# Agent Commerce Safety Kit

Dependency-free JavaScript guards for agents that call paid HTTP services.

## Why this exists

Agents combine untrusted URLs, payment requirements and model-generated output. A small mistake can turn a data fetch into an SSRF request, a payment challenge into a wrong-recipient transfer, or a retry into a replay. This kit provides conservative, composable checks for the edges of that workflow.

## Included

- `assertPublicHttpUrl(value)`: accepts HTTP(S) URLs, rejects credentials and common loopback, private-network and metadata hosts.
- `assertPaymentRequirements(requirements, expected)`: validates integer amounts, EVM recipients and exact endpoint expectations.
- `redactHeaders(headers)`: removes authorization, cookies and payment payloads before logging.
- `replayKey(...)` + `claimOnce(seen, key)`: creates a deterministic replay key and rejects reuse in a trusted process-local set.
- `boundedJson(value, maxBytes)`: caps untrusted JSON before it reaches a downstream model or renderer.

## Minimal use

```js
import {
  assertPublicHttpUrl,
  assertPaymentRequirements,
  boundedJson,
  claimOnce,
  redactHeaders,
  replayKey,
} from "./agent-commerce-safety-kit.mjs";

const target = assertPublicHttpUrl("https://example.com/data");
const payment = assertPaymentRequirements(receivedRequirements, {
  amount: "19000000",
  network: "eip155:8453",
  payTo: "0x0000000000000000000000000000000000000000",
});
const key = replayKey({ ...payment, nonce, transaction });
if (!claimOnce(seenKeys, key)) throw new Error("replay");
const safeBody = boundedJson(await response.json());
console.info({ target: target.origin, headers: redactHeaders(headers), safeBody });
```

Replace the zero address in the example with the exact public recipient your endpoint advertises. The module does not create wallets or perform any blockchain action.

## Scope and limits

These are input and logging guards, not a complete payment protocol or a substitute for a facilitator's verification. DNS rebinding, redirect policy, chain-specific signature verification, durable replay storage, rate limiting and authorization still belong in the service that uses the kit. Re-check the final URL after every redirect and allow only the hosts you actually need.

## License

MIT. Version 1.0.0, 5 August 2026.