Commerce Gate MCP

Commerce Gate MCP evaluates seven published tenant-bound commerce actions by default in Shadow Mode, provides an enforced Dynamics 365 transaction guard, and includes a separate marketplace SaaS offer-submission preflight. The unreleased commerce-preflight-v2 source candidate in this checkout adds four finance action families, for eleven in total; they require a matching backend, evaluate in SHADOW only, and never move money.

Shadow Mode evaluates the supplied tenant-scoped commerce facts and records policy evidence without blocking the native commerce flow; it is not a synthetic-data mode. When the customer activates an implemented, connected native enforcement path, that executor can block or hold the platform action outside this MCP. commercegate_evaluate_action itself never executes a marketplace or ERP action. commercegate_validate_erp_transaction performs enforced binary policy and agent-budget authorization for a complete Dynamics 365 transaction, but it does not post, release, modify, or otherwise write that transaction. Refund, oversell, and other connector execution paths remain separate and are available only when the connected platform exposes the required API, the merchant grants its required scope, and the Commerce Gate connector implements and enables that path.

Package: @decionis/commerce

Decionis CommerceAgent

Decionis CommerceAgent is the name for an AI agent that runs commerce operations through Commerce Gate: it observes listings, orders and refunds, proposes one exact action with its facts, calls this MCP, and stops on HOLD, BLOCK, an error or an ambiguous response. On PROCEED the merchant's own repricer, ERP, marketplace connector or a named person performs the action. It pairs with Decionis PolicyAgent, which authors the policy it operates under. The package, server, binary and tool identities on this page are unchanged; CommerceAgent names the agent that uses them. It is not a buyer-facing shopping assistant and not a payment gateway. Documentation: https://commerce.decionis.com/mcp

Development now belongs to the Commerce repository at packages/mcp. The published 0.1.6 package remains available with its public release source. This working tree also contains an unreleased source candidate, versioned 0.2.0. It is not published; the sixteen-check changes and the CommerceAgent run tools need a matching deployed backend before publication. The historical release source does not describe a future build. The MCP itself writes nothing. Decionis CommerceAgent writes only through a connector the customer enabled, only on PROCEED, and every write carries its dossier.

What operators use it for

• “Would repricing this SKU to $89 still clear our margin floor?” → PRICE_CHANGE
• “Would reducing this location from 47 to 7 units breach the inventory floor?” → INVENTORY_MUTATION
• “Would accepting this discounted order clear its supplied economics?” → ORDER_ACCEPTANCE
• “May this order be acknowledged, shipped, cancelled, or held?” → FULFILLMENT_ACTION
• “Does this proposed promotion need review?” → PROMOTION_CHANGE
• “Does this refund request fit the active policy?” → REFUND_REQUEST
• “May this return or RMA be authorized?” → RETURN_AUTHORIZATION
• “May this vendor payment be released under the approver's authority and today's liquidity floor?” → PAYMENT_RELEASE (unreleased source candidate)
• “Is this vendor bank-detail change inside the beneficiary change window?” → VENDOR_BANK_CHANGE (unreleased source candidate)
• “Is this early-payment discount worth taking against our cost of funds?” → EARLY_PAYMENT_DISCOUNT (unreleased source candidate)
• “May this customer credit hold be released?” → CREDIT_HOLD_RELEASE (unreleased source candidate)
• “Does this complete Dynamics 365 transaction clear policy and the agent budget?” → commercegate_validate_erp_transaction
• “Is this Microsoft Partner Center or AWS Marketplace SaaS offer packet ready for manual submission?” → commercegate_evaluate_marketplace_offer_submission
• “What would Shadow Mode have held this month, and why?” → the Shadow Report tools
• “Finance needs the signed evidence for this dossier.” → the dossier and proof-packet tools

Outcomes map to the operator vocabulary used across Commerce Gate: APPROVE → PROCEED, REVIEW → HOLD, ESCALATE → HOLD, and REJECT → BLOCK. Stop on HOLD, BLOCK, an error, or an ambiguous response. PROCEED is a policy result, not consent to execute.

Install

Commerce Gate requires Node.js 20 or later. Start the pinned public package with:

npx -y @decionis/[email protected]

The process starts without credentials for capability discovery. For an unconfigured local STDIO client on macOS or Linux, the first valid commercegate_evaluate_action call creates a provisional Shadow workspace without a registration form. It reuses that workspace on later calls and restarts. Discovery, invalid input, evidence reads, and ERP calls never create a workspace. Provisional access is subject to the service's trial limits and cannot authorize ERP transactions.

Automatic local provisioning is unavailable on Windows until equivalent secure credential persistence is supported; configure existing credentials there.

Local access is stored separately from AgentSafe in $AGENTOPS_HOME/credentials.json, or $XDG_CONFIG_HOME/agentops/credentials.json (default ~/.config/agentops/credentials.json). On POSIX systems the directory is owner-only (0700) and the file is owner-only (0600). A private exclusive lock coordinates concurrent processes. A persistent attempt marker prevents a second mint after an uncertain response, crash, or lost credential. Corrupt, permissive, missing-after-attempt, or revoked credentials fail closed: restore the owned credential or contact support rather than deleting setup files to obtain another trial. Safe tool results identify provisional access and provide claim guidance without exposing the key or claim tokens.

Existing DECIONIS_API_KEY and DECIONIS_ORG_ID configuration takes precedence. Store keys in the MCP client's secret manager; never place them in command arguments, source control, prompts, or logs. DECIONIS_API_BASE defaults to https://api.decionis.com and also accepts the exact /aws gateway prefix. Set AGENTOPS_AUTO_PROVISION=0 to disable new trial creation; already stored credentials remain usable. NODE_ENV=production and HTTP transport never provision anonymous access. For capability-only use, disable automatic provisioning and supply no stored or configured credentials.

The configured base selects an API transport; accepting a base URL does not establish every tool's route coverage.

| Calls | Base and authentication | Boundary | | -------------------------------------- | -------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------- | | Protocol evaluation and evidence | Direct API origin (default https://api.decionis.com); Bearer key and configured organization | Core preflight does not require an AWS purchase. Evaluation sends the action's stable Idempotency-Key. | | Protocol through Commerce's AWS facade | Exact https://commerce.decionis.com/aws base; granted Commerce credential and bound organization | The facade has a scoped route allowlist and server-side entitlement checks. | | Dynamics 365 transaction guard | Direct API origin; X-Decionis-API-Key and X-ERP-Region | /aws/v1/guard/validate is not exposed by the facade. | | Managed HTTP history | Exact /aws base with authorized history access | An extension with its own entitlement, separate from core preflight. |

Registry sign-in

The same MCP package is published across registries. accounts.decionis.com owns the Decionis Account sign-in. Microsoft surfaces can use Microsoft Entra, and AWS surfaces can use Login with Amazon through that Account flow. Those sign-ins establish the Decionis session; they do not pass marketplace credentials into the MCP. A Marketplace offer packet still carries only bounded identity evidence: Entra tenant and application IDs for Microsoft, or a Login with Amazon subject linked to an AWS account and IAM role for AWS Marketplace.

Codex client configuration

Optionally forward existing credentials and local access preferences from the environment that launches Codex:

[mcp_servers.commercegate]
command = "npx"
args = ["-y", "@decionis/[email protected]"]
env_vars = ["DECIONIS_API_KEY", "DECIONIS_ORG_ID", "DECIONIS_API_BASE", "AGENTOPS_HOME", "AGENTOPS_AUTO_PROVISION"]
enabled = true
required = true
startup_timeout_sec = 20
tool_timeout_sec = 45
default_tools_approval_mode = "writes"
enabled_tools = [
  "commercegate_describe_capabilities",
  "commercegate_validate_erp_transaction",
  "commercegate_evaluate_action",
  "commercegate_get_dossier",
  "commercegate_get_proof_packet",
  "commercegate_list_shadow_reports",
  "commercegate_summarize_shadow_reports",
  "commercegate_evaluate_marketplace_offer_submission",
]

Tools

| Tool | Purpose | External effect | | ---------------------------------------------------- | ------------------------------------------------------------------------------------------------- | -------------------------------------------------------------- | | commercegate_describe_capabilities | Inspect action coverage, Walmart connection mappings, safety guarantees, and connector boundaries | None; local only | | commercegate_validate_erp_transaction | Enforced binary authorization for one complete D365 transaction | Policy decision and idempotent agent-budget authorization only | | commercegate_evaluate_action | Check a price change, stock change, order, fulfillment step, promotion, refund or return | Writes only a Shadow Mode evaluation/evidence record | | commercegate_evaluate_marketplace_offer_submission | Check a Microsoft Partner Center or AWS Marketplace SaaS offer packet before manual submission | Writes only a Shadow Mode evaluation/evidence record | | commercegate_get_dossier | Read a signed Decision Dossier by UUID | Protocol tenant read | | commercegate_get_proof_packet | Read a dossier proof packet by UUID | Protocol tenant read | | commercegate_list_shadow_reports | Read recent Shadow Mode evaluation rows | Protocol tenant read | | commercegate_summarize_shadow_reports | Read aggregate Shadow Mode outcomes and near misses | Protocol tenant read |

Action contract

Every action includes a stable actor, a platform, and a bounded idempotency_key. The payload is selected by action_type:

| Action type | Payload | | ---------------------- | ------------------------------------------------------------------------------------------------------ | | ORDER_ACCEPTANCE | nullable order_id, gross_amount, discount_amount, estimated_cost, optional currency | | PRICE_CHANGE | sku, nullable from_price, to_price, optional nullable estimated_cost, optional currency | | INVENTORY_MUTATION | sku, nullable from, to, optional location_id | | FULFILLMENT_ACTION | order_id, action (acknowledge, ship, cancel, or hold) | | PROMOTION_CHANGE | nullable promotion_id, percentage_fraction, ends_at, status, and combines_with | | REFUND_REQUEST | order_id, amount, optional currency, reason_code, remaining_refundable, prior_refund_count | | RETURN_AUTHORIZATION | order_id, optional rma_id and amount |

Order acceptance and price change have native Commerce Gate margin mappings. The other five action types are generic Protocol evaluations that carry the supplied tenant-scoped facts in default Shadow Mode; the result is only as complete as the active tenant policy and those facts. Synthetic values are reserved for explicit trial and preflight test paths, never substituted for a commerce action evaluation. A verdict says whether the action clears policy, not whether the platform's connector can carry it out.

The ERP guard accepts a bounded erp_region and the complete canonical D365 request: transaction_id, erp_type, tenant_id, timestamp, agent_id, currency, and 1–200 line records. It sends the configured API key as X-Decionis-API-Key and the region as X-ERP-Region. An ALLOW response means the exact request cleared enforced policy and its idempotent agent-budget authorization; it is not user consent and the MCP still performs no ERP write. The guard returns a reason code and message but does not promise a retrievable Decision Dossier or proof packet for that call.

The candidate ERP backend normalizes only tenant UUID casing for transaction identity, preserving organization, agent and complete transaction identifiers. A single equivalent legacy reservation keeps its original stored key. Multiple equivalent reservations return HTTP 200/BLOCK and AGENT_BUDGET_REQUEST_CONFLICT, preserving every row and spent amount for controlled reconciliation.

The candidate binds configured-budget reservations to the current canonical request. A changed request for the same unambiguous transaction with an equal or older timestamp returns the same conflict, preserving the reservation and spent amount. Exact current retries retain their budget result; strictly newer revisions undergo budget authorization. This is not a wall-clock expiry rule, and no budget revision history is kept without a configured budget. It requires the matching backend deployment with old guard writers drained. This MCP source also reports that conflict as budget DENIED; it is not part of the published 0.1.6 client, and no new publication or hosted availability is established by this checkout.

Sixteen-check preflight contract — unreleased source candidate

This checkout adds an explicit commerce-preflight-v2 option. It requires a matching backend and an authorized tenant policy. The same contract adds four finance action families, PAYMENT_RELEASE, VENDOR_BANK_CHANGE, EARLY_PAYMENT_DISCOUNT and CREDIT_HOLD_RELEASE, and five finance checks (P12–P16); the MCP parses and evaluates them in SHADOW only and never moves money, changes vendor master data or releases credit. The published @decionis/[email protected] installation instructions above do not install this unreleased change. Existing calls without preflight keep their current SHADOW contract; the eight tool names, ERP guard, history tools, and marketplace-offer preflight are unchanged.

Supply the usual action and, optionally, an exact policy_version, together with:

{
  "preflight": {
    "version": "commerce-preflight-v2",
    "facts": {
      "source": "merchant.erp",
      "observed_at": "2026-10-05T08:00:00Z",
      "currency": "USD",
      "cost_basis": { "source_cost": 60, "system_of_record_cost": 60 },
      "region": { "country": "SE" },
      "contract": { "account_type": "retail" }
    }
  }
}

The values above are synthetic documentation facts, not a production evaluation. Use the actual observation time and source for a real proposal. Amounts use the action currency; estimated_cost includes fees and landed costs. Facts are caller assertions: the MCP does not read or independently verify a connected platform. The pricing group is for promotion projections; ordinary price and order economics remain in the action payload. Other bounded groups cover inventory, discounts, promotion reuse, refundable balance, prior refunds, lifecycle state and, for the finance families, payment authority, beneficiary verification state and treasury position. Neither the facts nor any action payload has a field for a full bank account number: a vendor bank change carries a SHA-256 account hash and the last four digits only, and the parser refuses anything else. The schema has no fields for raw customer identities, addresses, or credentials and rejects unknown fields, caller-supplied policy thresholds, and tenant or enforcement overrides. Do not place secrets or personal details in free-text labels.

The server evaluates these business checks. Applicability and policy settings remain server-owned; the client does not calculate their decisions.

| ID | Check | | --- | ---------------------------------------------------- | | P01 | Net margin floor | | P02 | Cost-basis integrity | | P03 | Inventory availability and consistency | | P04 | Regional eligibility | | P05 | Discount stacking | | P06 | B2B contract-price conformity | | P07 | Promotion abuse indicators | | P08 | Refundable balance | | P09 | Unattended refund limit | | P10 | Repeat-refund policy | | P11 | Order, fulfillment, and return lifecycle eligibility | | P12 | Payment release authority | | P13 | Duplicate invoice | | P14 | Beneficiary change window | | P15 | Liquidity floor | | P16 | Early-payment discount yield |

The tool exposes the server's result as preflight and retains it in evaluation.commerce_preflight. Every response has exactly one row per check: evaluated, not_applicable, disabled, missing_facts, or unsupported, with a verdict where required, reason codes, missing facts, and optional measurements. Missing or unsupported required checks hold; an entirely unassessed action cannot proceed. Omitted facts are never replaced with invented values.

The client verifies the version, SHADOW mode, action type, idempotency key, exact policy when requested, and SHA-256 digests of the sent action and facts using RFC8785/JCS. It rejects missing, inconsistent, or differently bound results and any overall Protocol outcome weaker than the preflight disposition. It never retries by removing preflight. The existing fallback_to_legacy flag describes continuation of the native flow in SHADOW; a complete versioned result is still required regardless of that flag.

The candidate Commerce /aws facade uses commerce-preflight-transport-v1 to bind its agreement-scoped retry key while preserving the original action and result. Its marker is reserved service metadata; it is not an MCP tool argument. A matching Protocol/API backend and explicitly authorized Commerce service are required. Local HTTP verification does not establish hosted staging, a public remote MCP endpoint, or Copilot Studio readiness. Published 0.1.6 remains unchanged.

The sixteen checks are distinct from the eleven action families and from native connector coverage. execution_available remains false; a preflight neither reserves nor executes a platform operation. Dossier and proof-packet retrieval remain separate evidence tools, and neither a preflight result nor its digest is execution consent. Capability discovery describes this opt-in contract without claiming that the configured backend or a connector is ready.

CommerceAgent runs — unreleased source candidate

commerce-agent-run-v1 is the bounded mandate Decionis CommerceAgent operates under. The four run tools are registered only when the MCP process starts with COMMERCEGATE_AGENT_RUNS=1; the default inventory above is unchanged, and the published 0.1.6 package does not include them. commercegate_describe_capabilities always reports the candidate under agent_runs with enabled true or false.

| Tool | Purpose | External effect | | ------------------------------------- | ------------------------------------------------------------------------------------------------ | ------------------------------------------------- | | commercegate_agent_start_run | Open one run: objective, platforms and records in scope, action budget, exposure budget, horizon | None; a run row in this process | | commercegate_agent_get_run | Read a run's state, budgets, horizon and recent proposals | None | | commercegate_agent_record_proposal | Record an evaluated proposal under the run with its outcome, dossier reference and amount | Debits the run budgets; never executes the action | | commercegate_agent_stop_run | The kill switch; idempotent and final | None | | commercegate_agent_get_budget | Read the agent's month envelope and what its runs used and still reserve | None | | commercegate_agent_forecast_mandate | Replay the previous three months of recorded proposals against a proposed mandate | None |

A run binds to the configured organization, never to a caller-supplied one. The objective fixes which action families may be proposed: hold_margin_floor admits price, order-acceptance and promotion proposals; hold_inventory_floor admits stock and order-acceptance proposals; review_orders admits order-acceptance and fulfillment proposals; review_refunds admits refund and return proposals; review_promotions admits promotion proposals; release_payments admits payment-release, early-payment-discount and credit-hold-release proposals. No objective admits a vendor bank change, which is never agent-proposed. Every recorded proposal consumes one action. A PROCEED with an amount also consumes that amount from the exposure budget, in the budget currency only. A proposal outside the objective, outside the platform scope, in another currency, after the horizon or beyond a budget is refused with a reason code; refusals consume nothing, and an exhausted budget closes the run. The same idempotency key replays the same receipt; the same key with different input is a conflict. The horizon is at most 31 days and expiry is observed on the next read.

An operator can set a month envelope per agent on the backend ledger (PUT /v1/commerce/mcp/agent/budgets/{agent_id}, owner or admin role, never through an agent tool). A run then starts only if its action and exposure budgets fit the envelope's remaining room for the current UTC month: closed runs count what they used, active runs count everything they were granted, and a mandate in another currency is refused. commercegate_agent_get_budget reads the view; without an envelope it carries usage only. A Decionis organization key with the AGENT role is the agent itself: the backend ledger binds its runs and budget to the key's own id (name it as agent.id), refuses any other agent id with COMMERCE_AGENT_IDENTITY_MISMATCH and the expected id, and lets it read only its own runs and budget; human keys may run or read on behalf of any agent. A workspace owner or admin issues an agent key on the Commerce dashboard's Agent budgets page; the key is shown once, Commerce never stores it, and reissuing creates a new agent id.

A proposal may carry a cost the agent reports for producing it: provider, model, input and output tokens, and an amount in the run currency (an amount in another currency is refused). Commerce Gate records these totals on the run and in the budget view and never prices them itself. The budget view also carries the three previous UTC months of usage so an operator can size the envelope, and GET /v1/commerce/mcp/agent/budgets lists every agent with an envelope or a run this month.

Without a backend, run state is held in process memory and is lost on restart; the tools say so in every response (durability: process_memory). With COMMERCEGATE_AGENT_RUNS_BACKEND set to the HTTPS origin of a Commerce API that enables its run ledger (COMMERCE_AGENT_RUNS_ENABLED=1), runs become tenant-bound rows under /v1/commerce/mcp/agent, bound to the configured organization key: every proposal is applied under the run's row lock, a PROCEED must cite a dossier, and every cited dossier is read from Core with the caller's credential and must belong to the organization and agree with the recorded outcome where the record carries a decision. Responses then report durability: backend_ledger and a dossier_verification of none, existence or outcome. The facade's source contract is api/openapi/AgentRuns.v1.yaml, published in the Commerce Gate OpenAPI on https://api.decionis.com, default-off and outside the default MCP operations. Recording a proposal never executes it: PROCEED remains policy evidence, and the merchant's own repricer, ERP, marketplace connector or a named person performs the action. See https://commerce.decionis.com/mcp for the CommerceAgent loop.

Marketplace SaaS offer-submission preflight

commercegate_evaluate_marketplace_offer_submission is separate from the eleven commerce-action contracts. It accepts one complete SAAS offer packet: publisher and offer IDs; unique plan IDs with billing terms and market codes; public HTTPS landing, connection-webhook, support, privacy, and terms URLs; an explicit marketplace identity; optional Business Central extension identity; and digest-bound release evidence. Microsoft Partner Center packets require Microsoft Entra tenant and application IDs. AWS Marketplace packets require the Login with Amazon subject that is linked to the seller's AWS account and IAM role with offer-management access. It rejects credentials, URL query strings and fragments, incomplete evidence, duplicate plan or market IDs, and customer-commerce fields before it creates a non-blocking preflight evaluation. The packet uses release metadata and preview or test evidence; the tool does not read customer commerce records from a marketplace.

The tool does not call a marketplace, upload an artifact, create or change an offer, or submit an offer for review. PROCEED is policy evidence for the exact packet, never consent or authority to submit it.

The Shadow Report tools accept an optional days window from 1–365 and limit from 1–100. Both read the canonical /v1/protocol/shadow-reports document; the list tool presents operational rows while the summary tool presents its aggregate view.

Minimal end-to-end example

With existing credentials, or to create a provisional local Shadow workspace on first use, call commercegate_evaluate_action with:

{
  "action": {
    "action_type": "REFUND_REQUEST",
    "actor": { "type": "AGENT", "id": "support-agent" },
    "platform": "walmart-marketplace",
    "idempotency_key": "order:123:refund:line-1:v1",
    "payload": {
      "order_id": "123",
      "amount": 180,
      "currency": "USD",
      "reason_code": "CustomerReturn"
    }
  },
  "policy_version": "commerce-2026-09"
}

The response contains the Protocol evaluation, the normalized Commerce Gate disposition, and explicit agent guidance. It also states that no downstream action was executed. A separate Walmart connector can submit a product-line refund only for an eligible shipped or delivered line and only up to its remaining refundable product amount; this MCP call neither checks that live order state nor submits the refund.

Safety contract

• commercegate_evaluate_action defaults to SHADOW: it evaluates supplied tenant-scoped facts without blocking a native commerce flow and may create a Decision Dossier. Customer-activated native enforcement is separate from this MCP; the MCP never executes the proposed action.
• commercegate_validate_erp_transaction is an enforced ALLOW/BLOCK decision and can reserve agent budget idempotently. It never writes the transaction to Dynamics 365.
• commercegate_evaluate_marketplace_offer_submission is a bounded non-writing preflight. It validates release metadata and preview or test evidence without reading customer commerce records or writing to either marketplace.
• APPROVE is evidence, not user consent and not permission to mutate a marketplace.
• REJECT means stop. REVIEW or ESCALATE means hold and involve an authorized human.
• Protocol calls are bound to DECIONIS_ORG_ID; tools never accept an organization override. The ERP guard instead authenticates the submitted tenant_id with the configured API key.
• Tenant failures and unknown outcomes fail closed to HOLD. The process never silently routes around Commerce Gate.
• API credentials are never returned. Safe errors omit configured organization values and upstream response bodies.
• Connector execution is conditional and separate. Do not translate an unavailable action into a different action type.

Connector boundary

Refund and oversell controls are connector-gated. Depending on the connector, Commerce Gate may return a decision, withhold order release, or submit an explicitly confirmed action. A connected status alone is not enough: execution requires the marketplace API, merchant-granted scope, implemented and enabled connector path, and explicit execution authority. If any condition is missing, the capability remains evaluation-only or unavailable.

Current shipped examples:

• Walmart Marketplace has a Commerce Gate connector. commercegate_evaluate_action is the preflight for Commerce Evaluation, Price Guard (PRICE_CHANGE), and Order Guard (ORDER_ACCEPTANCE). The same preflight maps order interception and margin protection to ORDER_ACCEPTANCE; it maps release to FULFILLMENT_ACTION with acknowledge, and hold or cancel to FULFILLMENT_ACTION with hold or cancel. The connected path implements interception, fee-aware margin protection, optional scoped inventory protection, Walmart acknowledgment release, withheld-acknowledgment hold, and operator-confirmed cancel. Capability discovery does not probe a merchant connection, and none of those writes are exposed through this MCP.
• Walmart supports order reads, policy-evaluated acknowledgment, and operator-confirmed ship, cancel, and product-line refund paths. Refunds are limited to eligible shipped or delivered lines and the remaining refundable product amount. None of those writes are exposed through this MCP.
• Shopify Functions enforce configured margin rules at checkout, in discount handling, and in payment-method selection. A separate Shopify Flow action performs a post-order Shopify inventory-floor check and records a decision; it does not hold, cancel, modify, or refund the order, and it does not currently compare another marketplace’s inventory.

Outcome semantics

| Protocol outcome | Commerce Gate disposition | Agent behavior | | -------------------- | ------------------------- | ---------------------------------------------------------------------------------------------------------------- | | APPROVE | PROCEED | Preflight passed; proceed only when the user separately authorized execution and the connector confirms support. | | REJECT | BLOCK | Stop. | | REVIEW, ESCALATE | HOLD | Hold and route to an authorized human. | | Missing or unknown | HOLD | Fail closed and ask an operator to inspect the dossier. |

The ERP guard uses a separate binary vocabulary: ALLOW maps to PROCEED for the exact validated transaction, while BLOCK means stop. ALLOW remains authorization evidence rather than user consent, and no ERP write occurs inside the MCP.

Configuration

| Environment variable | Required | Secret | Meaning | | ---------------------------- | --------------------------------- | ------ | ----------------------------------------------------------------------------------------------------------- | | DECIONIS_API_KEY | Existing workspace option | Yes | Sent as bearer for Protocol or X-Decionis-API-Key for ERP guard | | DECIONIS_ORG_ID | With an explicit key for Protocol | No | UUID that scopes Protocol evaluation and evidence | | DECIONIS_API_BASE | No | No | HTTPS API origin or exact /aws prefix; raw AWS secret defaults to https://commerce.decionis.com/aws | | AGENTOPS_ACCESS_SECRET_ARN | Managed access option | No | AWS Secrets Manager secret read through the execution role | | AGENTOPS_AWS_BOOTSTRAP | AgentCore Marketplace option | No | Set to 1 by the AgentOps image; proves the runtime's AWS identity and receives in-memory AgentSaaS access | | AGENTOPS_HOME | No | No | Private local trial directory; separate from AgentSafe | | AGENTOPS_AUTO_PROVISION | No | No | Set 0 to disable new local trial creation |

The API base must use HTTPS. HTTP is accepted only for loopback development.

Run it as a remote server (Amazon Bedrock AgentCore Runtime)

AgentOps is the container delivery of the same Commerce Gate MCP server, listed as "AgentOps MCP Server for Amazon Bedrock AgentCore" on AWS Marketplace. It speaks streamable HTTP for buyers who run their agents in Amazon Bedrock AgentCore Runtime. Start it with --http (or MCP_TRANSPORT=http): it listens on 0.0.0.0:8000, answers POST /mcp with one JSON-RPC message per request (stateless; the runtime's Mcp-Session-Id is echoed), and GET /ping with {"status":"Healthy"}. There is no server-initiated stream.

The AgentOps container is free on Marketplace; service usage is billed through the AgentSaaS subscription, the API-based Marketplace product. Buyers pay their own AWS runtime and related infrastructure charges. No measured compute-cost, latency or throughput improvement is claimed here.

For local use, put your workspace's DECIONIS_API_KEY and DECIONIS_ORG_ID in an untracked agentops.env file. DECIONIS_API_BASE is optional and defaults to https://api.decionis.com. Keep this file private and bind the published local port to loopback:

chmod 600 agentops.env
docker buildx build -f packages/mcp/Dockerfile --platform linux/arm64 -t agentops-core:latest .
docker run -p 127.0.0.1:8000:8000 --env-file ./agentops.env agentops-core:latest
curl -X POST http://127.0.0.1:8000/mcp -H 'content-type: application/json' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

For the Marketplace AgentOps image, AGENTOPS_AWS_BOOTSTRAP=1 is set by default. The runtime uses its AgentCore execution role to pre-sign a one-minute STS GetCallerIdentity request. Commerce relays that proof only to AWS, checks the resulting account against an active AgentSaaS grant, and returns a one-hour key held in process memory. The image never receives an API key, organization ID, API-base value, Marketplace secret ARN, or AWS static credential through its environment.

For a self-managed AgentCore deployment, configure AGENTOPS_ACCESS_SECRET_ARN with a durable Secrets Manager secret and grant the execution role secretsmanager:GetSecretValue on that secret (and kms:Decrypt if it uses a customer-managed KMS key). The AWS SDK uses its default execution-role credential chain; the image contains no AWS access key. The secret may contain JSON with api_key, org_id, and api_base_url, or the raw dcn_aws_ Marketplace key. For a raw key, the server discovers its tenant through authenticated GET https://commerce.decionis.com/aws/commerce/session. An explicit DECIONIS_API_BASE may select another trusted deployment's exact /aws gateway. Redirects and any returned change to the configured origin or prefix are rejected.

The secret is loaded once on the first authenticated tool call and retained in memory for that process; errors never trigger key rotation or anonymous fallback. New AgentCore instances load the same durable secret, so ephemeral restarts retain the tenant. A deliberate credential rotation requires restarting the runtime. Existing DECIONIS_API_KEY and DECIONIS_ORG_ID launch variables remain supported and take precedence. HTTP requires configured access and never creates a trial. Capability discovery works without access. This client does not itself subscribe a buyer, create the durable secret, or grant its execution role; the deployment must supply those bindings. Requests are limited to 1 MiB, with eight in flight including uploads still being read; further requests receive 503 with Retry-After. JSON-RPC batches receive 400 without invoking a tool. Browser access is unsupported: every request carrying an Origin header receives 403. HTTP supports MCP versions 2025-03-26, 2025-06-18, and 2025-11-25; unsupported MCP-Protocol-Version headers receive 400, and a missing header uses the 2025-03-26 compatibility default. Keep this server behind AgentCore's authenticated runtime in production. Commerce's .github/workflows/commerce-agent-agentcore.yml verifies the image and provides an explicitly enabled manual publication path. Publisher identity and the AWS role's master-branch trust must be transferred before publication; merging the source does not publish an image. Listing versions use the pinned digest.

Historical assessment in managed HTTP

Managed HTTP retains all eight tools above and adds a 90-day historical assessment feature. This feature does not replace proposal evaluation, Dynamics 365 authorization or their existing permission boundaries. The STDIO package and Claude Desktop wrapper retain their eight-tool contract.

| Additional HTTP tool | Purpose | | ------------------------------------------ | ------------------------------------------------------------------------------ | | commercegate_list_history_sources | List the synthetic dataset and already connected stores available to the buyer | | commercegate_start_historical_assessment | Persist an idempotent assessment of the previous 90 days | | commercegate_get_historical_assessment | Read its immutable summary, provenance, policy and bounded evidence |

These tools require the Commerce Gate /aws gateway with its historical service deployed and enabled, plus a currently valid, server-verified AWS grant. A package or image release alone does not enable the service. Use the durable AgentSaaS access secret described above, or explicitly configure its key and DECIONIS_API_BASE=https://commerce.decionis.com/aws. History requests derive the workspace from the credential and never send an organization override. Grant eligibility and expiry are verified by the service on each request; the container does not invent an expiry or extend a trial.

The AWS trial lasts 14 days and uses a synthetic dataset representing 90 days of commerce history. It does not require live customer data. Real assessments currently read an already verified Adobe Commerce store connection; there is no CSV, generic transaction upload or store-connection tool in this contract. The client never creates an anonymous HTTP trial.

First list sources, then call the start tool with:

{
  "source": { "kind": "synthetic" },
  "idempotency_key": "history-demo-1"
}

For real history, use {"kind":"connected_store","connection_id":"<listed UUID>"} as the source. The service fixes the 90-day window, timestamps, policy and transactions. Callers cannot supply replacement dates, policies or raw transactions. Reuse the same idempotency key only for a retry of the same assessment, then read its assessment_id to retrieve the stored result.

The current cost_scope is merchandise_margin: subtotal less discounts and reported item cost. Shipping, tax, payment fees and platform fees are excluded; the result is not total transaction profit. Summaries retain missing costs, excluded timestamps and evaluation failures. Synthetic results identify a sample policy; real-store results identify the merchant policy. Historical PROCEED is a retrospective classification, not permission to execute an action. Evidence includes at most 100 records with hashed identifiers. The initial service scans at most 100 source records, so coverage.complete and truncated must be checked before treating a result as complete for the interval. Missing costs or unavailable policy must not be presented as successful evaluation. A failed assessment may have policy: null. A null proof_ref means no signed proof is available; sample margin calculations must not be described as signed Decision Dossiers. No history tool executes a platform write.

The history transport accepts only the exact /aws prefix, rejects redirects, limits responses to 100 KiB and validates returned source, policy, window, assessment identity and evidence. Errors omit upstream bodies and credentials. There is no fallback to another tenant, source or prospective evaluation.

Develop from source

Run these commands from the Commerce repository with Node.js 22 and pnpm 9.15.3:

pnpm install --frozen-lockfile --ignore-scripts
pnpm --filter @decionis/commerce contract:check
pnpm --filter @decionis/commerce typecheck
pnpm --filter @decionis/commerce test
pnpm --filter @decionis/commerce build
pnpm --silent --filter @decionis/commerce mcp

contract:sync copies Commerce's generated OpenAPI and preflight projection locally; contract:check rejects drift without a network request. After deploying the matching contract, compare the public OpenAPI separately with pnpm --filter @decionis/commerce exec node scripts/SyncContract.mjs --check --published. The canonical policy schemas remain in Decionis's shared contract package.

Private Commerce publication requires its own npm trusted publisher or scoped release token. npm cannot generate provenance for private source; do not reuse the historical public release's provenance. The candidate server.json omits the optional public repository field. Public product documentation and support remain available at https://commerce.decionis.com/mcp and https://decionis.com/contact.

Privacy Policy

Commerce Gate MCP talks to the configured Decionis API. The AgentOps Marketplace image also contacts AWS STS to generate an identity proof; managed deployments using AGENTOPS_ACCESS_SECRET_ARN contact AWS Secrets Manager through the AWS SDK credential chain. It has no telemetry, analytics, or crash reporting. The full Decionis privacy policy is at https://decionis.com/privacy; this section describes what this server specifically does.

What it collects. The first valid unconfigured local Shadow call sends the fixed agent name "AgentOps MCP Shadow" to obtain a provisional workspace. Other application data comes from tool inputs: the commerce facts being checked (SKU, current and new price or quantity, landed cost, order amounts, discount, refund amount and reason, promotion facts, actor type and a non-secret actor identifier, platform, idempotency key), a dossier UUID for evidence reads, and a report window for Shadow reports. The additional managed HTTP history tools send only a selected synthetic source or connected-store UUID, idempotency key, or assessment UUID; they do not accept uploaded customer transactions. The service reads authorized connected-store history separately. The server reads only its configured credentials and local access files; it does not read browser data, the clipboard, or unrelated machine data.

Where it goes and why. Tool inputs are sent over HTTPS to the Decionis API to evaluate them against your organization's policy and to read evidence you already own. The request carries your DECIONIS_API_KEY as a bearer token, your DECIONIS_ORG_ID to scope the call to your organization, and a user-agent naming this package and version. Credentials come from the process environment, private local access storage, or the configured AWS secret. Keys and claim tokens are never returned in tool results or written to logs.

What is stored. Existing Protocol policy evaluations may produce signed Decision Dossiers in your organization's workspace. Historical assessments instead persist their immutable summary, source and policy provenance, hashed record identifiers, and inline evaluation results; those results are unsigned when proof_ref is null. Do not describe a synthetic assessment as a signed dossier. Retention follows your Decionis plan and the Decionis privacy policy. Local trial access persists its credential, tenant binding, and setup marker in the private AgentOps directory. Managed AWS credentials remain in Secrets Manager and process memory; the server does not persist them locally. There is no tool-input cache, log file, or local evidence database. On a failed request it writes one fixed line to stderr with no request contents.

Third parties. Managed secret access uses AWS; commerce tool inputs still go only to the configured Decionis API. Decionis does not sell or share tool inputs. Your MCP client (Claude Desktop, Codex, VS Code or another host) may log tool calls under its own policy.

Personal data. Commerce facts can include order identifiers and, if you pass them, customer-related amounts. Send only what the policy check needs; the server accepts a bounded, typed action and rejects unknown fields.

Your controls. Set AGENTOPS_AUTO_PROVISION=0 to disable new local trial creation. To leave only capability discovery, also remove configured access and securely remove the stored credential; keep the attempt marker to prevent accidental reminting. Revocation and deletion of the server-side workspace are separate operations. Uninstall the package or extension to stop all processing. To access, correct or delete dossiers held by Decionis, or to ask anything about this policy, write to mailto:[email protected]; security reports go to mailto:[email protected] (see https://commerce.decionis.com/.well-known/security.txt).

Support and license

• Support: Contact Decionis
• License: Apache-2.0