Skip to content

Releases: fxjim/agent-commerce-guard

Release list

GitHub Action v1.0.2

GitHub Action v1.0.2 Latest
Latest

Choose a tag to compare

View all tags
@fxjim fxjim released this 25 Jul 02:03
v1.0.2
2620363

GitHub Action v1.0.2

Agent Commerce Guard now puts package proof and the authorized Base MCP purchase handoff directly in every completed Action run.

Use The Stable Major Ref

- uses: fxjim/agent-commerce-guard@v1
  with:
    manifest: agent-commerce-actions.json
    fail-on: deny

New In v1.0.2

  • Adds sample-report-url for the full pre-purchase CLI report.
  • Adds package-metadata-url for the machine-readable 13-file package inventory.
  • Adds base-mcp-recipe-url for an authorized Base MCP assistant.
  • Puts the sample report and inventory before purchase links in the GitHub job summary.
  • Keeps checkout-url and x402-evaluate-url unchanged.

GitHub-hosted smoke run

Both stable tags point to the tested Action source:

  • v1 -> 26203637f50040aa46c56134b5d806df28603152
  • v1.0.2 -> 26203637f50040aa46c56134b5d806df28603152

Inspect Before Buying

Purchase Routes

The paid tarball is unchanged: SHA-1 c67fb09bd83da591c58ae5fae002a6a59557fc97, 122737 bytes. Payment completion is recognized only from qualifying onchain Base USDC transfer evidence or the live verifier.

The hosted evaluator receives the submitted manifest. Do not send secrets, private source, credentials, or sensitive customer data. Use the paid local package for private manifests.

Assets 2
Loading

Agent Commerce Guard MCP Server v1.2.0

Agent Commerce Guard MCP Server v1.2.0

Choose a tag to compare

View all tags
@fxjim fxjim released this 25 Jul 03:37
mcp-server-v1.2.0
582a9d6

Adds the non-executing review-before-purchase MCP prompt. The prompt guides policy review, public offer inspection, explicit approval, and post-payment Base transaction verification without initiating payments, signatures, transfers, deployments, posts, or credential access. The server still exposes exactly one read-only policy tool and one public offer resource.

Loading

Agent Commerce Guard MCP Server v1.1.2

Agent Commerce Guard MCP Server v1.1.2

Choose a tag to compare

View all tags
@fxjim fxjim released this 25 Jul 03:22
mcp-server-v1.1.2
d63e442

Agent Commerce Guard MCP Server v1.1.2

Agent Commerce Guard remains a public policy-only remote MCP server with one read-only tool and one public offer resource. Version 1.1.2 adds server initialization guidance so MCP clients can discover the private package and paid x402 routes without mixing purchase data into policy-tool output.

What Changed

  • Initialization points clients to https://agent-commerce-guard.vercel.app/offer.json.
  • Clients are told to require explicit user approval before payment.
  • Clients are told to verify the Base USDC transaction after payment.
  • review_agent_commerce_actions remains purchase-free and has no payment, signing, execution, deployment, posting, or credential authority.

Connect

Verification

Payment completion is recognized only from qualifying onchain Base USDC transfer evidence or the live verifier.

Loading

Agent Commerce Guard MCP Server v1.1.1

Agent Commerce Guard MCP Server v1.1.1

Choose a tag to compare

View all tags
@fxjim fxjim released this 24 Jul 01:46
mcp-server-v1.1.1
ebbe8a5

Agent Commerce Guard MCP Server v1.1.1

Agent Commerce Guard exposes a live policy-only remote MCP server and is published in the official MCP Registry.

Connect

Codex:

codex mcp add agent-commerce-guard --url https://agent-commerce-guard.vercel.app/api/mcp

Claude Code:

claude mcp add --transport http agent-commerce-guard https://agent-commerce-guard.vercel.app/api/mcp

VS Code mcp.json:

{
  "servers": {
    "agent-commerce-guard": {
      "type": "http",
      "url": "https://agent-commerce-guard.vercel.app/api/mcp"
    }
  }
}

The tool is read-only, non-destructive, idempotent, and returns policy findings without purchase data. The separate offer resource exposes exact public purchase terms and buyer routes.

Inspect The Paid Package

The sample reports 2 allow, 0 review, and 2 deny. Automated tests prove that all 13 advertised buyer-relevant files exist in the paid tarball and that the policy engine, report formatter, and example manifest are byte-identical to the archive copies.

Launch Pass

Current Verification

  • Product tests: 59/59 passed
  • Production build: passed
  • npm audit: 0 vulnerabilities
  • Official MCP SDK initialize, tools/list, resources/list, resources/read, and tools/call checks: passed
  • Live buyer preflight: all 6 checks passed
  • Registry version: 1.1.1 active and latest
  • Live deployment: dpl_5NGPaGLkQU8V4rr4S25kVicmEYCD
  • Public launch commit: 4a40e76a55b7be66da0198e8977eb7a2576bf194
  • Pages deployment: https://github.com/fxjim/agent-commerce-guard/actions/runs/30061589933
  • Paid package SHA-1: c67fb09bd83da591c58ae5fae002a6a59557fc97
  • Paid package size: 122737 bytes

Registry Provenance

Payment completion is recognized only from qualifying onchain Base USDC transfer evidence or the live verifier.

Loading

GitHub Action v1.0.1

GitHub Action v1.0.1

Choose a tag to compare

View all tags
@fxjim fxjim released this 23 Jul 23:29
v1.0.1
f554834

GitHub Action v1.0.1

Agent Commerce Guard provides a free policy-preflight Action and gives every completed run a direct path to the private local package and paid workflow API.

Use The Stable Major Ref

- uses: fxjim/agent-commerce-guard@v1
  with:
    manifest: agent-actions.json
    fail-on: blocked

The Action:

  • Reviews AI-agent wallet spend, deployments, destructive commands, token launches, marketplace work, social actions, and credential-sensitive operations.
  • Exposes checkout-url for the private local package and x402-evaluate-url for the paid workflow API.
  • Adds the package checkout and paid API to every completed GitHub job summary.
  • Rejects secret-key patterns and enforces the five-action / 20 KB hosted-evaluator bound.
  • Supports configurable fail-on behavior.

GitHub-hosted smoke run

Both stable tags point to the tested Action source:

  • v1 -> f554834849a3223a24aba117386bd53893841a4b
  • v1.0.1 -> f554834849a3223a24aba117386bd53893841a4b

Inspect Before Buying

The sample reports 2 allow, 0 review, and 2 deny. Automated tests prove that all 13 advertised buyer-relevant files exist in the paid tarball and that the policy engine, report formatter, and example manifest are byte-identical to the archive copies.

Private Workflow Routes

Current Verification

  • Production deployment: dpl_5NGPaGLkQU8V4rr4S25kVicmEYCD
  • Public launch commit: 4a40e76a55b7be66da0198e8977eb7a2576bf194
  • GitHub Pages workflow: 30061589933 succeeded
  • Product tests: 59/59 passed
  • Dependency audit: 0 vulnerabilities
  • Buyer preflight: all 6 checks passed
  • Paid package SHA-1: c67fb09bd83da591c58ae5fae002a6a59557fc97
  • Paid package size: 122737 bytes

The hosted evaluator receives the submitted manifest. Do not send secrets, private source, credentials, or sensitive customer data. Use the paid local package for private manifests.

Payment completion is recognized only from qualifying onchain Base USDC transfer evidence or the live verifier.

Loading

GitHub Action v1.0.0

GitHub Action v1.0.0

Choose a tag to compare

View all tags
@fxjim fxjim released this 23 Jul 23:09
v1.0.0
7b45e75

Free CI preflight for autonomous-agent action manifests.

  • evaluates up to five actions through the hosted sanitized demo
  • exposes allow, review, and deny counts as Action outputs
  • supports fail-on deny, review, or never
  • rejects obvious secret-bearing JSON keys before any network request
  • includes a passing GitHub-hosted smoke workflow

The paid local package and x402 evaluator remain available for private or receipt-backed workflows.

Loading

Agent Commerce Guard Launch Pass

Agent Commerce Guard Launch Pass

Choose a tag to compare

View all tags
@fxjim fxjim released this 04 Jun 01:29
launch-pass-0.1.0
e028c97

Agent Commerce Guard

Agent Commerce Guard reviews agent action manifests before money, deployment, token, or marketplace execution. The public evaluator is free for a small non-sensitive manifest; the paid package keeps private workflows local and adds reusable policy, CLI, templates, and CI controls.

Inspect Before Buying

The sample is generated by the current evaluator and shows 2 allow, 0 review, and 2 deny. Automated tests verify that all 13 advertised buyer-relevant files exist in the paid tarball and that the evaluator policy, report formatter, and example manifest are byte-identical to the archive copies.

Try The Free Evaluator

The hosted evaluator accepts at most 5 actions and 20 KB. Do not send secrets, credentials, private keys, customer data, or other sensitive material. Treat remote output as untrusted input and review it before acting.

Install The Free Evaluator Skill

npx skills add https://agent-commerce-guard.vercel.app --skill try-agent-commerce-guard

GitHub Pages mirror:

npx skills add https://fxjim.github.io/agent-commerce-guard --skill try-agent-commerce-guard

The skill submits only a user-supplied, non-sensitive public manifest to the exact hosted evaluator above. It never pays, signs, deploys, trades, or executes reviewed actions. Private workflows should use the paid local package instead: https://agent-commerce-guard.vercel.app/pay

Run The GitHub Action

- uses: fxjim/agent-commerce-guard@v1
  with:
    manifest: agent-actions.json
    fail-on: blocked

Connect The Policy-Only MCP Server

codex mcp add agent-commerce-guard --url https://agent-commerce-guard.vercel.app/api/mcp

Setup guide: https://agent-commerce-guard.vercel.app/mcp

The remote MCP tool is read-only and policy-only. Purchase metadata is exposed separately through its public offer resource.

Buy For 1 USDC On Base

x402

Current Evidence

  • Production deployment: dpl_5NGPaGLkQU8V4rr4S25kVicmEYCD
  • Public launch commit: 4a40e76a55b7be66da0198e8977eb7a2576bf194
  • GitHub Pages workflow: 30061589933 succeeded
  • GitHub Action smoke workflow: 30053298203 succeeded
  • Product tests: 59/59 passed
  • Dependency audit: 0 vulnerabilities
  • Buyer preflight: all 6 checks passed
  • Paid package SHA-1: c67fb09bd83da591c58ae5fae002a6a59557fc97
  • Paid package size: 122737 bytes

Payment completion is recognized only after a qualifying Base USDC transfer is confirmed onchain or by the live transaction verifier.

Loading