Let your agent pay, without giving it anything to steal

Connect over MCP

The gateway is a remote MCP server at https://mandate.mindgears.dev/api/mcp. Authenticate with an agent key as a bearer token; create one on the Agents page, which also shows this setup with your key filled in.

npx -y mcp-remote https://mandate.mindgears.dev/api/mcp --header "Authorization: Bearer mk_your_agent_key"

Each demo store has its own catalogue server with search_products, get_product and present_mandate, which takes a mandate credential. It is the store's server, not the gateway's, so whatever it returns is untrusted as far as the gateway is concerned.

search_products also takes that credential, as an optional credential argument. With it, each product comes back with a mandate field saying whether it fits and why, and the list is ordered: products inside the mandate first, then those that would need the buyer's approval, then those outside it. Without it the search works as before. The two outside stores do not sort their search yet; they answer present_mandate only.

REST API

For agents and frameworks without MCP. Send the same agent key as Authorization: Bearer mk_…. The machine-readable description is at /api/v1/openapi.json.

curl -X POST https://mandate.mindgears.dev/api/v1/purchases \
  -H "Authorization: Bearer mk_your_agent_key" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: order-001" \
  -d '{
    "product_url": "https://mandate.mindgears.dev/stores/stride/products/STR-TEMPO3",
    "expected_price": 89.00,
    "user_request": "Buy me road running shoes under $100",
    "reason": "A cushioned daily trainer at $89"
  }'

A purchase request

The mandate credential

A credential is a short statement, signed by the gateway, of what an agent may buy: the budget left, the limits, the categories and the store rules. The agent carries it to a store. The store checks the signature with the gateway's public key and answers from its own catalogue. The store does not call the gateway.

A credential authorises nothing by itself. It holds no payment details, no buyer name or email, and none of the mandate's own wording. Every purchase still goes through request_purchase, where the gateway reads the product page and checks the whole mandate.

import { createPublicKey, verify } from "node:crypto";

// Keys sorted, no whitespace: the form the gateway signs.
function canonical(v) {
  if (v === null || typeof v !== "object") return JSON.stringify(v ?? null);
  if (Array.isArray(v)) return "[" + v.map(canonical).join(",") + "]";
  return "{" + Object.keys(v).filter((k) => v[k] !== undefined).sort()
    .map((k) => JSON.stringify(k) + ":" + canonical(v[k])).join(",") + "}";
}

// Read once and keep: the gateway's public key.
const { evidence } = await (await fetch("https://mandate.mindgears.dev/.well-known/mandate-gateway.json")).json();
const gatewayKey = createPublicKey(evidence.publicKey);

// No call to the gateway from here on.
function checkCredential({ payload, signature }, myStoreUrl) {
  const signed = verify(null, Buffer.from(canonical(payload)), gatewayKey, Buffer.from(signature, "base64"));
  if (!signed) return "the signature is not the gateway's";
  if (payload.type !== "mandate.authorisation" || payload.version !== 1) return "not a mandate credential";
  if (Date.parse(payload.expiresAt) <= Date.now()) return "expired";
  if (payload.audience !== myStoreUrl) return "issued for another store";
  return null; // good: read payload.mandates and answer from your catalogue
}

For stores

Agent test results

The same scenarios, run through agents built on different frameworks and architectures against this gateway. The point is that the outcome does not depend on how well-behaved the agent is.

See every test run and what the agent did in it, with the comparison against the same agents without the gateway.