Skip to content

Anthropic

Commerce agent blueprint ships with every write staged

Written by an AI model from the linked sources and checked against them by a second model. How we work

Image: github.com

Anthropic’s commerce-agents repo ships under Apache 2.0 as a reference implementation that isn’t maintained and doesn’t accept contributions. Nothing in it touches live commerce. Checkout renders the cart for the host app to complete, and every merchant write stays staged until a person approves it.

Four verticals run over the same libraries, retail, travel, telecom and entertainment, each with a storefront and a merchant portal. One agent definition, prompt, skills, tool contracts and gates, runs three ways: on the Messages API, the Claude Agent SDK, and Managed Agents.

Fencing, provenance gates, caps, memory validation and the merchant approval gate all run inside the tool call and hold on every path. The examples ship with no authentication, and the MCP servers bind to loopback.

Anthropic

Stolen session keys drained Claude token quotas

“It increased from 45% to 55% while I performed no work,” a U.K. consultant told TechCrunch about his Claude Max account. Anthropic traced it to a stolen session key minting unauthorized Claude Code OAuth tokens.

No comments yet. Be the first.

Join the conversation

Sign in to leave a comment. It appears after moderation.