MandateFuzz

A CLI and GitHub Action that generates signed AP2 payment mandates, then breaks them the way a bug or an attacker would, so a merchant's checkout-agent integration fails in CI instead of in production.

Problem

Google's Agent Payments Protocol (AP2) went live as an open, payment-method-agnostic spec in September 2025, and Visa and Mastercard joined as launch partners the same month, so a merchant can now implement one mandate-verification layer instead of separate per-network integrations. That layer checks a chain of cryptographically signed Intent, Cart, and Payment Mandates built on W3C Verifiable Credentials before releasing funds. The spec and a reference implementation live on GitHub, but nobody independently certifies a merchant's verification code. A missed check in that layer can move real money against a mandate that was never actually authorized.

Target user

The backend engineer who got handed the "add agent checkout" ticket at a mid-size e-commerce or SaaS company, with a deadline tied to the 2026 holiday shopping season. They're writing the code that accepts an incoming mandate chain and decides whether to charge the card. They don't have a Visa or Mastercard sandbox account yet, and they want to know their verification logic actually rejects a forged or malformed mandate before a real agent (or a hostile one) gets to test that for them.

MVP scope

• CLI that generates a valid AP2 Intent → Cart → Payment mandate chain against a local test keypair, so a merchant can replay a full signed checkout flow without network-provider credentials
• A mutation suite covering the failure modes that matter: expired mandate, cart total that doesn't match the linked payment mandate, reused nonce, substituted merchant ID, stripped or downgraded signature, and a payment mandate with no valid cart mandate behind it
• Report of which mutations the target endpoint wrongly accepted, with the specific field that should have failed verification
• Drop-in GitHub Action that runs the same suite against a staging endpoint on every pull request, so a broken check fails the build instead of a transaction
• Fixture set of known-good mandate chains pulled from the public AP2 reference implementation, so a new integrator has something correct to diff their own output against
• Everything scoped to test keys with no live network calls, stated loudly in the README so the tool reads as a conformance suite and not a mandate-forging kit

Monetization

Freemium. The CLI, mutation suite, and GitHub Action are open source (MIT). The paid tier runs the same suite on a schedule against a merchant's staging environment and pages the team when a deploy regresses a previously-passing check, billed per merchant account per month.

Why now

AP2 is a live, Apache-2.0-licensed spec with Visa and Mastercard both wrapping their own network tokens inside its mandate envelope as of September 2025, which means merchants are building against it now rather than waiting for a mature ecosystem. At the same time, Stripe/OpenAI's ACP, Coinbase's x402, and Stripe/Tempo's MPP are separate agent-payment protocols shipping in the same year, so a team integrating agent checkout is likely wiring up more than one verification path at once, under the same deadline pressure, with no shared test harness for any of them.

Risks & open questions

• Demand-side: agent checkout adoption is still concentrated among larger retailers in 2026; if a team hasn't started that integration yet, this tool has nothing to test against
• Build-side: the mutation generator has to produce mandates that are correctly formed except for the one deliberate flaw, which means getting the W3C Verifiable Credential signing right first, or every result is noise
• Scope is AP2-shaped mandates only; a team that integrated ACP or x402 instead gets no coverage from this tool
• A tool whose core feature is generating fake signed payment authorizations will draw scrutiny regardless of intent, and the test-keys-only framing needs to hold up under actual security review, not just a README claim

Next step

Build the mandate generator and mutation suite against the public AP2 reference implementation first; hold off on the GitHub Action until the suite catches at least one real verification bug in a toy merchant server.

Sources

• https://en.wikipedia.org/wiki/Agentic_commerce — AP2 announcement date, the Intent/Cart/Payment mandate structure, and the GitHub-hosted spec
• https://eco.com/support/en/articles/15192001-what-is-mastercard-agent-pay-ai-agent-commerce-protocol-in-2026 — Mastercard Agent Pay launch date and Mastercard joining AP2 in September 2025, including how the mandate envelope wraps network tokens
• https://www.reactify-solutions.com/articles/agentic-commerce-protocols-2026 — the four separate agent-payment protocols (AP2, ACP, x402, MPP) live in 2026, and AP2's basis in W3C Verifiable Credentials