STEELYARD
Open-source TypeScript SDK · current main

Build for agentic commerce.

Define your catalog once. Serve it over commerce.json, HTTP, MCP, ACP, and UCP from a single call. Add checkout through Stripe or a UCP PSP adapter. Use x402 for paid API requests that return HTTP 402.

$npm i steelyard
Read the docs
Overview
{ }defineCommerce()source
one manifest
serveCommerce()5 rows
/.well-known/commerce.jsonmanifest
/commerceHTTP
/mcpMCP
/acp/feedACP
/.well-known/ucpUCP
AAgentlive
discovers + buys
MMerchantlive
checkout · UCP PSP adapter
✓Receiptpaid
pi_test_abc123 · paid $4.77
00Verified trace · route path
steelyard demo
Buyer
01$ steelyard-agent "buy 1 espresso, email me@local"
02→ POST /mcp · tools/call list_offers q="espresso"
03200 found 3 · picking espresso $4.50
04→ GET /.well-known/ucp
05200 ucp · checkout · stripe
06→ POST /api/checkout {offer:"espresso"}
07201 chk_xy91 · total $4.77
08→ IPC proposeIntent · caller_token
09200 allow ic_test_9df2 · sha256:0f9c… · card scoped $4.77
10→ POST /api/checkout/chk_xy91/complete
11200 paid pi_test_abc123 · rcpt_xyz789
Merchant
01merchant listening on http://localhost:3000
02↳ awaiting requests…
03← POST /mcp · tools/call list_offers
04200 3 offers returned
05← GET /.well-known/ucp · 127.0.0.1 · 200
06← POST /api/checkout {offer:espresso}
07← POST /api/checkout/chk_xy91/complete · vc_******
08↳ stripePsp.capture → stripe.paymentIntents.confirm
09200 pi_test_abc123 paid $4.77
01Getting started

Install one package.
Serve every surface.
Or scaffold into Next.js.

Define a manifest, call serveCommerce, and your catalog is live over five read surfaces at once. Read-only by default — no processor, no keys. Or run npx steelyard init inside an existing Next.js app and the five generated route files land in your project.

Node ≥ 20·TypeScript·Next.js 14+·zero config
shellnext.js scaffold
$ npx steelyard init
  ✔ Detected Next.js 15 (App Router · TypeScript · pnpm)
  ✔ Imported 12 prices from Stripe
  ✔ app/.well-known/commerce.json/route.ts
  ✔ app/mcp/route.ts
  ✔ app/acp/feed/route.ts
  ✔ app/.well-known/ucp/route.ts
  ✔ app/api/catalog/[...path]/route.ts
  ✔ commerce.ts · /steelyard inspector
server.ts
import { defineCommerce, serveCommerce } from "steelyard"

const manifest = defineCommerce({
  identity: { name: "My Shop", domain: "shop.example", currencies: ["USD"] },
  offers: [
    { id: "tee", title: "T-Shirt", availability: "in_stock",
      pricing: [{ kind: "one_time", amount: 2500, currency: "USD" }] },
  ],
})

serveCommerce(manifest).listen(3000)
shellfive surfaces, one manifest
$ curl localhost:3000/.well-known/commerce.json
$ curl localhost:3000/mcp  # MCP
$ curl localhost:3000/acp/feed  # ACP
02What you get

One definition. Every protocol. PSP adapters where the protocol allows.

01

Define once, serve everywhere

One defineCommerce manifest, served over commerce.json, a plain HTTP API, MCP, ACP, and UCP — from a single serveCommerce() call. Read-only by default, no keys required.

example
serveCommerce(manifest).listen(3000)
02

Drops into existing Next.js apps

npx steelyard init detects your framework, language, and package manager, optionally imports your Stripe catalog, writes five route files plus a dev inspector at /steelyard, and installs the public steelyard package.

example
npx steelyard init
03

UCP-neutral checkout

UCP checkout is adapter-neutral: the merchant advertises accepted instruments, and the buyer matches by instrument type. ACP checkout remains intentionally direct Stripe SPT-only.

example
createCheckoutServer(manifest, { psp: stripePsp(...) })
04

x402 paid HTTP resources

For pay-per-request APIs, x402Fetch lets a Wallet satisfy HTTP 402 challenges. Policy runs before PAYMENT-SIGNATURE, and x402Paywall delegates verify and settle to a facilitator you choose.

example
x402Fetch(wallet, { maxAmount: { amount: "0.10", currency: "USDC" } })
05

Open adapter contract

steelyard/psp is a thin, additive-only contract plus a framework-agnostic conformance kit. Ship a steelyard-psp-* adapter from your own repo and self-certify it.

example
runPspConformance(myAdapter)
06

Buyer-side policy engine

Agents ask a local engine for permission before a payment mandate exists. YAML policy, approval flow, reservation ledger, and audit log run in a separate process; rail keys stay out of the LLM runtime.

example
steelyard policy run --policy ~/.steelyard/policy.yaml
07

Cryptographic consent

AP2 mandates (SD-JWT+KB) and RFC 9421 HTTP Message Signatures, opt-in through UCP capability negotiation, isolated in steelyard/ucp-signing. Off by default; rigorous when on.

example
dev.ucp.shopping.ap2_mandate
08

Tested end-to-end

The current verify report shows 238 passing conformance cases across protocol, lifecycle, security, compatibility, PSP, and adapter-neutral checkout suites.

example
pnpm verify  ·  238 passed, 0 failed
03One manifest, five surfaces

Reachable by every agent runtime.

The same catalog answers an MCP tool call, an ACP feed reader, a UCP catalog request, and a plain curl. One source of truth, rendered for each protocol.

/.well-known/commerce.jsonStatic commerce manifest
/commerce/productsPlain HTTP read API
/mcpModel Context Protocol server
/acp/feedAgentic Commerce Protocol feed
/.well-known/ucpUniversal Commerce Protocol discovery + catalog
04Free validators

Check protocol JSON before an agent sees it.

Two public diagnostic tools use Steelyard's own SDK validators: an ACP schema validator and a UCP validator for discovery/profile JSON.

ACP Schema Validator

Paste or fetch ACP feed and discovery JSON, then inspect SDK-backed schema errors.

/acp/feed/.well-known/acp.json
open

UCP Validator

Validate /.well-known/ucp discovery or UCP profile JSON with readiness warnings.

/.well-known/ucp
open
05Packages

Install the umbrella, or just the parts.

steelyard

The front door. defineCommerce, serveCommerce, the protocol handlers, Wallet, PSP adapters — one install, one import.

↗steelyard/next

Next.js adapter. App Router and Pages Router handlers, the createCommerceRoutes factory, and the dev inspector page template that steelyard init writes.

↗steelyard/cli

The steelyard command. init scaffolds five route files into a Next.js app; enable checkout verifies your Stripe key and probes the agentic-payments capability.

↗steelyard/core

Manifest schema, validation, canonical hashing, and the shared payment-contract types.

↗steelyard/protocol/*

MCP, ACP, UCP, commerce.json, and the plain HTTP read API, all from one manifest.

↗steelyard/buyer

Wallet facade, encrypted vault, signed receipts, and the explore-and-buy client.

↗steelyard/x402

Paid HTTP resources: x402Fetch, x402Payments, x402Paywall, exactUsdc, and facilitator client boundaries.

↗steelyard/policy

Buyer-side permission engine: YAML rules, approvals, reservation ledger, local IPC, and audit chain.

↗steelyard/policy-rail-card

Stripe Issuing adapter that mints constrained virtual cards and normalizes settlement webhooks.

↗steelyard/merchant

Checkout server, PSP adapters, and mandate verification for ACP and UCP.

↗steelyard/psp

The public PSP adapter contract plus a conformance kit. Depend on this to ship an adapter.

↗steelyard/stripe/buyer

First-party Stripe Shared Payment Token issuer for the wallet.

↗steelyard/ucp-signing

AP2 mandates and RFC 9421 signatures. Optional; loaded only when negotiated.

↗
Full reference in the docs.

Open source. MIT.
Ship adapters from your own repo.

Star on GitHubRead the docs