapter at /a2a in src/protocols/a2a, not part of the MCP endpoint; see the a2a field
- Run ACP checkout operations: not reachable. config.example.yaml: ACP serves REST routes under /acp with a bearer token, and the ACP MCP binding is not implemented
- Generate resource definitions from an OpenAPI document: not reachable. CLI only: agent-commerce import openapi in src/cli/commands/import-openapi.ts; the MCP adapter has no such tool
- Read receipts and the payment ledger: not reachable. README: /api/receipts, /api/events and /api/payment-attempts are operator HTTP routes behind server.adminToken; the MCP adapter serves only resource tools
- Check a deployment's health and settlement terms: not reachable. CLI only: agent-commerce doctor in src/cli/commands/doctor
- Reconcile and resolve uncertain payments: not reachable. agent-commerce reconcile and resolve in the CLI, plus POST /api/payment-attempts/:id/resolve over HTTP; nothing over MCP

## A2A Protocol

Role: server (other agents can call it). Status: experimental. Version: 1.0. Bindings: JSONRPC.
Agent Card: /.well-known/agent-card.json on each deployment. Source: https://github.com/devlab-group/agent-commerce/blob/master/docs/protocols/a2a.md (published by the builder). src/protocols/a2a/constants.ts pins binding JSONRPC and negotiation version 1.0 (spec revision 1.0.1), src/gateway/run.ts registers the adapter when protocols.a2a.enabled is true, tests/conformance/a2a drives it with the official @a2a-js/sdk, and that SDK is a dev dependency only, with no outbound A2A client in src/.

Reach describes the stated interface, not A2A.

## Code stack

- Languages: TypeScript
- Frameworks: Fastify
- Package manager: npm
- Database: SQLite
- Hosting target: Docker, Node.js 22 or later

## Skills

bundled: One skill, labeled experimental by the Builder, that puts the gateway in front of an API on Base Sepolia using the init, validate, start and doctor commands. It leaves secrets, prices and payment signing to the user.
- Paths: skills/agent-commerce/SKILL.md, .claude-plugin/
- Install: npx skills add devlab-group/agent-commerce --skill agent-commerce

## Evidence and confidence

- formFactor: A Fastify server you run as a separate process (src/gateway/run.ts, agent-commerce start); the dashboard lives under demo/ and is not part of the package (confidence 0.9)
- executionModel: package.json dependencies include no model provider; the gateway validates, charges and proxies requests with no model at runtime (confidence 0.95)
- operability: docs/protocols/mcp.md and src/protocols/mcp are published by devlab-group, the org that ships the gateway; README marks MCP Supported (confidence 0.7)
- effort: config.example.yaml resources block sets price, exposure and payment rail; docs/configuration.md is the reference; .env.example names the deployment variables (confidence 0.9)
- editions: LICENSE and GitHub API report Apache-2.0; acg.devlab.group offers 'Managed by DEVLAB' as a service with no published price (confidence 0.8)
- active: GitHub API: default-branch commit 2026-11-02 (b1fd31f, release 2.6.0); npm shows 2.6.0; 70 stars, 4 forks; issues and pull requests from outside accounts such as #25 and #26
- provenance: One of the last 100 commits carries a Cursor Agent co-author trailer and the repo has no agent instruction files; that is not enough to classify it
- a2aRole: No A2A client in src/; a search for A2AClient, a2a-js and agent-card.json finds only the server adapter, config and tests
- reach:  (confidence 0.8)

## Open questions

- Is mcp the right stated interface? It serves buying agents. An Adopter's own agent configures and runs the gateway through the CLI and the bundled skill, which would reach the last four jobs in the Reach list but not the buying jobs
- Operability is set to official because MCP is one of several adapters the Builder publishes; native is arguable, since the gateway has no product UI and exists to serve agents
- Reach and A2A were read from docs and source; the gateway was not run and no live Agent Card was fetched, and each deployment serves its own card
- Provenance could not be determined from the repo
- Managed by DEVLAB has no public price or scope beyond the homepage; the Builder asks buyers to get in touch
- No commercial product is named as a replacement by the Builder, so alternativeTo is empty
- Filed under agent-infrastructure because it is a gateway (adr/0012). It sells API access to paying agents, so ecommerce is a fair second reading

## Sources

- https://github.com/devlab-group/agent-commerce (sourcing:ecommerce:a2a-topic)
- https://acg.devlab.group (analysis:ecommerce)
- https://github.com/devlab-group/agent-commerce/blob/master/docs/protocols/a2a.md (analysis:ecommerce)