From ucp-agentic-commerce
Implements UCP AP2 Mandates for autonomous agent payments using SD-JWT credentials, JWS merchant signatures, and Agent Payments Protocol in 7-step flow with security lock.
npx claudepluginhub orcaqubits/agentic-commerce-skills-plugins --plugin ucp-agentic-commerceThis skill is limited to using the following tools:
**Fetch live spec**:
Guides Next.js Cache Components and Partial Prerendering (PPR) with cacheComponents enabled. Implements 'use cache', cacheLife(), cacheTag(), revalidateTag(), static/dynamic optimization, and cache debugging.
Migrates code, prompts, and API calls from Claude Sonnet 4.0/4.5 or Opus 4.1 to Opus 4.5, updating model strings on Anthropic, AWS, GCP, Azure platforms.
Automates semantic versioning and release workflow for Claude Code plugins: bumps versions in package.json, marketplace.json, plugin.json; verifies builds; creates git tags, GitHub releases, changelogs.
Fetch live spec:
site:ucp.dev specification ap2-mandates for the extension schemasite:ap2-protocol.org for the AP2 protocol specificationAP2 (Agent Payments Protocol) enables fully autonomous agent commerce — the agent can authorize payments cryptographically without requiring real-time human approval for each transaction. The user pre-authorizes spending parameters, and the agent proves authorization via signed credentials.
Checkout Mandate (ap2.checkout_mandate): An SD-JWT+kb (Selective Disclosure JWT with Key Binding) credential that proves the user authorized the agent to complete this specific checkout at these specific terms.
Payment Mandate (payment_data.token): A separate credential proving payment authorization, verified by the PSP (not the Business).
Before the Platform generates mandates, the Business must sign the checkout terms:
<header>..<signature>The Business returns this merchant_authorization in the checkout response.
merchant_authorization (JWS detached content)complete_checkout callOnce AP2 is negotiated for a checkout session, a Security Lock is activated: neither party may revert to a standard (non-AP2) checkout flow for that session. This prevents downgrade attacks where a malicious actor could bypass the cryptographic mandate requirements by falling back to a simpler payment flow.
AP2-specific errors:
mandate_required — AP2 mandates needed but not providedagent_missing_key — Agent's signing key not foundmandate_invalid_signature — Signature verification failedmandate_expired — Mandate past validity windowmandate_scope_mismatch — Mandate doesn't match checkout termsmerchant_authorization_invalid — Business signature invalidmerchant_authorization_missing — Business didn't sign termsThis is the most complex UCP extension. Before implementing:
This extension is intended for advanced autonomous agent scenarios. Most initial implementations should start with standard payment handlers (Google Pay, Shop Pay) before adding AP2.