# ProveTheBuy

> Open-source verifier for orders placed by AI agents. It checks the agent's HTTP message signature (RFC 9421, Web Bot Auth, Visa Trusted Agent Protocol), the shopper's signed mandate (Mastercard Verifiable Intent, AP2) and payment token limits at checkout, then keeps a hash-chained evidence record for chargebacks. TypeScript, Node.js 18.17+, Apache-2.0, no runtime dependencies.

- Install: `npm install @provethebuy/verify`
- Count agent traffic in a log: `npx @provethebuy/cli traffic-check access.log`
- Decisions: allow, step_up, block, not_agent. Starts in shadow mode (records only) and fails open.
- ProveTheBuy Cloud (https://app.provethebuy.com) stores records and submits dispute evidence to Stripe. The verifier works without it.

## Docs

- [Quickstart](https://provethebuy.com/docs/quickstart.md): Install @provethebuy/verify, verify an agent's signed request at checkout in shadow mode, and read the decision. Express middleware included.
- [CLI and traffic-check](https://provethebuy.com/docs/cli.md): Run npx @provethebuy/cli traffic-check on an nginx or Apache log to see how many ChatGPT, Claude and Perplexity agents hit your store and checkout.
- [Protocols](https://provethebuy.com/docs/protocols.md): Exactly what ProveTheBuy checks for each agent-commerce standard: RFC 9421, Web Bot Auth, Visa Trusted Agent Protocol, Verifiable Intent, AP2 and Stripe shared payment tokens.
- [Policy](https://provethebuy.com/docs/policy.md): Every option in the ProveTheBuy YAML policy: shadow and enforce modes, fail open, mandate handling, limits and agent reputation.
- [Architecture](https://provethebuy.com/docs/architecture.md): The parts of ProveTheBuy, how data moves between them, and what a hash-chained evidence record holds.
- [Flows](https://provethebuy.com/docs/flows.md): Diagrams of how ProveTheBuy is set up, what happens when an agent places an order, and how a chargeback is answered months later.
- [Threat model](https://provethebuy.com/docs/security.md): The threats ProveTheBuy protects against, including replays, edited requests, key rotation and over-limit orders, and how each is handled.
- [Roadmap](https://provethebuy.com/docs/roadmap.md): What ships next in ProveTheBuy: Python and Go verifiers, a Stripe App, and full AP2 support.

## Code

- [GitHub repository](https://github.com/noelps-git/provethebuy): verifier, CLI, playground, examples
- [Express example](https://github.com/noelps-git/provethebuy/tree/main/examples/express-checkout): a runnable shop and an agent that buys from it
- [Test vectors](https://github.com/noelps-git/provethebuy/tree/main/test-vectors): signed requests with expected decisions, for ports to other languages

## Optional

- [Pricing](https://provethebuy.com/pricing)
- [Security](https://provethebuy.com/security)
- [Full docs in one file](https://provethebuy.com/llms-full.txt)