MT Shopping Developer Guide: Verify AI Agent Purchases with W3C Credentials

MT Shopping is a transaction verification API for autonomous shopping agents. It issues and verifies BuyerAgentCredentials — W3C Verifiable Credentials (VCs) signed with Ed25519 — that bind an AI agent to its human principal's spending constraints. 5 REST endpoints, 3 Model Context Protocol (MCP) tools, free during Early Access. Part of MolTrust v0.7.0.

What Is a BuyerAgentCredential

A BuyerAgentCredential is a W3C Verifiable Credential that authorizes an AI shopping agent to make purchases on behalf of a human. It contains the agent's DID, the human principal's DID, spend limits, allowed currencies, category restrictions, and an expiration date. The credential is signed with Ed25519 and can be verified by any merchant in a single API call.

{
  "type": ["VerifiableCredential", "BuyerAgentCredential"],
  "credentialSubject": {
    "id": "did:moltrust:agent-001",
    "humanDID": "did:moltrust:human-001",
    "authorization": {
      "spendLimit": 300,
      "currency": "USDC",
      "validFrom": "2026-03-16T00:00:00Z",
      "validUntil": "2026-04-16T00:00:00Z",
      "scope": {
        "categories": ["electronics", "books"],
        "maxTransactionsPerDay": 5
      }
    }
  }
}

Unlike API-key-only authorization, a BuyerAgentCredential is portable, cryptographically verifiable, and carries its own constraints. The merchant doesn't need to trust the agent — it trusts the credential.

Verify a Purchase: One POST Request

The verification endpoint checks the credential signature, spend limits, currency, expiry, daily transaction cap, and trust score. It returns a receipt with an approval status.

import requests

# Verify an agent's purchase attempt
receipt = requests.post(
    "https://api.moltrust.ch/guard/shopping/verify",
    json={
        "agentDID": "did:moltrust:agent-001",
        "vc": buyer_agent_credential,  # Full W3C VC object
        "merchant": "amazon.com",
        "amount": 189.99,
        "currency": "USDC"
    }
).json()

print(receipt["result"])     # "approved", "review", or "rejected"
print(receipt["guardScore"]) # 0-100 trust score
print(receipt["receiptId"])  # Unique receipt ID for audit trail

The approved response:

{
  "receiptId": "r-a1b2c3d4-e5f6-7890",
  "agentDID": "did:moltrust:agent-001",
  "humanDID": "did:moltrust:human-001",
  "merchant": "amazon.com",
  "amount": 189.99,
  "currency": "USDC",
  "guardScore": 72,
  "result": "approved",
  "reason": "All checks passed",
  "timestamp": "2026-03-16T10:30:00Z"
}

Trust scores below 20 are rejected. Scores 20-49 are flagged for review. 50+ approved. The merchant can use guardScore and result to gate or escalate purchases automatically.

Issue a Credential: $5 USDC via x402

Issue a BuyerAgentCredential via the x402 payment protocol. $5 USDC on Base L2 — free during Early Access.

# Issue a BuyerAgentCredential (free during Early Access)
vc = requests.post(
    "https://api.moltrust.ch/guard/vc/buyer-agent/issue",
    json={
        "agentDID": "did:moltrust:agent-001",
        "humanDID": "did:moltrust:human-001",
        "spendLimit": 500,
        "currency": "USDC",
        "categories": ["electronics", "clothing"],
        "maxTransactionsPerDay": 10,
        "validDays": 30
    }
).json()

print(vc["credential"])       # Signed BuyerAgentCredential (JWS)
print(vc["credentialHash"])   # SHA-256 hash

The 5 Endpoints

GET /shopping/info — Service info, schema reference, version. Free.
GET /shopping/schema — Full BuyerAgentCredential JSON schema. Free.
POST /shopping/verify — Verify agent purchase against credential. Free (Early Access).
POST /vc/buyer-agent/issue — Issue a signed BuyerAgentCredential. $5 USDC via x402 (free EA).
GET /shopping/receipt/:id — Retrieve a verification receipt by ID. Free.

All endpoints are prefixed with /guard/ through the API gateway: api.moltrust.ch/guard/shopping/...

MCP Integration

MT Shopping is available as 3 MCP tools in the moltrust-mcp-server package (33 tools total, v0.7.0):

# Install
pip install moltrust-mcp-server

# Add to Claude Desktop / Cursor / Windsurf
claude mcp add moltrust -- uvx moltrust-mcp-server

# Available tools:
# mt_shopping_info    — service info and schema
# mt_shopping_verify  — verify agent purchase
# mt_shopping_issue_vc — issue BuyerAgentCredential

The Model Context Protocol (MCP) integration means any MCP-compatible client can verify shopping transactions natively without writing HTTP calls.

Use Cases

Merchant-Side Verification

An e-commerce platform receives a purchase request from an AI agent. Before processing payment, the platform calls /shopping/verify with the agent's credential and transaction details. If the receipt says “rejected”, the order is blocked. If “review”, a human is notified. If “approved”, the order proceeds — with a cryptographic audit trail.

Agent-Side Credential Management

A shopping agent framework (like AutoGPT or CrewAI) requests a BuyerAgentCredential from its human principal's MolTrust account. The credential is scoped to specific categories, spending limits, and time windows. The agent presents this credential at every checkout — no stored API keys, no shared passwords.

5 endpoints. 3 MCP tools. W3C Verifiable Credentials.

Merchant-verifiable trust for the autonomous shopping economy.

api.moltrust.ch/guard/shopping/verify

FAQ

What is MT Shopping?

MT Shopping is a transaction verification API for autonomous shopping agents. It issues BuyerAgentCredentials (W3C Verifiable Credentials) that bind an AI agent to its human principal's spending constraints, and provides merchants with a single API call to verify agent identity and authorization before processing a purchase.

How does the verification pipeline work?

The /shopping/verify endpoint runs a 10-step check: credential type validation, Ed25519 signature verification, expiry check, valid-from check, spend limit check, currency match, daily transaction cap, trust score evaluation, DID resolution, and merchant scope validation. The result is a receipt with “approved”, “review”, or “rejected” status.

What does it cost?

Verification (POST /shopping/verify) and info endpoints are free permanently. Credential issuance (POST /vc/buyer-agent/issue) costs $5 USDC via the x402 payment protocol on Base L2. All endpoints are free during Early Access.

Can I use MT Shopping with Claude Desktop?

Yes. Install the MCP server with pip install moltrust-mcp-server and add it to Claude Desktop. The mt_shopping_verify tool lets Claude verify agent purchases natively. See the MCP Integration section above.

Start Verifying Agent Purchases

Free during Early Access. 33 MCP tools via pip install. W3C Verifiable Credentials with Ed25519 signatures.

API Docs → pip install →

Written by the MolTrust Team (CryptoKRI GmbH, Zurich). Follow @MolTrust on X for updates.

MT Shopping Developer Guide: Verify Agent Purchases with W3C Credentials