Agent Commerce Engine

**Judgement** Agent Commerce Engine is a strong, production-focused foundation for “agentic commerce” integrations. It offers a well-structured protocol and CLI for agents to talk to any e-commerce backend that adopts its server spec, covering discovery, carts, profiles, orders, and brand info while explicitly handing off payment to humans. It is best suited for teams willing to implement the SERVER_SPEC on their backend and who want a reusable standard instead of bespoke tools per store. **Key strengths** - Comprehensive commerce coverage: search/list, product detail, variants, promotions, cart operations, profile management, orders, and brand storytelling endpoints. - Explicit agent operation patterns (search-before-add, pagination, variant validation, error handling), which reduce typical agent mistakes. - Security-aware design: token-based auth, no password-at-rest after login, HTTPS-only for remote endpoints, and local credential storage with restrictive (0600) permissions. - Sensible payment boundary: agents can create orders but must hand payment URLs to users, limiting financial risk and authorization issues. - Includes a concrete production reference (Lafeitu Gourmet) that demonstrates real-world use. **Risks / limitations** - Requires backend adoption of the SERVER_SPEC; without that, the engine cannot be used, limiting out-of-the-box compatibility with arbitrary stores. - Local credential storage and Visitor IDs, while reasonably secured, still represent sensitive state that must be protected by the host environment (disk encryption, access control, backup practices). - Agents must follow the documented flows diligently (search before add, variant validation, payment handoff); misconfigured prompts or poorly supervised agents could still add wrong variants or fail to surface crucial instructions to users. - The engine assumes HTTPS for production, but misconfigured deployments (e.g., allowing HTTP via reverse proxies or incorrect TLS) could weaken security in practice. - Handling of PII (name, phone, address, email) via get/update-profile and order creation introduces regulatory obligations (e.g., GDPR/CCPA) that are outside the engine’s direct control. **Recommended scenarios** - Brands with existing headless e-commerce APIs that can implement the provided SERVER_SPEC and want a standardized way for multiple agents or platforms to interact with their store. - Agent platform providers who want a generic commerce substrate that can power many brand-specific skills without rewriting core shopping logic each time. - Teams building autonomous shopping assistants that must safely manage carts and orders while leaving payment execution to the human user. - Experimental or pilot “agentic shopping” deployments where production realism is required (tokens, credentials, promotions, orders) but direct agent-driven payments are intentionally disallowed for safety.