{ "data": { "similar": [ { "grade": "B", "json": "https://www.anchorterminal.com/tools/shop-mcp.json", "name": "Shop MCP", "score": 65.9, "shared": [ "shopping.search", "shopping.prices", "commerce.cart", "commerce.checkout", "shopping.orders" ], "slug": "shop-mcp" }, { "grade": "F", "json": "https://www.anchorterminal.com/tools/walmart-agent-gateway.json", "name": "Walmart Agent Gateway", "score": 8.5, "shared": [ "shopping.orders", "shopping.search", "shopping.prices" ], "slug": "walmart-agent-gateway" }, { "grade": "BB", "json": "https://www.anchorterminal.com/tools/shopify.json", "name": "Shopify API + MCP", "score": 77, "shared": [ "commerce.cart", "commerce.checkout" ], "slug": "shopify" }, { "grade": "BB", "json": "https://www.anchorterminal.com/tools/woocommerce.json", "name": "WooCommerce API + MCP", "score": 73, "shared": [ "commerce.cart", "commerce.checkout" ], "slug": "woocommerce" }, { "grade": "BB", "json": "https://www.anchorterminal.com/tools/shopware.json", "name": "Shopware", "score": 71.6, "shared": [ "commerce.cart", "commerce.checkout" ], "slug": "shopware" }, { "grade": "BB", "json": "https://www.anchorterminal.com/tools/commercetools.json", "name": "commercetools", "score": 71.4, "shared": [ "commerce.cart", "commerce.checkout" ], "slug": "commercetools" } ], "tool": { "slug": "opencommerce", "name": "opencommerce", "vendor": "Agentcard", "vendorUrl": "https://opencommerce.sh", "kind": "sdk", "category": "shopping", "summary": "opencommerce is Agentcard's Commerce SDK, a TypeScript package that gives an agent one `buy` tool. Agentcard searches stores, builds the cart and places the order after the shopper approves payment with a card saved in Agentcard's Vault.", "url": "https://www.anchorterminal.com/tools/opencommerce", "markdownUrl": "https://www.anchorterminal.com/tools/opencommerce.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/opencommerce.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/opencommerce.json", "license": "Proprietary. `@agent-cards/commerce-sdk` and the `agent-cards` CLI ship a licence of Agentcard Corporation that allows running them only to use Agentcard's services and forbids copying, reverse engineering and benchmarking a competing product. The repository they name is private", "transports": [ "http" ], "remoteUrl": "https://api.agentcard.sh", "packages": [ { "registry": "npm", "name": "@agent-cards/commerce-sdk" }, { "registry": "npm", "name": "agent-cards" } ], "auth": "oauth", "authNotes": "Company client credentials. `AgentcardClient` exchanges a client ID and secret for a platform token that lasts one hour and renews it a minute before expiry. Sandbox and production use separate credentials on one host. A buy tool can instead carry one shopper's own Agentcard access token. Each shopper connects through a Vault link and approves payments with a passkey. The CLI README says sign-ups are by invitation (https://docs.agentcard.com/api-reference/commerce-sdk/agentcard-client.md, checked 2026-10-30).", "pricing": "usage", "pricingNotes": "Standard is 1 per cent of each completed order, charged to the integrating company from a prefunded balance or a saved card, with no API access. Enterprise adds API access at custom fees. Sandbox purchases are never billed (https://opencommerce.sh/#pricing, https://docs.agentcard.com/commerce-sdk/quickstart.md, checked 2026-10-30).", "priceSummary": "1% fee", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the Commerce SDK docs, the package or the opencommerce.sh pricing. Purchases are paid with the shopper's card from Agentcard's Vault, and agentcard.com's FAQ answers Not yet on x402, AP2 and other agent payment protocols (https://agentcard.com/, checked 2026-10-30).", "endpoints": [] }, "toolCount": 1, "popularity": { "githubStars": null, "npmWeekly": 2716, "pypiWeekly": null, "asOf": "2026-10-30" }, "docsUrl": "https://docs.agentcard.com/commerce-sdk/quickstart", "llmsTxt": "https://opencommerce.sh/llms.txt", "capabilities": [ "shopping.search", "shopping.orders", "shopping.prices", "commerce.cart", "commerce.checkout", "shopping.returns" ], "tags": [ "hosted", "closed-source", "sdk", "typescript", "oauth", "sandbox", "webhooks", "llms-txt", "approvals", "pre-1.0", "new", "cli" ], "lastRelease": "2026-10-30", "graded": true, "anchor": { "graded": true, "score": 62, "grade": "B", "agentReady": false, "rank": 528, "ranked": true, "rankOf": 1239, "categoryRank": 3, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 69, "maintenance": 75, "payments": 40, "reliability": 43, "schema": 81, "security": 68, "transparency": 63 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 43, "points": 8.6, "reason": "Read with the hosted lines, since the SDK is a client and every purchase runs at api.agentcard.sh. The footer's Status link opens monitoring.opencommerce.sh, the vendor's own page of per-merchant test results with a day-by-day history. It has no component for Agentcard's API and reports tests rather than availability (10 of 20). Its data on 30 October 2026 held results from 23 to 30 October only, all passing, so there is no readable incident record for 90 days (5 of 30). The only rate limit with numbers is 30 requests per 5 minutes per IP on the token endpoint. `GET /buy/merchants` caps a page at 100 entries (5 of 15). The client sends each purchase turn once, the docs say to read the conversation after a timeout before resending, a cart hash refuses a confirm on a changed cart, and `cart_busy` says to try again in a moment. No 429 or `Retry-After` is documented (10 of 15). Agentcard's Order Form Terms (21 September 2026) promise 99.9 per cent monthly availability, excluding weekends, holidays and maintenance, with 5 per cent service credits, for customers on an order form. opencommerce.sh's plans name no SLA, and whether Standard customers sign an order form is not stated (5 of 10). No beta label, but the SDK is 0.18.6 and first shipped on 16 October 2026 (8 of 10). Total 43.", "checked": "2026-10-30" }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 81, "points": 13.16, "reason": "The buy tool's input is a strict JSON Schema with five required fields and `additionalProperties` false, and the package ships TypeScript declarations. The purchase endpoints under it are missing from the OpenAPI file at docs.agentcard.com/openapi.json, which holds 18 operations for tokens, connections, identity checks and cards (20 of 25). llms.txt on opencommerce.sh and on docs.agentcard.com, with a Markdown twin for each docs page (10 of 10). The description's 57 rules say when to call the tool, when to set `confirm` and what each answer means, such as \"Show the shopper the cart before you confirm it\" (18 of 20). Two booleans and two nullable ids, but the main input `ask` is free text (9 of 15). Code for Anthropic, Vercel AI SDK, OpenAI and OpenRouter, a sandbox walkthrough script, error tables with what to do next and captured error bodies (14 of 15). npm versions follow 0.x semver, and Agentcard's changelog is dated almost daily, newest 27 October 2026, but it covers every Agentcard product and the SDK has no changelog of its own (10 of 15). Total 81.", "checked": "2026-10-30" }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 69, "points": 11.21, "reason": "One tool, inside the band for ten or fewer, but its description is 57 rules and about 14,500 characters, and the docs also recommend Agentcard's `appInstructions()` system prompt. Answers are capped at eight product and eight store cards and stripped of links for the model. Ten less than the band for the description's size, two back for the capped answers, a departure from the checklist (17 of 25). The buy tool has no page or filter controls, and `storeWaitMs` sets how long a reply waits. `GET /buy/merchants` has `q`, `kind`, `limit` up to 100 and a cursor (12 of 20). `AgentcardApiError` codes each come with what to do next, `decline_code` and `error_code` are machine-readable, and input outside the schema is refused with a message the model can act on (18 of 20). No idempotency key on a purchase turn. The client never resends a turn except once after a 401, a cart hash guards confirms, order events carry an `order_id` to reconcile on, and the MCP `buy` tool is documented as destructive (14 of 20). The model fills five simple fields, but the SDK is TypeScript only, for Node 18 or later and the browser (8 of 15). Total 69.", "checked": "2026-10-30" }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 68, "points": 11.9, "reason": "OAuth client credentials exchanged for a one-hour platform token, separate sandbox and production clients, and a per-shopper access token as an alternative. Agentcard's platform tokens carry the single scope `api`, per the agentcard listing, and `init` writes production credentials to the env file by default (22 of 30). Every payment not covered by an auto-approval rule needs the shopper's passkey, the docs say neither the app nor the model approves for the shopper, and the model cannot change the shopper or address. `init` runs Agentcard's coding agent with permissions bypassed and unsandboxed commands, which the docs disclose. Two less for that (15 of 20). Answers carry store and product text, links are stripped before the model reads them, and preset rules ignore merchant text an agent sends, but no guidance naming untrusted content or prompt injection was found (10 of 15). Order and purchase events by webhook or stream, with logged deliveries and stored approval records of who, when and where (11 of 15). agentcard.com serves a valid security.txt, the Vault Enterprise plan lists a SOC 2 report and pen-test summary, and the Trust Centre was not read. No bug bounty or disclosure policy found (10 of 20). Total 68.", "checked": "2026-10-30" }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 40, "points": 5, "reason": "No x402, MPP or L402. Purchases are paid with the shopper's card from the Vault, and agentcard.com's FAQ answers Not yet on agent payment protocols (0 of 40). 1 per cent of each completed order is published on opencommerce.sh without a login (20 of 20). Sandbox credentials run the whole flow, stop before payment and are never billed, with no card needed (20 of 20). A person signs in through app.agentcard.sh or an emailed code, and since 27 October 2026 the CLI says sign-ups are by invitation (0 of 20). Total 40.", "checked": "2026-10-30" }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 75, "points": 6.56, "reason": "`@agent-cards/commerce-sdk` 0.18.6 was published on 30 October 2026 (30 of 30). 19 versions since 16 October 2026 (20 of 20). Closed service. Agentcard's changelog is dated almost daily, newest 27 October, and support runs through `agent-cards support` chat and support@agentcard.sh. Neither was tested (10 of 15). The TypeScript SDK is current, with no SDK in a second language (10 of 15). The SDK has no dependencies. The CLI has 10, among them PostHog and the Claude Agent SDK, needs Node 22, and its repository is private, so CI isn't visible (5 of 10). The product is two weeks old. Total 75.", "checked": "2026-10-30" }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 63, "points": 5.51, "note": "editorial 42, provenance 83", "reason": "Closed. The packages' licence allows running them only to use Agentcard's services and forbids benchmarking a competing product. The terms of use (10 July 2026) name Agentcard Corporation and cover the API, MCP server and CLI, but not the Commerce SDK or its 1 per cent fee, and the opencommerce.sh footer names Agentcard, Inc. (12 of 30). Agentcard's own privacy policy (21 October 2026) covers orders, delivery addresses, store accounts it links or creates with their encrypted sign-ins, a one-time card credential held at most 45 minutes, and session recordings of what is typed into dashboard forms. Retention is as long as the account is active, with no periods and no public DPA (14 of 30). No deprecation policy. The SDK keeps deprecated names with notes, such as `toAnthropicTool` and `ackFor`, and the changelog marks one breaking change of 10 September 2026 (6 of 20). The privacy policy names Crossmint, Coinbase, Third National, Sumsub, Visa and Stripe and the kinds of other providers, with transfers to the United States. The CLI's PostHog telemetry honours DO_NOT_TRACK and AGENT_CARDS_TELEMETRY, found in its code (10 of 20). Total 42.", "checked": "2026-10-30" } ], "assessment": { "date": "2026-10-30", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "One tool, inside the band for ten or fewer, but its description is 57 rules and about 14,500 characters, and the docs also recommend Agentcard's `appInstructions()` system prompt. Answers are capped at eight product and eight store cards and stripped of links for the model. Ten less than the band for the description's size, two back for the capped answers, a departure from the checklist (17 of 25). The buy tool has no page or filter controls, and `storeWaitMs` sets how long a reply waits. `GET /buy/merchants` has `q`, `kind`, `limit` up to 100 and a cursor (12 of 20). `AgentcardApiError` codes each come with what to do next, `decline_code` and `error_code` are machine-readable, and input outside the schema is refused with a message the model can act on (18 of 20). No idempotency key on a purchase turn. The client never resends a turn except once after a 401, a cart hash guards confirms, order events carry an `order_id` to reconcile on, and the MCP `buy` tool is documented as destructive (14 of 20). The model fills five simple fields, but the SDK is TypeScript only, for Node 18 or later and the browser (8 of 15). Total 69.", "maintenance": "`@agent-cards/commerce-sdk` 0.18.6 was published on 30 October 2026 (30 of 30). 19 versions since 16 October 2026 (20 of 20). Closed service. Agentcard's changelog is dated almost daily, newest 27 October, and support runs through `agent-cards support` chat and support@agentcard.sh. Neither was tested (10 of 15). The TypeScript SDK is current, with no SDK in a second language (10 of 15). The SDK has no dependencies. The CLI has 10, among them PostHog and the Claude Agent SDK, needs Node 22, and its repository is private, so CI isn't visible (5 of 10). The product is two weeks old. Total 75.", "payments": "No x402, MPP or L402. Purchases are paid with the shopper's card from the Vault, and agentcard.com's FAQ answers Not yet on agent payment protocols (0 of 40). 1 per cent of each completed order is published on opencommerce.sh without a login (20 of 20). Sandbox credentials run the whole flow, stop before payment and are never billed, with no card needed (20 of 20). A person signs in through app.agentcard.sh or an emailed code, and since 27 October 2026 the CLI says sign-ups are by invitation (0 of 20). Total 40.", "reliability": "Read with the hosted lines, since the SDK is a client and every purchase runs at api.agentcard.sh. The footer's Status link opens monitoring.opencommerce.sh, the vendor's own page of per-merchant test results with a day-by-day history. It has no component for Agentcard's API and reports tests rather than availability (10 of 20). Its data on 30 October 2026 held results from 23 to 30 October only, all passing, so there is no readable incident record for 90 days (5 of 30). The only rate limit with numbers is 30 requests per 5 minutes per IP on the token endpoint. `GET /buy/merchants` caps a page at 100 entries (5 of 15). The client sends each purchase turn once, the docs say to read the conversation after a timeout before resending, a cart hash refuses a confirm on a changed cart, and `cart_busy` says to try again in a moment. No 429 or `Retry-After` is documented (10 of 15). Agentcard's Order Form Terms (21 September 2026) promise 99.9 per cent monthly availability, excluding weekends, holidays and maintenance, with 5 per cent service credits, for customers on an order form. opencommerce.sh's plans name no SLA, and whether Standard customers sign an order form is not stated (5 of 10). No beta label, but the SDK is 0.18.6 and first shipped on 16 October 2026 (8 of 10). Total 43.", "schema": "The buy tool's input is a strict JSON Schema with five required fields and `additionalProperties` false, and the package ships TypeScript declarations. The purchase endpoints under it are missing from the OpenAPI file at docs.agentcard.com/openapi.json, which holds 18 operations for tokens, connections, identity checks and cards (20 of 25). llms.txt on opencommerce.sh and on docs.agentcard.com, with a Markdown twin for each docs page (10 of 10). The description's 57 rules say when to call the tool, when to set `confirm` and what each answer means, such as \"Show the shopper the cart before you confirm it\" (18 of 20). Two booleans and two nullable ids, but the main input `ask` is free text (9 of 15). Code for Anthropic, Vercel AI SDK, OpenAI and OpenRouter, a sandbox walkthrough script, error tables with what to do next and captured error bodies (14 of 15). npm versions follow 0.x semver, and Agentcard's changelog is dated almost daily, newest 27 October 2026, but it covers every Agentcard product and the SDK has no changelog of its own (10 of 15). Total 81.", "security": "OAuth client credentials exchanged for a one-hour platform token, separate sandbox and production clients, and a per-shopper access token as an alternative. Agentcard's platform tokens carry the single scope `api`, per the agentcard listing, and `init` writes production credentials to the env file by default (22 of 30). Every payment not covered by an auto-approval rule needs the shopper's passkey, the docs say neither the app nor the model approves for the shopper, and the model cannot change the shopper or address. `init` runs Agentcard's coding agent with permissions bypassed and unsandboxed commands, which the docs disclose. Two less for that (15 of 20). Answers carry store and product text, links are stripped before the model reads them, and preset rules ignore merchant text an agent sends, but no guidance naming untrusted content or prompt injection was found (10 of 15). Order and purchase events by webhook or stream, with logged deliveries and stored approval records of who, when and where (11 of 15). agentcard.com serves a valid security.txt, the Vault Enterprise plan lists a SOC 2 report and pen-test summary, and the Trust Centre was not read. No bug bounty or disclosure policy found (10 of 20). Total 68.", "transparency": "Closed. The packages' licence allows running them only to use Agentcard's services and forbids benchmarking a competing product. The terms of use (10 July 2026) name Agentcard Corporation and cover the API, MCP server and CLI, but not the Commerce SDK or its 1 per cent fee, and the opencommerce.sh footer names Agentcard, Inc. (12 of 30). Agentcard's own privacy policy (21 October 2026) covers orders, delivery addresses, store accounts it links or creates with their encrypted sign-ins, a one-time card credential held at most 45 minutes, and session recordings of what is typed into dashboard forms. Retention is as long as the account is active, with no periods and no public DPA (14 of 30). No deprecation policy. The SDK keeps deprecated names with notes, such as `toAnthropicTool` and `ackFor`, and the changelog marks one breaking change of 10 September 2026 (6 of 20). The privacy policy names Crossmint, Coinbase, Third National, Sumsub, Visa and Stripe and the kinds of other providers, with transfers to the United States. The CLI's PostHog telemetry honours DO_NOT_TRACK and AGENT_CARDS_TELEMETRY, found in its code (10 of 20). Total 42." }, "sources": [ { "what": "opencommerce.sh robots.txt", "url": "https://opencommerce.sh/robots.txt", "seen": "2026-10-30" }, { "what": "opencommerce home page, pricing and footer", "url": "https://opencommerce.sh/", "seen": "2026-10-30" }, { "what": "opencommerce llms.txt", "url": "https://opencommerce.sh/llms.txt", "seen": "2026-10-30" }, { "what": "opencommerce get started form", "url": "https://opencommerce.sh/get-started", "seen": "2026-10-30" }, { "what": "Monitoring page and its data feed", "url": "https://monitoring.opencommerce.sh/", "seen": "2026-10-30" }, { "what": "Monitoring data feed read at 22:38 UTC", "url": "https://monitoring.opencommerce.sh/api/monitoring", "seen": "2026-10-30" }, { "what": "docs.agentcard.com robots.txt", "url": "https://docs.agentcard.com/robots.txt", "seen": "2026-10-30" }, { "what": "Docs index", "url": "https://docs.agentcard.com/llms.txt", "seen": "2026-10-30" }, { "what": "Commerce SDK quickstart", "url": "https://docs.agentcard.com/commerce-sdk/quickstart.md", "seen": "2026-10-30" }, { "what": "Commerce SDK reference overview", "url": "https://docs.agentcard.com/api-reference/commerce-sdk/overview.md", "seen": "2026-10-30" }, { "what": "AgentcardClient reference and error codes", "url": "https://docs.agentcard.com/api-reference/commerce-sdk/agentcard-client.md", "seen": "2026-10-30" }, { "what": "Buy tool reference", "url": "https://docs.agentcard.com/api-reference/commerce-sdk/buy-tool.md", "seen": "2026-10-30" }, { "what": "listen reference", "url": "https://docs.agentcard.com/api-reference/commerce-sdk/listen.md", "seen": "2026-10-30" }, { "what": "Webhook handler reference", "url": "https://docs.agentcard.com/api-reference/commerce-sdk/webhook-handler.md", "seen": "2026-10-30" }, { "what": "Approving a purchase", "url": "https://docs.agentcard.com/commerce-sdk/guides/approving-a-purchase.md", "seen": "2026-10-30" }, { "what": "Signing in to a store", "url": "https://docs.agentcard.com/commerce-sdk/guides/signing-in-to-a-store.md", "seen": "2026-10-30" }, { "what": "Choose how long a reply waits", "url": "https://docs.agentcard.com/commerce-sdk/guides/choosing-how-long-a-reply-waits.md", "seen": "2026-10-30" }, { "what": "Give your model Agentcard's instructions", "url": "https://docs.agentcard.com/commerce-sdk/guides/give-your-model-agentcards-instructions.md", "seen": "2026-10-30" }, { "what": "Agentic purchases explained", "url": "https://docs.agentcard.com/getting-started/agentic-purchases-explained.md", "seen": "2026-10-30" }, { "what": "Integrating a merchant", "url": "https://docs.agentcard.com/partners/integrating-a-merchant.md", "seen": "2026-10-30" }, { "what": "Webhooks overview", "url": "https://docs.agentcard.com/webhooks/overview.md", "seen": "2026-10-30" }, { "what": "Order events", "url": "https://docs.agentcard.com/webhooks/orders/overview.md", "seen": "2026-10-30" }, { "what": "API reference overview", "url": "https://docs.agentcard.com/api-reference/overview.md", "seen": "2026-10-30" }, { "what": "Create an access token", "url": "https://docs.agentcard.com/api-reference/access-tokens/create.md", "seen": "2026-10-30" }, { "what": "OpenAPI file", "url": "https://docs.agentcard.com/openapi.json", "seen": "2026-10-30" }, { "what": "MCP server", "url": "https://docs.agentcard.com/tools/mcp.md", "seen": "2026-10-30" }, { "what": "MCP buy tool", "url": "https://docs.agentcard.com/tools/mcp/user/buy.md", "seen": "2026-10-30" }, { "what": "CLI", "url": "https://docs.agentcard.com/tools/cli.md", "seen": "2026-10-30" }, { "what": "agent-cards init", "url": "https://docs.agentcard.com/tools/cli/init.md", "seen": "2026-10-30" }, { "what": "npm metadata, @agent-cards/commerce-sdk", "url": "https://registry.npmjs.org/@agent-cards%2fcommerce-sdk", "seen": "2026-10-30" }, { "what": "Package files read as text, @agent-cards/commerce-sdk 0.18.6", "url": "https://registry.npmjs.org/@agent-cards/commerce-sdk/-/commerce-sdk-0.18.6.tgz", "seen": "2026-10-30" }, { "what": "npm metadata, agent-cards", "url": "https://registry.npmjs.org/agent-cards", "seen": "2026-10-30" }, { "what": "Package files read as text, agent-cards 0.11.0", "url": "https://registry.npmjs.org/agent-cards/-/agent-cards-0.11.0.tgz", "seen": "2026-10-30" }, { "what": "npm weekly downloads", "url": "https://api.npmjs.org/downloads/point/last-week/@agent-cards/commerce-sdk", "seen": "2026-10-30" }, { "what": "agentcard.com robots.txt", "url": "https://agentcard.com/robots.txt", "seen": "2026-10-30" }, { "what": "Terms of use", "url": "https://agentcard.com/terms", "seen": "2026-10-30" }, { "what": "Privacy policy", "url": "https://agentcard.com/privacy", "seen": "2026-10-30" }, { "what": "Order form terms, Exhibit A service levels", "url": "https://agentcard.com/order-form-terms", "seen": "2026-10-30" }, { "what": "Changelog", "url": "https://agentcard.com/updates", "seen": "2026-10-30" }, { "what": "Agentcard home page and FAQ", "url": "https://agentcard.com/", "seen": "2026-10-30" }, { "what": "Agentcard pricing", "url": "https://agentcard.com/pricing", "seen": "2026-10-30" }, { "what": "Agentcard about page", "url": "https://agentcard.com/about", "seen": "2026-10-30" }, { "what": "security.txt", "url": "https://agentcard.com/.well-known/security.txt", "seen": "2026-10-30" }, { "what": "RDAP, opencommerce.sh (404)", "url": "https://rdap.org/domain/opencommerce.sh", "seen": "2026-10-30" } ], "openQuestions": [ "Availability. Since `agent-cards` 0.9.0 (27 October 2026) the CLI README and sign-in code say sign-ups are by invitation and send new emails to a form that books a call. The quickstart and `init` docs say `init` creates the account. We did not try to sign up", "The \"100% uptime\" claim is the vendor's. The monitoring page reports test pass rates, all 100 per cent where there were results, and no availability figure. Its data held only passing results, so whether failed runs are kept was not established. Agentcard's own Order Form Terms commit to 99.9 per cent monthly availability, a commitment rather than a measurement", "The 5,026 stores are the vendor's claim. The site's bundled store list holds 5,009 distinct domains with logos from Channel3's CDN, and the monitoring history named 4,532 domains in search-only checks. Amazon and DoorDash are named in the docs and pass tests on the monitoring page. No first-hand page says most Shopify stores are supported", "Who is the merchant of record. For Vault payments the store charges the shopper's card and disputes go to their bank, per agentcard.com's FAQ. For stores Agentcard buys at without a card form (Amazon, Target and others marked `retail`), and for orders on store accounts Agentcard creates, no page says whose account or merchant relationship carries the order. The buy tool tells the model never to say", "Refunds and chargebacks for Commerce SDK orders are not covered in the terms of use. Returns appear only as MCP tools for the Amazon and Walmart lane and as refund fields in the proposed merchant contract", "unchecked: the purchase endpoints under the SDK and the Enterprise API, which are not in the public reference", "unchecked: the Trust Centre and the SOC 2 report listed for Vault Enterprise", "unchecked: whether support answers, and the MCP server's live tool definitions. We made no call", "unchecked: the registration date of opencommerce.sh. rdap.org returned 404", "`agentcard` is listed with provenance domain agentcard.sh, which now redirects to agentcard.com, and its docs moved to docs.agentcard.com. This listing's `company` is set to agentcard.sh to group with it", "agentcard.com's FAQ says the Purchase Agent completes purchases in under 2 seconds with a 99 per cent success rate. The Commerce SDK docs give a 110-second turn budget. That claim belongs to the agentcard listing's next re-check", "The docs' instructions to models (`appInstructions()`, the buy tool's rules, the MCP `get_instructions` tool) and `init`'s agent prompt were read as documents and not followed", "Speed. A launch post forwarded on 30 October 2026 said opencommerce responds in under 10s. It wasn't read first-hand, so it isn't deducted. The vendor's own pages say searches and purchases take under 20s with a cold route of 2m 40s (https://opencommerce.sh/), store searches end at 30 seconds in the docs, and on 30 October 79 of 158 timed monitoring tests took more than 10 seconds to a first response (https://monitoring.opencommerce.sh/). If the under-10s claim appears on a page of the vendor's own, it's a false claim and a deduction of 2." ] }, "negative": 0, "verdict": "One strictly typed buy tool covers search, cart, checkout and order updates, and every payment not covered by an auto-approval rule waits for the shopper's passkey. The tool's description runs to about 14.5 KB, the purchase API under it is undocumented, the monitoring page reports test passes rather than uptime, and the CLI says sign-ups are by invitation.", "bestFor": "A company building a chat agent that buys for US shoppers at many online stores, restaurants and airlines through one tool, with payments approved by the shopper's passkey.", "strengths": [ "The buy tool takes five required fields under a strict JSON Schema, and the shopper and delivery address are fixed when the tool is built", "Every payment not covered by an auto-approval rule waits for the shopper's passkey on an approval link that works for about 15 minutes", "`forModel` strips every link from an answer, and links reach the shopper through `sendLink` without passing through the model", "Errors carry stable codes with a documented next step, and a timeout comes with advice to read the conversation before resending", "The SDK has no dependencies, and 19 versions shipped between 16 and 30 October 2026", "A public monitoring page reports per-merchant test results, success rates, last run and first-response times" ], "weaknesses": [ "The tool description is 57 rules and about 14,500 characters, read on every call", "The purchase endpoints the SDK calls are not in the API reference or the OpenAPI file, and API access is Enterprise only", "The monitoring history started on 23 October 2026, 52 of 84 merchants had no results, and it measures test passes rather than uptime", "The CLI README says sign-ups are by invitation, while the quickstart says `init` creates the account", "Neither Agentcard's terms nor the docs address stores whose terms bar automated buyers. The changelog records checkouts finished behind a bot wall", "TypeScript only, at 0.18.6, two weeks after its first release" ], "agentNotes": [ "Call `buy` with the shopper's words in `ask`, and set `confirm` true only after the shopper says yes to the cart you showed", "After a `timeout`, `unreachable` or `invalid_answer` error, read the conversation before sending the turn again, since the order may have gone through", "Show the cart's `max_charge` beside its total, because the approval holds up to that amount", "Use sandbox credentials for tests. `init` writes production credentials by default, and they place real orders", "Check a store with `GET /buy/merchants` before sending a shopper there, and suggest another store when it is `held_back` or `supported` is false" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 62 } ], "editorialScores": { "ergonomics": 69, "maintenance": 75, "payments": 40, "reliability": 43, "schema": 81, "security": 68, "transparency": 42 }, "provenanceScore": 83, "checked": { "categories": { "ergonomics": "2026-10-30", "maintenance": "2026-10-30", "payments": "2026-10-30", "reliability": "2026-10-30", "schema": "2026-10-30", "security": "2026-10-30", "transparency": "2026-10-30" }, "last": "2026-10-30", "oldest": "2026-10-30", "stale": false, "staleAfterDays": 90 }, "scoreHistory": [ { "date": "2026-10-30", "grade": "B", "kind": "listed", "method": "0.7", "score": 62 } ] }, "connect": { "install": "npm install @agent-cards/commerce-sdk", "http": "curl \"https://api.agentcard.sh/buy/merchants?kind=catalog\u0026q=target.com\" -H \"Authorization: Bearer $AGENTCARD_TOKEN\"" }, "letme": { "capability": "https://letme.dev/shopping.search", "tool": "https://letme.dev/opencommerce" }, "sameCompany": [ "agentcard" ], "notable": [ "opencommerce.sh's llms.txt calls opencommerce a product by Agentcard whose SDK, `@agent-cards/commerce-sdk`, gives an agent one buy tool. The site footer reads © 2026 Agentcard, Inc. and links agentcard.com's terms and privacy policy (https://opencommerce.sh/llms.txt)", "The pricing section lists Standard at 1 per cent of each completed order with API access No, and Enterprise with custom fees and API access Yes (https://opencommerce.sh/#pricing)", "The quickstart says Agentcard takes 1 per cent of each live purchase from the integrating company, from a prefunded balance or a saved card, and that a balance at zero or a declined card pauses live purchases (https://docs.agentcard.com/commerce-sdk/quickstart.md)", "The site says 5,026 stores. The store list bundled in its page script holds 5,009 distinct domains, with logos served from cdn.trychannel3.com (https://opencommerce.sh/)", "The home page says catalogue searches and purchases take under 20s and shows a cold route of 2m 40s and a warmed route of 9s. The docs say store searches end at 30 seconds and 99.7 per cent of stores show first products within 25 seconds (https://docs.agentcard.com/commerce-sdk/guides/choosing-how-long-a-reply-waits.md)", "The monitoring page's data, read at 22:38 UTC on 30 October 2026, listed 84 merchants. 32 had results, all passing (185 of 185 tests), and 52 had none, their tests disabled or without data. No test had failed. First-response times on 158 tests had a median of 10.0 seconds and a maximum of 51.7 (https://monitoring.opencommerce.sh/)", "The monitoring history held 8,346 results for 4,532 store domains, all passing, dated 23 to 30 October 2026, under a 45-day heading. The page labels each one a search-only check and not proof of checkout support (https://monitoring.opencommerce.sh/)", "Since `agent-cards` 0.9.0 (27 October 2026) the CLI says sign-ups are by invitation and points new emails to a form that books a call. The docs say `init` creates the account (https://registry.npmjs.org/agent-cards, https://docs.agentcard.com/tools/cli/init.md)", "`agent-cards init` runs the Claude Agent SDK in the developer's project with Read, Write, Edit, Bash, Grep and Glob, permissions bypassed, through Agentcard's gateway. A hook blocks paths outside the folder and env files, and the docs say commands are not sandboxed (https://docs.agentcard.com/tools/cli/init.md)", "The changelog of 10 October 2026 says a grocery order now places even when the store's checkout is behind a bot wall, by finishing it in a real browser. The entry of 25 October moves catalogue stores to Agentcard's managed browser (https://agentcard.com/updates)", "The buy tool's description tells the model never to say how or on whose account an order is placed (`@agent-cards/commerce-sdk` 0.18.6, dist/definition.js)", "Agentcard's privacy policy, updated 21 October 2026, says it keeps the sign-in details and session of store accounts a shopper links or that Agentcard creates to complete an order, encrypted (https://agentcard.com/privacy)" ], "area": "everyday", "details": [ { "label": "Surface listed", "value": "The `buy` tool from `@agent-cards/commerce-sdk` 0.18.6 and the Agentcard service at api.agentcard.sh behind it, read from opencommerce.sh, docs.agentcard.com, the package files on npm and the monitoring page on 30 October 2026. No account was created, no API or MCP call was made and `init` was not run" }, { "label": "Relationship", "value": "A product of Agentcard, whose card Vault, Issuing, REST API and MCP server are the separate `agentcard` listing. The same `buy` loop is also a user tool on Agentcard's MCP server at https://mcp.agentcard.sh/mcp" }, { "label": "Buy tool input", "value": "Five required fields under a strict JSON Schema with no extra properties. `ask` (the shopper's words), `confirm`, `new_order`, `product_id` and `store_id`. The shopper and delivery address are set when the tool is built, so the model can change neither" }, { "label": "What it buys", "value": "Products from online stores, food delivery, table reservations, flights, and per `init`, groceries, hotels, fitness classes and event tickets. Some stores, such as DoorDash, check out only on the shopper's own account after a sign-in link" }, { "label": "Paying", "value": "The shopper saves a card once through a Vault link and approves each purchase with a passkey from an approval link that works for about 15 minutes. An auto-approval rule can pay where the processor fixes the amount. Stripe Link and Shop Pay are listed as coming soon" }, { "label": "Answers", "value": "`status` is one of needs_input, needs_card, approval_sent, placing, order_placed or declined, with `next_action`, carts with `max_charge`, up to eight product and eight store cards, `decline_code` and `error_code`. `forModel` strips every link before the model reads an answer" }, { "label": "Events", "value": "`listen` holds one connection to Agentcard, resumes after the last event and keeps events for 72 hours. Or `agentcardWebhook` verifies signed deliveries. Order events are order.placed, order.confirmed, order.failed and order.updated" }, { "label": "Timing", "value": "A purchase turn has a 110-second budget at Agentcard and the client waits 130 seconds. Store searches end at 30 seconds. After a timeout the docs say to read the conversation before sending the turn again" }, { "label": "HTTP API", "value": "Documented only in part. `GET /buy/merchants` reports whether Agentcard can pay at a store, with `supported_reason` and a cursor. The purchase endpoints the SDK calls are not in the API reference or the OpenAPI file, and API access is an Enterprise feature" }, { "label": "CLI", "value": "`npx agent-cards init` asks four questions, installs the SDK, signs in through app.agentcard.sh, writes production credentials to `.env` or `.env.local` by default and adds it to `.gitignore`, then runs Agentcard's coding agent in the project. `--print` prints the instructions for your own agent" }, { "label": "Merchant terms", "value": "Agentcard's terms of use and the Commerce SDK docs say nothing about stores whose terms bar automated buyers. `GET /buy/merchants` marks a store `held_back` after it cancelled orders Agentcard placed there as a guest" }, { "label": "Monitoring", "value": "https://monitoring.opencommerce.sh, linked as Status in the site footer, shows per-merchant test results, success rates, last run and first-response time. On 30 October 2026 its history began on 23 October" } ], "unitPrices": [ { "item": "Completed order fee, Standard plan", "unit": "pct", "usd": 1, "note": "Charged to the integrating company per live purchase. Sandbox not billed. https://opencommerce.sh/#pricing" } ], "provenance": { "legalEntity": "Agentcard Corporation", "domain": "opencommerce.sh", "domainRegistered": "", "endpointOnVendorDomain": true, "terms": "https://agentcard.com/terms", "privacy": "https://agentcard.com/privacy", "statusPage": "https://monitoring.opencommerce.sh", "changelog": "https://agentcard.com/updates", "securityTxt": "valid", "checked": "2026-10-30", "notes": [ "opencommerce.sh's footer reads © 2026 Agentcard, Inc. and links agentcard.com's terms and privacy policy. The terms of use (last updated 10 July 2026) and the npm packages' licence name Agentcard Corporation, a Delaware corporation (File No. 10619012).", "The terms of use cover the MCP server, CLI, dashboard and API and do not name the Commerce SDK, opencommerce or the 1 per cent fee. The privacy policy was last updated 21 October 2026.", "The SDK calls api.agentcard.sh, an Agentcard domain, not opencommerce.sh.", "The status page is the monitoring page the footer links as Status. It reports per-merchant test results, not the availability of Agentcard's API.", "opencommerce.sh/.well-known/security.txt returns 404. agentcard.com/.well-known/security.txt is valid, with security@agentcard.com and an expiry of 1 October 2027.", "rdap.org returned 404 for opencommerce.sh, so its registration date is unknown. The first package version, 0.0.0-stage, was published on 16 October 2026.", "The changelog at agentcard.com/updates covers all of Agentcard's products. Its newest entry on 30 October 2026 was dated 27 October." ], "score": 83, "checks": [ { "check": "Legal entity named", "value": "Agentcard Corporation", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "opencommerce.sh, no registry record we could read", "points": 0, "max": 15, "state": "no" }, { "check": "Endpoint on the vendor's domain", "value": "api.agentcard.sh", "points": 15, "max": 15, "state": "ok" }, { "check": "Terms of service", "value": "read, states 5 of the 7 things a reader expects, and has 1 clause that costs points", "points": 6.3, "max": 10, "state": "part" }, { "check": "Privacy policy", "value": "read, states 7 of the 8 things a reader expects", "points": 9.3, "max": 10, "state": "part" }, { "check": "Status page", "value": "monitoring.opencommerce.sh", "points": 10, "max": 10, "state": "ok" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "valid", "points": 10, "max": 10, "state": "ok" }, { "check": "People named", "value": "2 named with their role, 2 with a public profile", "points": 10, "max": 10, "state": "ok" }, { "check": "Support route", "value": "a support address, help pages", "points": 5, "max": 5, "state": "ok" } ], "policies": [ { "kind": "terms", "url": "https://agentcard.com/terms", "state": "read", "readAt": "2026-10-30", "statedDate": "2026-07-10", "words": 758, "points": 6.3, "max": 10, "expected": [ { "key": "terms.date", "label": "Gives the date it was last updated", "found": true, "quote": "Last updated July 10, 2026", "says": "Last updated 2026-07-10" }, { "key": "terms.law", "label": "Names the governing law or courts", "found": true, "quote": "These Terms shall be governed by the laws of the State of California.", "says": "The law of the State of California" }, { "key": "terms.liability", "label": "States a limit on its liability", "found": true, "quote": "TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, AGENTCARD CORPORATION SHALL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES.", "says": "Rules out indirect and consequential losses, with no cap named in this sentence" }, { "key": "terms.termination", "label": "Says how the agreement or account can be ended", "found": true, "quote": "We may terminate your access immediately for any breach of these Terms." }, { "key": "terms.changes", "label": "Says how changes to the terms are announced", "found": false }, { "key": "terms.use", "label": "Lists what users may not do", "found": true, "quote": "Privacy PolicyAccount Opening Privacy NoticeTerms of ServiceCard TermsCard Terms (International)E-Sign ConsentProhibited Uses" }, { "key": "terms.sla", "label": "Refers to a service level or uptime commitment", "found": false } ], "toKnow": [ { "key": "terms.automated", "label": "Restricts automated access", "found": true, "quote": "Use automated means exceeding reasonable use", "costsPoints": true }, { "key": "terms.arbitration", "label": "Requires arbitration or waives class actions", "found": true, "quote": "If unresolved within 30 days, either party may initiate binding arbitration in San Francisco, California." } ] }, { "kind": "privacy", "url": "https://agentcard.com/privacy", "state": "read", "readAt": "2026-10-30", "statedDate": "2026-10-21", "words": 1318, "points": 9.3, "max": 10, "expected": [ { "key": "privacy.date", "label": "Gives the date it was last updated", "found": true, "quote": "Last updated October 21, 2026", "says": "Last updated 2026-10-21" }, { "key": "privacy.collected", "label": "Says what personal data is collected", "found": true, "quote": "This Privacy Policy describes how we collect, use, disclose, and protect your information when you use the Site and our services." }, { "key": "privacy.retention", "label": "Says how long data is kept", "found": true, "quote": "We retain your personal information for as long as your account is active or as needed to provide services, comply with legal obligations, resolve disputes, and enforce our agreements.", "says": "For as long as needed, with no period named" }, { "key": "privacy.processors", "label": "Says who else receives the data", "found": true, "quote": "Service providers: with third-party vendors including Crossmint and Coinbase (wallet funding), our card program manager and our card issuing partner Third National (card issuing), Sumsub (identity verification), Visa, Stripe, and hosting providers, and with these kinds of providers: AI model providers that process you…" }, { "key": "privacy.sale", "label": "Says whether personal data is sold or shared for advertising", "found": true, "quote": "We may share your information in the following circumstances:" }, { "key": "privacy.rights", "label": "Says what rights people have over their data", "found": true, "quote": "If you are a California resident, you have additional rights under the CCPA." }, { "key": "privacy.contact", "label": "Gives a privacy contact", "found": false }, { "key": "privacy.transfers", "label": "Says where data is transferred or stored", "found": true, "quote": "By using the Site, you consent to the transfer of your information to the United States.", "says": "Data goes to the United States" } ] } ] }, "humans": { "slug": "opencommerce", "checked": "2026-10-30", "company": "Agentcard", "people": [ { "name": "Karen Serfaty", "role": "CEO and Co-founder, Agentcard", "founder": true, "linkedin": "https://www.linkedin.com/in/keyserfaty", "x": "https://x.com/keyserfaty", "bio": "Karen Serfaty co-founded Agentcard, which lets AI agents pay for things online, and is its chief executive. She was previously chief executive of Atlas, an expense card for global teams that Remote.com bought, then general manager for cards at Remote.com. Before that she co-founded Palabra and was co-founder and CTO of Nilus.", "bioSources": [ "https://www.ycombinator.com/companies/agentcard", "https://www.agentcard.sh/about" ], "page": "/people/karen-serfaty/" }, { "name": "Felipe Abello", "role": "CTO and Co-founder, Agentcard", "founder": true, "linkedin": "https://www.linkedin.com/in/pipeabello", "x": "https://x.com/PipeAbellos", "bio": "Felipe Abello co-founded Agentcard and is its chief technology officer. He was the first employee at Rappi, then founder and chief executive of Helloguru, a Y Combinator W22 company, and later a co-founder of Infactory.", "bioSources": [ "https://www.ycombinator.com/companies/agentcard", "https://www.agentcard.sh/about" ], "page": "/people/felipe-abello/" } ], "peopleNote": "opencommerce is a product of Agentcard, so the people are Agentcard's founders as in the agentcard listing's file (checked 29 October 2026). On 30 October 2026 agentcard.com/about still listed Karen Serfaty as CEO and Co-Founder and Felipe Abello as CTO and Co-Founder, with two staff, and the same investors. opencommerce.sh names no people. The npm package @agent-cards/commerce-sdk has one maintainer, pipeabello, and agent-cards adds keyserfaty. Ownership and investors are left out so they come from the agentcard file, since nothing new was found since 29 October.", "companySocial": { "linkedin": "https://www.linkedin.com/company/agentcard/", "x": "https://x.com/agentcardhq" }, "support": { "emails": [ "support@agentcard.sh" ], "urls": [ "https://docs.agentcard.com/commerce-sdk/quickstart", "https://monitoring.opencommerce.sh" ], "contactEmails": [ "founders@agentcard.com", "security@agentcard.com" ], "contactUrls": [ "https://opencommerce.sh/get-started" ] }, "sources": [ "https://opencommerce.sh/", "https://opencommerce.sh/llms.txt", "https://agentcard.com/about", "https://agentcard.com/terms", "https://agentcard.com/.well-known/security.txt", "https://docs.agentcard.com/partners/integrating-a-merchant.md", "https://registry.npmjs.org/@agent-cards%2fcommerce-sdk", "https://registry.npmjs.org/agent-cards" ], "ownership": { "status": "private", "checked": "2026-10-29", "sources": [ "https://agentcard.com/about", "https://www.ycombinator.com/companies/agentcard" ] }, "investors": [ { "name": "Y Combinator", "kind": "accelerator", "rounds": [ "Summer 2026 batch" ], "url": "https://www.ycombinator.com", "source": "https://www.ycombinator.com/companies/agentcard", "quote": "Batch: Summer 2026", "page": "/investors/y-combinator/" }, { "name": "Paul Graham", "kind": "angel", "source": "https://agentcard.com/about", "quote": "Paul Graham Co-founder YC", "page": "/investors/paul-graham/" }, { "name": "Tobi Lütke", "kind": "angel", "source": "https://agentcard.com/about", "quote": "Tobi Lütke CEO Shopify", "page": "/investors/tobi-lutke/" }, { "name": "Dharmesh Shah", "kind": "angel", "source": "https://agentcard.com/about", "quote": "Dharmesh Shah CTO HubSpot", "page": "/investors/dharmesh-shah/" }, { "name": "Michael Grinich", "kind": "angel", "source": "https://agentcard.com/about", "quote": "Michael Grinich CEO WorkOS", "page": "/investors/michael-grinich/" }, { "name": "Guillermo Rauch", "kind": "angel", "source": "https://agentcard.com/about", "quote": "Guillermo Rauch CEO Vercel", "page": "/investors/guillermo-rauch/" }, { "name": "Adam D’Angelo", "firm": "Adam D'Angelo", "kind": "angel", "source": "https://agentcard.com/about", "quote": "Adam D’Angelo Board OpenAI", "page": "/investors/adam-d-angelo/" }, { "name": "Simón Borrero", "kind": "angel", "source": "https://agentcard.com/about", "quote": "Simón Borrero CEO Rappi", "page": "/investors/simon-borrero/" }, { "name": "Ken Kocienda", "kind": "angel", "source": "https://agentcard.com/about", "quote": "Ken Kocienda Apple", "page": "/investors/ken-kocienda/" }, { "name": "Felipe Villamarín", "kind": "angel", "source": "https://agentcard.com/about", "quote": "Felipe Villamarín Co-founder Rappi", "page": "/investors/felipe-villamarin/" }, { "name": "Charlie Songhurst", "kind": "angel", "source": "https://agentcard.com/about", "quote": "Charlie Songhurst Board Meta", "page": "/investors/charlie-songhurst/" }, { "name": "Michelle Bu", "kind": "angel", "source": "https://agentcard.com/about", "quote": "Michelle Bu Stripe", "page": "/investors/michelle-bu/" }, { "name": "Sebastian Bensusan", "kind": "angel", "source": "https://agentcard.com/about", "quote": "Sebastian Bensusan Ex-Stripe", "page": "/investors/sebastian-bensusan/" }, { "name": "Greg Arrese", "kind": "angel", "source": "https://agentcard.com/about", "quote": "Greg Arrese Ride Ventures", "page": "/investors/greg-arrese/" }, { "name": "Gabriel Benmergui", "kind": "angel", "source": "https://agentcard.com/about", "quote": "Gabriel Benmergui silver.dev", "page": "/investors/gabriel-benmergui/" }, { "name": "Christopher Stromeyer", "kind": "angel", "source": "https://agentcard.com/about", "quote": "Christopher Stromeyer dLocal", "page": "/investors/christopher-stromeyer/" } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/opencommerce.json", "live": { "slug": "opencommerce", "probe": { "target": "https://api.agentcard.sh", "method": "get", "lastAt": "2026-10-31T01:12:14.249888793Z", "lastOk": true, "lastStatus": 404, "lastMs": 142, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 121, "p95ms24h": 269, "samples24h": 15, "samples30d": 15, "days": [ { "date": "2026-10-30", "probes": 2, "ok": 2 }, { "date": "2026-10-31", "probes": 13, "ok": 13 } ] }, "vendorStatus": { "page": "https://monitoring.opencommerce.sh", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-10-31T00:10:14.604856983Z" }, "updatedAt": "2026-10-31T01:12:14.249888793Z" } }, "verify": { "accepts": "a page on opencommerce.sh or agentcard.sh or one of their subdomains", "badgeUrl": "https://www.anchorterminal.com/badges/opencommerce.svg", "body": { "slug": "opencommerce", "url": "the page with the badge or the link" }, "docs": "https://www.anchorterminal.com/builders/#verify", "effect": "none, it never changes a grade, rank or review", "endpoint": "https://www.anchorterminal.com/api/v1/verify", "listingUrl": "https://www.anchorterminal.com/tools/opencommerce", "mcpTool": "verify_listing", "recheck": "weekly; two failed checks in a row and it lapses, a later pass restores it", "snippets": { "html": "\u003ca href=\"https://www.anchorterminal.com/tools/opencommerce\"\u003e\u003cimg src=\"https://www.anchorterminal.com/badges/opencommerce.svg\" alt=\"opencommerce on Anchor Terminal\" height=\"20\"\u003e\u003c/a\u003e", "markdown": "[![opencommerce on Anchor Terminal](https://www.anchorterminal.com/badges/opencommerce.svg)](https://www.anchorterminal.com/tools/opencommerce)", "link": "\u003ca href=\"https://www.anchorterminal.com/tools/opencommerce\"\u003eopencommerce on Anchor Terminal\u003c/a\u003e" } } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/tools/opencommerce", "json": "https://www.anchorterminal.com/tools/opencommerce.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/tools/opencommerce.md", "mcp": "https://www.anchorterminal.com/mcp", "pricing": "https://www.anchorterminal.com/tools/opencommerce#pricing", "reviews": "https://www.anchorterminal.com/tools/opencommerce#reviews", "slim": "https://www.anchorterminal.com/tools/opencommerce.min.md" }, "markdown": "## Overview\n\n**Grade B · 62/100 · rank #528 of 1239 · #3 in Shopping, returns \u0026 refunds · not agent-ready · confidence medium**\n\n\nMore from Agentcard, listed separately because each is its own product: [Agentcard](https://www.anchorterminal.com/tools/agentcard.md) (Agent wallets \u0026 spending controls).\n\n## Assessment\n\nOne strictly typed buy tool covers search, cart, checkout and order updates, and every payment not covered by an auto-approval rule waits for the shopper's passkey. The tool's description runs to about 14.5 KB, the purchase API under it is undocumented, the monitoring page reports test passes rather than uptime, and the CLI says sign-ups are by invitation.\n\n## Facts\n\n| Field | Value |\n| --- | --- |\n| Vendor | Agentcard (https://opencommerce.sh) |\n| Kind | SDK + MCP |\n| Category | Shopping, returns \u0026 refunds (https://www.anchorterminal.com/categories/shopping) |\n| Transport | HTTP |\n| Endpoint | `https://api.agentcard.sh` |\n| Auth | OAuth · Company client credentials. `AgentcardClient` exchanges a client ID and secret for a platform token that lasts one hour and renews it a minute before expiry. Sandbox and production use separate credentials on one host. A buy tool can instead carry one shopper's own Agentcard access token. Each shopper connects through a Vault link and approves payments with a passkey. The CLI README says sign-ups are by invitation (https://docs.agentcard.com/api-reference/commerce-sdk/agentcard-client.md, checked 2026-10-30). |\n| Pricing | Pay per use (1% fee) · Standard is 1 per cent of each completed order, charged to the integrating company from a prefunded balance or a saved card, with no API access. Enterprise adds API access at custom fees. Sandbox purchases are never billed (https://opencommerce.sh/#pricing, https://docs.agentcard.com/commerce-sdk/quickstart.md, checked 2026-10-30). |\n| x402 | No · No x402, MPP or L402 in the Commerce SDK docs, the package or the opencommerce.sh pricing. Purchases are paid with the shopper's card from Agentcard's Vault, and agentcard.com's FAQ answers Not yet on x402, AP2 and other agent payment protocols (https://agentcard.com/, checked 2026-10-30). |\n| Licence | Proprietary. `@agent-cards/commerce-sdk` and the `agent-cards` CLI ship a licence of Agentcard Corporation that allows running them only to use Agentcard's services and forbids copying, reverse engineering and benchmarking a competing product. The repository they name is private |\n| Tools exposed | 1 |\n| Packages | npm: `@agent-cards/commerce-sdk`; npm: `agent-cards` |\n| Docs | https://docs.agentcard.com/commerce-sdk/quickstart |\n| llms.txt | https://opencommerce.sh/llms.txt |\n| Last release | 2026-10-30 |\n| npm downloads / week | 2,716 |\n| Surface listed | The `buy` tool from `@agent-cards/commerce-sdk` 0.18.6 and the Agentcard service at api.agentcard.sh behind it, read from opencommerce.sh, docs.agentcard.com, the package files on npm and the monitoring page on 30 October 2026. No account was created, no API or MCP call was made and `init` was not run |\n| Relationship | A product of Agentcard, whose card Vault, Issuing, REST API and MCP server are the separate `agentcard` listing. The same `buy` loop is also a user tool on Agentcard's MCP server at https://mcp.agentcard.sh/mcp |\n| Buy tool input | Five required fields under a strict JSON Schema with no extra properties. `ask` (the shopper's words), `confirm`, `new_order`, `product_id` and `store_id`. The shopper and delivery address are set when the tool is built, so the model can change neither |\n| What it buys | Products from online stores, food delivery, table reservations, flights, and per `init`, groceries, hotels, fitness classes and event tickets. Some stores, such as DoorDash, check out only on the shopper's own account after a sign-in link |\n| Paying | The shopper saves a card once through a Vault link and approves each purchase with a passkey from an approval link that works for about 15 minutes. An auto-approval rule can pay where the processor fixes the amount. Stripe Link and Shop Pay are listed as coming soon |\n| Answers | `status` is one of needs_input, needs_card, approval_sent, placing, order_placed or declined, with `next_action`, carts with `max_charge`, up to eight product and eight store cards, `decline_code` and `error_code`. `forModel` strips every link before the model reads an answer |\n| Events | `listen` holds one connection to Agentcard, resumes after the last event and keeps events for 72 hours. Or `agentcardWebhook` verifies signed deliveries. Order events are order.placed, order.confirmed, order.failed and order.updated |\n| Timing | A purchase turn has a 110-second budget at Agentcard and the client waits 130 seconds. Store searches end at 30 seconds. After a timeout the docs say to read the conversation before sending the turn again |\n| HTTP API | Documented only in part. `GET /buy/merchants` reports whether Agentcard can pay at a store, with `supported_reason` and a cursor. The purchase endpoints the SDK calls are not in the API reference or the OpenAPI file, and API access is an Enterprise feature |\n| CLI | `npx agent-cards init` asks four questions, installs the SDK, signs in through app.agentcard.sh, writes production credentials to `.env` or `.env.local` by default and adds it to `.gitignore`, then runs Agentcard's coding agent in the project. `--print` prints the instructions for your own agent |\n| Merchant terms | Agentcard's terms of use and the Commerce SDK docs say nothing about stores whose terms bar automated buyers. `GET /buy/merchants` marks a store `held_back` after it cancelled orders Agentcard placed there as a guest |\n| Monitoring | https://monitoring.opencommerce.sh, linked as Status in the site footer, shows per-merchant test results, success rates, last run and first-response time. On 30 October 2026 its history began on 23 October |\n| Capabilities | shopping.search, shopping.orders, shopping.prices, commerce.cart, commerce.checkout, shopping.returns |\n| Tags | hosted, closed-source, sdk, typescript, oauth, sandbox, webhooks, llms-txt, approvals, pre-1.0, new, cli |\n| JSON | https://www.anchorterminal.com/api/v1/tools/opencommerce.json |\n\n## Score breakdown (methodology v0.7, October 2026 research run)\n\nAssessed 2026-10-30 from public evidence against the published checklist (https://www.anchorterminal.com/benchmark/#checklist). Confidence: medium. Performance and Task success pending (no score, not in the total); the total is Σ(score × weight) ÷ 80 over the 7 assessed categories. \"This run\" is each category's share of the 100 points.\n\n| Category | Weight | This run | Score (0–100) | Points |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% | 20 | 43 | 8.6 |\n| Performance | 10% | pending | pending | n/a |\n| Schema \u0026 documentation | 13% | 16.2 | 81 | 13.2 |\n| Agent ergonomics | 13% | 16.2 | 69 | 11.2 |\n| Security \u0026 auth | 14% | 17.5 | 68 | 11.9 |\n| Payments \u0026 pricing | 10% | 12.5 | 40 | 5.0 |\n| Task success | 10% | pending | pending | n/a |\n| Maintenance \u0026 community | 7% | 8.8 | 75 | 6.6 |\n| Transparency \u0026 trust (editorial 42, provenance 83) | 7% | 8.8 | 63 | 5.5 |\n| Negative events | up to −15 | up to −15 | none recorded | 0 |\n| **Total** | | | | **62 → B** |\n\n### Why each score\n\n- Reliability 43 (checked 2026-10-30): Read with the hosted lines, since the SDK is a client and every purchase runs at api.agentcard.sh. The footer's Status link opens monitoring.opencommerce.sh, the vendor's own page of per-merchant test results with a day-by-day history. It has no component for Agentcard's API and reports tests rather than availability (10 of 20). Its data on 30 October 2026 held results from 23 to 30 October only, all passing, so there is no readable incident record for 90 days (5 of 30). The only rate limit with numbers is 30 requests per 5 minutes per IP on the token endpoint. `GET /buy/merchants` caps a page at 100 entries (5 of 15). The client sends each purchase turn once, the docs say to read the conversation after a timeout before resending, a cart hash refuses a confirm on a changed cart, and `cart_busy` says to try again in a moment. No 429 or `Retry-After` is documented (10 of 15). Agentcard's Order Form Terms (21 September 2026) promise 99.9 per cent monthly availability, excluding weekends, holidays and maintenance, with 5 per cent service credits, for customers on an order form. opencommerce.sh's plans name no SLA, and whether Standard customers sign an order form is not stated (5 of 10). No beta label, but the SDK is 0.18.6 and first shipped on 16 October 2026 (8 of 10). Total 43.\n- Performance: Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes.\n- Schema \u0026 documentation 81 (checked 2026-10-30): The buy tool's input is a strict JSON Schema with five required fields and `additionalProperties` false, and the package ships TypeScript declarations. The purchase endpoints under it are missing from the OpenAPI file at docs.agentcard.com/openapi.json, which holds 18 operations for tokens, connections, identity checks and cards (20 of 25). llms.txt on opencommerce.sh and on docs.agentcard.com, with a Markdown twin for each docs page (10 of 10). The description's 57 rules say when to call the tool, when to set `confirm` and what each answer means, such as \"Show the shopper the cart before you confirm it\" (18 of 20). Two booleans and two nullable ids, but the main input `ask` is free text (9 of 15). Code for Anthropic, Vercel AI SDK, OpenAI and OpenRouter, a sandbox walkthrough script, error tables with what to do next and captured error bodies (14 of 15). npm versions follow 0.x semver, and Agentcard's changelog is dated almost daily, newest 27 October 2026, but it covers every Agentcard product and the SDK has no changelog of its own (10 of 15). Total 81.\n- Agent ergonomics 69 (checked 2026-10-30): One tool, inside the band for ten or fewer, but its description is 57 rules and about 14,500 characters, and the docs also recommend Agentcard's `appInstructions()` system prompt. Answers are capped at eight product and eight store cards and stripped of links for the model. Ten less than the band for the description's size, two back for the capped answers, a departure from the checklist (17 of 25). The buy tool has no page or filter controls, and `storeWaitMs` sets how long a reply waits. `GET /buy/merchants` has `q`, `kind`, `limit` up to 100 and a cursor (12 of 20). `AgentcardApiError` codes each come with what to do next, `decline_code` and `error_code` are machine-readable, and input outside the schema is refused with a message the model can act on (18 of 20). No idempotency key on a purchase turn. The client never resends a turn except once after a 401, a cart hash guards confirms, order events carry an `order_id` to reconcile on, and the MCP `buy` tool is documented as destructive (14 of 20). The model fills five simple fields, but the SDK is TypeScript only, for Node 18 or later and the browser (8 of 15). Total 69.\n- Security \u0026 auth 68 (checked 2026-10-30): OAuth client credentials exchanged for a one-hour platform token, separate sandbox and production clients, and a per-shopper access token as an alternative. Agentcard's platform tokens carry the single scope `api`, per the agentcard listing, and `init` writes production credentials to the env file by default (22 of 30). Every payment not covered by an auto-approval rule needs the shopper's passkey, the docs say neither the app nor the model approves for the shopper, and the model cannot change the shopper or address. `init` runs Agentcard's coding agent with permissions bypassed and unsandboxed commands, which the docs disclose. Two less for that (15 of 20). Answers carry store and product text, links are stripped before the model reads them, and preset rules ignore merchant text an agent sends, but no guidance naming untrusted content or prompt injection was found (10 of 15). Order and purchase events by webhook or stream, with logged deliveries and stored approval records of who, when and where (11 of 15). agentcard.com serves a valid security.txt, the Vault Enterprise plan lists a SOC 2 report and pen-test summary, and the Trust Centre was not read. No bug bounty or disclosure policy found (10 of 20). Total 68.\n- Payments \u0026 pricing 40 (checked 2026-10-30): No x402, MPP or L402. Purchases are paid with the shopper's card from the Vault, and agentcard.com's FAQ answers Not yet on agent payment protocols (0 of 40). 1 per cent of each completed order is published on opencommerce.sh without a login (20 of 20). Sandbox credentials run the whole flow, stop before payment and are never billed, with no card needed (20 of 20). A person signs in through app.agentcard.sh or an emailed code, and since 27 October 2026 the CLI says sign-ups are by invitation (0 of 20). Total 40.\n- Task success: Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored.\n- Maintenance \u0026 community 75 (checked 2026-10-30): `@agent-cards/commerce-sdk` 0.18.6 was published on 30 October 2026 (30 of 30). 19 versions since 16 October 2026 (20 of 20). Closed service. Agentcard's changelog is dated almost daily, newest 27 October, and support runs through `agent-cards support` chat and support@agentcard.sh. Neither was tested (10 of 15). The TypeScript SDK is current, with no SDK in a second language (10 of 15). The SDK has no dependencies. The CLI has 10, among them PostHog and the Claude Agent SDK, needs Node 22, and its repository is private, so CI isn't visible (5 of 10). The product is two weeks old. Total 75.\n- Transparency \u0026 trust 63 (checked 2026-10-30): Closed. The packages' licence allows running them only to use Agentcard's services and forbids benchmarking a competing product. The terms of use (10 July 2026) name Agentcard Corporation and cover the API, MCP server and CLI, but not the Commerce SDK or its 1 per cent fee, and the opencommerce.sh footer names Agentcard, Inc. (12 of 30). Agentcard's own privacy policy (21 October 2026) covers orders, delivery addresses, store accounts it links or creates with their encrypted sign-ins, a one-time card credential held at most 45 minutes, and session recordings of what is typed into dashboard forms. Retention is as long as the account is active, with no periods and no public DPA (14 of 30). No deprecation policy. The SDK keeps deprecated names with notes, such as `toAnthropicTool` and `ackFor`, and the changelog marks one breaking change of 10 September 2026 (6 of 20). The privacy policy names Crossmint, Coinbase, Third National, Sumsub, Visa and Stripe and the kinds of other providers, with transfers to the United States. The CLI's PostHog telemetry honours DO_NOT_TRACK and AGENT_CARDS_TELEMETRY, found in its code (10 of 20). Total 42.\n\nFix list for a coding agent, everything this grade says the listing lacks, the biggest gain first (23 items): https://www.anchorterminal.com/fixes/opencommerce.md (JSON https://www.anchorterminal.com/fixes/opencommerce.json)\n\n### What we couldn't check\n\n- Availability. Since `agent-cards` 0.9.0 (27 October 2026) the CLI README and sign-in code say sign-ups are by invitation and send new emails to a form that books a call. The quickstart and `init` docs say `init` creates the account. We did not try to sign up\n- The \"100% uptime\" claim is the vendor's. The monitoring page reports test pass rates, all 100 per cent where there were results, and no availability figure. Its data held only passing results, so whether failed runs are kept was not established. Agentcard's own Order Form Terms commit to 99.9 per cent monthly availability, a commitment rather than a measurement\n- The 5,026 stores are the vendor's claim. The site's bundled store list holds 5,009 distinct domains with logos from Channel3's CDN, and the monitoring history named 4,532 domains in search-only checks. Amazon and DoorDash are named in the docs and pass tests on the monitoring page. No first-hand page says most Shopify stores are supported\n- Who is the merchant of record. For Vault payments the store charges the shopper's card and disputes go to their bank, per agentcard.com's FAQ. For stores Agentcard buys at without a card form (Amazon, Target and others marked `retail`), and for orders on store accounts Agentcard creates, no page says whose account or merchant relationship carries the order. The buy tool tells the model never to say\n- Refunds and chargebacks for Commerce SDK orders are not covered in the terms of use. Returns appear only as MCP tools for the Amazon and Walmart lane and as refund fields in the proposed merchant contract\n- unchecked: the purchase endpoints under the SDK and the Enterprise API, which are not in the public reference\n- unchecked: the Trust Centre and the SOC 2 report listed for Vault Enterprise\n- unchecked: whether support answers, and the MCP server's live tool definitions. We made no call\n- unchecked: the registration date of opencommerce.sh. rdap.org returned 404\n- `agentcard` is listed with provenance domain agentcard.sh, which now redirects to agentcard.com, and its docs moved to docs.agentcard.com. This listing's `company` is set to agentcard.sh to group with it\n- agentcard.com's FAQ says the Purchase Agent completes purchases in under 2 seconds with a 99 per cent success rate. The Commerce SDK docs give a 110-second turn budget. That claim belongs to the agentcard listing's next re-check\n- The docs' instructions to models (`appInstructions()`, the buy tool's rules, the MCP `get_instructions` tool) and `init`'s agent prompt were read as documents and not followed\n- Speed. A launch post forwarded on 30 October 2026 said opencommerce responds in under 10s. It wasn't read first-hand, so it isn't deducted. The vendor's own pages say searches and purchases take under 20s with a cold route of 2m 40s (https://opencommerce.sh/), store searches end at 30 seconds in the docs, and on 30 October 79 of 158 timed monitoring tests took more than 10 seconds to a first response (https://monitoring.opencommerce.sh/). If the under-10s claim appears on a page of the vendor's own, it's a false claim and a deduction of 2.\n\n### Sources\n\n- opencommerce.sh robots.txt: \u003chttps://opencommerce.sh/robots.txt\u003e (seen 2026-10-30)\n- opencommerce home page, pricing and footer: \u003chttps://opencommerce.sh/\u003e (seen 2026-10-30)\n- opencommerce llms.txt: \u003chttps://opencommerce.sh/llms.txt\u003e (seen 2026-10-30)\n- opencommerce get started form: \u003chttps://opencommerce.sh/get-started\u003e (seen 2026-10-30)\n- Monitoring page and its data feed: \u003chttps://monitoring.opencommerce.sh/\u003e (seen 2026-10-30)\n- Monitoring data feed read at 22:38 UTC: \u003chttps://monitoring.opencommerce.sh/api/monitoring\u003e (seen 2026-10-30)\n- docs.agentcard.com robots.txt: \u003chttps://docs.agentcard.com/robots.txt\u003e (seen 2026-10-30)\n- Docs index: \u003chttps://docs.agentcard.com/llms.txt\u003e (seen 2026-10-30)\n- Commerce SDK quickstart: \u003chttps://docs.agentcard.com/commerce-sdk/quickstart.md\u003e (seen 2026-10-30)\n- Commerce SDK reference overview: \u003chttps://docs.agentcard.com/api-reference/commerce-sdk/overview.md\u003e (seen 2026-10-30)\n- AgentcardClient reference and error codes: \u003chttps://docs.agentcard.com/api-reference/commerce-sdk/agentcard-client.md\u003e (seen 2026-10-30)\n- Buy tool reference: \u003chttps://docs.agentcard.com/api-reference/commerce-sdk/buy-tool.md\u003e (seen 2026-10-30)\n- listen reference: \u003chttps://docs.agentcard.com/api-reference/commerce-sdk/listen.md\u003e (seen 2026-10-30)\n- Webhook handler reference: \u003chttps://docs.agentcard.com/api-reference/commerce-sdk/webhook-handler.md\u003e (seen 2026-10-30)\n- Approving a purchase: \u003chttps://docs.agentcard.com/commerce-sdk/guides/approving-a-purchase.md\u003e (seen 2026-10-30)\n- Signing in to a store: \u003chttps://docs.agentcard.com/commerce-sdk/guides/signing-in-to-a-store.md\u003e (seen 2026-10-30)\n- Choose how long a reply waits: \u003chttps://docs.agentcard.com/commerce-sdk/guides/choosing-how-long-a-reply-waits.md\u003e (seen 2026-10-30)\n- Give your model Agentcard's instructions: \u003chttps://docs.agentcard.com/commerce-sdk/guides/give-your-model-agentcards-instructions.md\u003e (seen 2026-10-30)\n- Agentic purchases explained: \u003chttps://docs.agentcard.com/getting-started/agentic-purchases-explained.md\u003e (seen 2026-10-30)\n- Integrating a merchant: \u003chttps://docs.agentcard.com/partners/integrating-a-merchant.md\u003e (seen 2026-10-30)\n- Webhooks overview: \u003chttps://docs.agentcard.com/webhooks/overview.md\u003e (seen 2026-10-30)\n- Order events: \u003chttps://docs.agentcard.com/webhooks/orders/overview.md\u003e (seen 2026-10-30)\n- API reference overview: \u003chttps://docs.agentcard.com/api-reference/overview.md\u003e (seen 2026-10-30)\n- Create an access token: \u003chttps://docs.agentcard.com/api-reference/access-tokens/create.md\u003e (seen 2026-10-30)\n- OpenAPI file: \u003chttps://docs.agentcard.com/openapi.json\u003e (seen 2026-10-30)\n- MCP server: \u003chttps://docs.agentcard.com/tools/mcp.md\u003e (seen 2026-10-30)\n- MCP buy tool: \u003chttps://docs.agentcard.com/tools/mcp/user/buy.md\u003e (seen 2026-10-30)\n- CLI: \u003chttps://docs.agentcard.com/tools/cli.md\u003e (seen 2026-10-30)\n- agent-cards init: \u003chttps://docs.agentcard.com/tools/cli/init.md\u003e (seen 2026-10-30)\n- npm metadata, @agent-cards/commerce-sdk: \u003chttps://registry.npmjs.org/@agent-cards%2fcommerce-sdk\u003e (seen 2026-10-30)\n- Package files read as text, @agent-cards/commerce-sdk 0.18.6: \u003chttps://registry.npmjs.org/@agent-cards/commerce-sdk/-/commerce-sdk-0.18.6.tgz\u003e (seen 2026-10-30)\n- npm metadata, agent-cards: \u003chttps://registry.npmjs.org/agent-cards\u003e (seen 2026-10-30)\n- Package files read as text, agent-cards 0.11.0: \u003chttps://registry.npmjs.org/agent-cards/-/agent-cards-0.11.0.tgz\u003e (seen 2026-10-30)\n- npm weekly downloads: \u003chttps://api.npmjs.org/downloads/point/last-week/@agent-cards/commerce-sdk\u003e (seen 2026-10-30)\n- agentcard.com robots.txt: \u003chttps://agentcard.com/robots.txt\u003e (seen 2026-10-30)\n- Terms of use: \u003chttps://agentcard.com/terms\u003e (seen 2026-10-30)\n- Privacy policy: \u003chttps://agentcard.com/privacy\u003e (seen 2026-10-30)\n- Order form terms, Exhibit A service levels: \u003chttps://agentcard.com/order-form-terms\u003e (seen 2026-10-30)\n- Changelog: \u003chttps://agentcard.com/updates\u003e (seen 2026-10-30)\n- Agentcard home page and FAQ: \u003chttps://agentcard.com/\u003e (seen 2026-10-30)\n- Agentcard pricing: \u003chttps://agentcard.com/pricing\u003e (seen 2026-10-30)\n- Agentcard about page: \u003chttps://agentcard.com/about\u003e (seen 2026-10-30)\n- security.txt: \u003chttps://agentcard.com/.well-known/security.txt\u003e (seen 2026-10-30)\n- RDAP, opencommerce.sh (404): \u003chttps://rdap.org/domain/opencommerce.sh\u003e (seen 2026-10-30)\n\n## Score history\n\nEvery move of a score since the listing was graded, newest first, with its cause. A score can't move without an entry here. JSON: https://www.anchorterminal.com/api/v1/tools/opencommerce/history.json\n\n- 2026-10-30: graded 62 B (methodology 0.7)\n\n## Who's behind it (provenance 83/100, checked 2026-10-30)\n\n| Check | Finding | Points |\n| --- | --- | --- |\n| Legal entity named | Agentcard Corporation | 20/20 |\n| Domain age | opencommerce.sh, no registry record we could read | 0/15 |\n| Endpoint on the vendor's domain | api.agentcard.sh | 15/15 |\n| Terms of service | read, states 5 of the 7 things a reader expects, and has 1 clause that costs points | 6.3/10 |\n| Privacy policy | read, states 7 of the 8 things a reader expects | 9.3/10 |\n| Status page | monitoring.opencommerce.sh | 10/10 |\n| Changelog | published | 10/10 |\n| security.txt | valid | 10/10 |\n| People named | 2 named with their role, 2 with a public profile | 10/10 |\n| Support route | a support address, help pages | 5/5 |\n\nopencommerce.sh's footer reads © 2026 Agentcard, Inc. and links agentcard.com's terms and privacy policy. The terms of use (last updated 10 July 2026) and the npm packages' licence name Agentcard Corporation, a Delaware corporation (File No. 10619012).\n\nThe terms of use cover the MCP server, CLI, dashboard and API and do not name the Commerce SDK, opencommerce or the 1 per cent fee. The privacy policy was last updated 21 October 2026.\n\nThe SDK calls api.agentcard.sh, an Agentcard domain, not opencommerce.sh.\n\nThe status page is the monitoring page the footer links as Status. It reports per-merchant test results, not the availability of Agentcard's API.\n\nopencommerce.sh/.well-known/security.txt returns 404. agentcard.com/.well-known/security.txt is valid, with security@agentcard.com and an expiry of 1 October 2027.\n\nrdap.org returned 404 for opencommerce.sh, so its registration date is unknown. The first package version, 0.0.0-stage, was published on 16 October 2026.\n\nThe changelog at agentcard.com/updates covers all of Agentcard's products. Its newest entry on 30 October 2026 was dated 27 October.\n\n### Terms and privacy, as read\n\nA reading by a fixed set of rules, each answered with the vendor's own sentence. Not legal advice.\n\n**Terms of service** (https://agentcard.com/terms), read 2026-10-30, dated 2026-07-10, states 5 of the 7 things a reader expects.\n\n- To know. Restricts automated access (costs points). \"Use automated means exceeding reasonable use\"\n- To know. Requires arbitration or waives class actions. \"If unresolved within 30 days, either party may initiate binding arbitration in San Francisco, California.\"\n- Gives the date it was last updated. Last updated 2026-07-10.\n- Names the governing law or courts. The law of the State of California.\n- States a limit on its liability. Rules out indirect and consequential losses, with no cap named in this sentence.\n- Not found in the text. Says how changes to the terms are announced.\n- Not found in the text. Refers to a service level or uptime commitment.\n\n**Privacy policy** (https://agentcard.com/privacy), read 2026-10-30, dated 2026-10-21, states 7 of the 8 things a reader expects.\n\n- Gives the date it was last updated. Last updated 2026-10-21.\n- Says how long data is kept. For as long as needed, with no period named.\n- Not found in the text. Gives a privacy contact.\n- Says where data is transferred or stored. Data goes to the United States.\n\n## Humans behind the project (researched 2026-10-30 from public pages, not part of the grade)\n\n### Key people\n\n- Karen Serfaty, CEO and Co-founder, Agentcard. LinkedIn: https://www.linkedin.com/in/keyserfaty. X: https://x.com/keyserfaty\n- Felipe Abello, CTO and Co-founder, Agentcard. LinkedIn: https://www.linkedin.com/in/pipeabello. X: https://x.com/PipeAbellos\n- Note: opencommerce is a product of agentcard, so the people are agentcard's founders as in the agentcard listing's file (checked 29 october 2026). on 30 october 2026 agentcard.com/about still listed karen serfaty as ceo and co-founder and felipe abello as cto and co-founder, with two staff, and the same investors. opencommerce.sh names no people. the npm package @agent-cards/commerce-sdk has one maintainer, pipeabello, and agent-cards adds keyserfaty. ownership and investors are left out so they come from the agentcard file, since nothing new was found since 29 october.\n- Agentcard: LinkedIn https://www.linkedin.com/company/agentcard/ X https://x.com/agentcardhq\n\n### Ownership and investors\n\n- Backed by: Y Combinator, Paul Graham, Tobi Lütke, Dharmesh Shah, Michael Grinich, Guillermo Rauch, Adam D'Angelo, Simón Borrero, Ken Kocienda, Felipe Villamarín, Charlie Songhurst, Michelle Bu, Sebastian Bensusan, Greg Arrese, Gabriel Benmergui, Christopher Stromeyer\n\n### Getting support\n\n- Support email: support@agentcard.sh\n- Help: https://docs.agentcard.com/commerce-sdk/quickstart\n- Help: https://monitoring.opencommerce.sh\n- Sources: https://opencommerce.sh/, https://opencommerce.sh/llms.txt, https://agentcard.com/about, https://agentcard.com/terms, https://agentcard.com/.well-known/security.txt, https://docs.agentcard.com/partners/integrating-a-merchant.md, https://registry.npmjs.org/@agent-cards%2fcommerce-sdk, https://registry.npmjs.org/agent-cards\n\n## Live (updated 2026-10-31 01:12 UTC)\n\n- Right now: up, HTTP 404, 142 ms, checked 2026-10-31 01:12 UTC (get on `https://api.agentcard.sh`)\n- Uptime 24h 100.0% (15 probes) · 30 days 100.0% (15 probes) · p50 121 ms · p95 269 ms\n- Vendor status page: unknown, no machine-readable status found\n- Always current: https://www.anchorterminal.com/api/v1/live/opencommerce.json\n\n## Probe metrics\n\nNot measured yet. Our benchmark probes haven't run, so there's no availability, latency or error rate from a run and Performance is pending. Live uptime, where we poll the endpoint, is under Live and doesn't change the score.\n\n## Prices\n\n| Item | Price | Unit | Note |\n| --- | --- | --- | --- |\n| Completed order fee, Standard plan | 1% | percentage fee | Charged to the integrating company per live purchase. Sandbox not billed. https://opencommerce.sh/#pricing |\n\nAcross all listings: https://www.anchorterminal.com/prices/index.md\n\n## Strengths\n\n- The buy tool takes five required fields under a strict JSON Schema, and the shopper and delivery address are fixed when the tool is built\n- Every payment not covered by an auto-approval rule waits for the shopper's passkey on an approval link that works for about 15 minutes\n- `forModel` strips every link from an answer, and links reach the shopper through `sendLink` without passing through the model\n- Errors carry stable codes with a documented next step, and a timeout comes with advice to read the conversation before resending\n- The SDK has no dependencies, and 19 versions shipped between 16 and 30 October 2026\n- A public monitoring page reports per-merchant test results, success rates, last run and first-response times\n\n## Weaknesses\n\n- The tool description is 57 rules and about 14,500 characters, read on every call\n- The purchase endpoints the SDK calls are not in the API reference or the OpenAPI file, and API access is Enterprise only\n- The monitoring history started on 23 October 2026, 52 of 84 merchants had no results, and it measures test passes rather than uptime\n- The CLI README says sign-ups are by invitation, while the quickstart says `init` creates the account\n- Neither Agentcard's terms nor the docs address stores whose terms bar automated buyers. The changelog records checkouts finished behind a bot wall\n- TypeScript only, at 0.18.6, two weeks after its first release\n\n\n\n## Before you call it (notes for agents)\n\n1. Call `buy` with the shopper's words in `ask`, and set `confirm` true only after the shopper says yes to the cart you showed\n2. After a `timeout`, `unreachable` or `invalid_answer` error, read the conversation before sending the turn again, since the order may have gone through\n3. Show the cart's `max_charge` beside its total, because the approval holds up to that amount\n4. Use sandbox credentials for tests. `init` writes production credentials by default, and they place real orders\n5. Check a store with `GET /buy/merchants` before sending a shopper there, and suggest another store when it is `held_back` or `supported` is false\n\n## Connect\n\nInstall:\n\n```bash\nnpm install @agent-cards/commerce-sdk\n```\n\nFirst request:\n\n```bash\ncurl \"https://api.agentcard.sh/buy/merchants?kind=catalog\u0026q=target.com\" -H \"Authorization: Bearer $AGENTCARD_TOKEN\"\n```\n\nThrough letme: https://letme.dev/opencommerce (letme picks it for shopping.returns, the top-graded tool for the job). letme answers with the pick and how to call it direct. How it works: https://www.anchorterminal.com/letme/index.md\n\n## Similar tools\n\nRanked by shared capabilities, then score. Same-category tools with no shared capability key are listed last.\n\n| Tool | Grade | Score | Rank | Shared capabilities | x402 | Markdown |\n| --- | --- | --- | --- | --- | --- | --- |\n| Shop MCP | B | 65.9 | 353 | shopping.search, shopping.prices, commerce.cart, commerce.checkout, shopping.orders | no | https://www.anchorterminal.com/tools/shop-mcp.md |\n| Walmart Agent Gateway | F | 8.5 | 1231 | shopping.orders, shopping.search, shopping.prices | no | https://www.anchorterminal.com/tools/walmart-agent-gateway.md |\n| Shopify API + MCP | BB | 77 | 35 | commerce.cart, commerce.checkout | no | https://www.anchorterminal.com/tools/shopify.md |\n| WooCommerce API + MCP | BB | 73 | 101 | commerce.cart, commerce.checkout | no | https://www.anchorterminal.com/tools/woocommerce.md |\n| Shopware | BB | 71.6 | 131 | commerce.cart, commerce.checkout | no | https://www.anchorterminal.com/tools/shopware.md |\n| commercetools | BB | 71.4 | 137 | commerce.cart, commerce.checkout | no | https://www.anchorterminal.com/tools/commercetools.md |\n\n## Panel reviews (0)\n\nReviewed by the Anchor panel (https://www.anchorterminal.com/reviewers/index.md): .\n\nDesk reviews, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. For a desk review, the outcome says whether the reviewer's questions could be answered from public material: success, partial or failure. How reviews work: https://www.anchorterminal.com/reviews/how-it-works.md\n\n## Notable\n\n- opencommerce.sh's llms.txt calls opencommerce a product by Agentcard whose SDK, `@agent-cards/commerce-sdk`, gives an agent one buy tool. The site footer reads © 2026 Agentcard, Inc. and links agentcard.com's terms and privacy policy (source: \u003chttps://opencommerce.sh/llms.txt\u003e)\n- The pricing section lists Standard at 1 per cent of each completed order with API access No, and Enterprise with custom fees and API access Yes (source: \u003chttps://opencommerce.sh/#pricing\u003e)\n- The quickstart says Agentcard takes 1 per cent of each live purchase from the integrating company, from a prefunded balance or a saved card, and that a balance at zero or a declined card pauses live purchases (source: \u003chttps://docs.agentcard.com/commerce-sdk/quickstart.md\u003e)\n- The site says 5,026 stores. The store list bundled in its page script holds 5,009 distinct domains, with logos served from cdn.trychannel3.com (source: \u003chttps://opencommerce.sh/\u003e)\n- The home page says catalogue searches and purchases take under 20s and shows a cold route of 2m 40s and a warmed route of 9s. The docs say store searches end at 30 seconds and 99.7 per cent of stores show first products within 25 seconds (source: \u003chttps://docs.agentcard.com/commerce-sdk/guides/choosing-how-long-a-reply-waits.md\u003e)\n- The monitoring page's data, read at 22:38 UTC on 30 October 2026, listed 84 merchants. 32 had results, all passing (185 of 185 tests), and 52 had none, their tests disabled or without data. No test had failed. First-response times on 158 tests had a median of 10.0 seconds and a maximum of 51.7 (source: \u003chttps://monitoring.opencommerce.sh/\u003e)\n- The monitoring history held 8,346 results for 4,532 store domains, all passing, dated 23 to 30 October 2026, under a 45-day heading. The page labels each one a search-only check and not proof of checkout support (source: \u003chttps://monitoring.opencommerce.sh/\u003e)\n- Since `agent-cards` 0.9.0 (27 October 2026) the CLI says sign-ups are by invitation and points new emails to a form that books a call. The docs say `init` creates the account (source: \u003chttps://registry.npmjs.org/agent-cards, https://docs.agentcard.com/tools/cli/init.md\u003e)\n- `agent-cards init` runs the Claude Agent SDK in the developer's project with Read, Write, Edit, Bash, Grep and Glob, permissions bypassed, through Agentcard's gateway. A hook blocks paths outside the folder and env files, and the docs say commands are not sandboxed (source: \u003chttps://docs.agentcard.com/tools/cli/init.md\u003e)\n- The changelog of 10 October 2026 says a grocery order now places even when the store's checkout is behind a bot wall, by finishing it in a real browser. The entry of 25 October moves catalogue stores to Agentcard's managed browser (source: \u003chttps://agentcard.com/updates\u003e)\n- The buy tool's description tells the model never to say how or on whose account an order is placed (`@agent-cards/commerce-sdk` 0.18.6, dist/definition.js)\n- Agentcard's privacy policy, updated 21 October 2026, says it keeps the sign-in details and session of store accounts a shopper links or that Agentcard creates to complete an order, encrypted (source: \u003chttps://agentcard.com/privacy\u003e)\n\n- #3 of 11 in Best shopping and order APIs for AI agents buying for a person: https://www.anchorterminal.com/best/shopping/index.md\n- All 32 shopping comparisons: https://www.anchorterminal.com/compare/shopping/index.md\n\n## Compare\n\n- [Amazon Creators API vs opencommerce](https://www.anchorterminal.com/compare/amazon-creators-api-vs-opencommerce.md): D 48.8 vs B 62\n- [Best Buy Developer API vs opencommerce](https://www.anchorterminal.com/compare/best-buy-vs-opencommerce.md): E 39.2 vs B 62\n- [Etsy Open API v3 vs opencommerce](https://www.anchorterminal.com/compare/etsy-vs-opencommerce.md): B 63.4 vs B 62\n- [opencommerce vs Shop MCP](https://www.anchorterminal.com/compare/opencommerce-vs-shop-mcp.md): B 62 vs B 65.9\n- [opencommerce vs Walmart Affiliate Marketing API](https://www.anchorterminal.com/compare/opencommerce-vs-walmart-affiliate-api.md): B 62 vs E 38.8\n- [opencommerce vs Walmart Agent Gateway](https://www.anchorterminal.com/compare/opencommerce-vs-walmart-agent-gateway.md): B 62 vs F 8.5\n- [opencommerce vs Zillow in Claude](https://www.anchorterminal.com/compare/opencommerce-vs-zillow-claude.md): B 62 vs F 28.7\n- [Instacart Developer Platform API + MCP vs opencommerce](https://www.anchorterminal.com/compare/instacart-vs-opencommerce.md): D 48.5 vs B 62\n\n## Verify this listing\n\nFor the vendor. The badge or a plain link to this page verifies the listing, from a page on opencommerce.sh or agentcard.sh or one of their subdomains. It shows the listing is the vendor's and that the vendor knows it's here, and it never changes a grade, rank or review. The vendor sends the page's address to `POST https://www.anchorterminal.com/api/v1/verify` as `{\"slug\": \"opencommerce\", \"url\": \"…\"}`, or calls the `verify_listing` tool at https://www.anchorterminal.com/mcp. We fetch the page once, then again every week; two failed checks in a row and the verification lapses, and a later pass restores it. What we check: https://www.anchorterminal.com/builders/index.md#verify\n\nHTML badge:\n\n```html\n\u003ca href=\"https://www.anchorterminal.com/tools/opencommerce\"\u003e\u003cimg src=\"https://www.anchorterminal.com/badges/opencommerce.svg\" alt=\"opencommerce on Anchor Terminal\" height=\"20\"\u003e\u003c/a\u003e\n```\n\nMarkdown badge, for a README:\n\n```markdown\n[![opencommerce on Anchor Terminal](https://www.anchorterminal.com/badges/opencommerce.svg)](https://www.anchorterminal.com/tools/opencommerce)\n```\n\nPlain link:\n\n```html\n\u003ca href=\"https://www.anchorterminal.com/tools/opencommerce\"\u003eopencommerce on Anchor Terminal\u003c/a\u003e\n```\n\n## Share this listing\n\nFor the vendor. Sharing assets for social media, two PNGs of 1200 × 630 that say opencommerce is listed on Anchor Terminal, with the vendor's logo and this page's address and no grade or score.\n\n- Dark: https://www.anchorterminal.com/assets/share/opencommerce-dark.png\n- Light: https://www.anchorterminal.com/assets/share/opencommerce-light.png\n- Create a video and download its frames: https://www.anchorterminal.com/assets/listing-video/index.html?listing=opencommerce\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-31", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Terminal", "url": "https://www.anchorterminal.com/tools/" }, { "name": "Shopping, returns \u0026 refunds", "url": "https://www.anchorterminal.com/categories/shopping" }, { "name": "opencommerce", "url": "" } ], "description": "opencommerce is Agentcard's Commerce SDK, a TypeScript package that gives an agent one buy tool. Agentcard searches stores, builds the cart and places the order after the shopper approves payment with a card saved in Agentcard's Vault.", "facts": [ "rank #528 of 1239", "OAuth auth", "0 desk reviews" ], "h1": "opencommerce", "image": "https://www.anchorterminal.com/assets/og/tools-opencommerce.png", "path": "/tools/opencommerce", "published": "2026-10-01", "section": "tools", "title": "opencommerce review (2026): pricing, alternatives and grade B", "toc": null, "updated": "2026-10-31", "url": "https://www.anchorterminal.com/tools/opencommerce" }, "tokens": { "markdown": 10000, "slim": 2130 }, "version": 1 }