@decionis/commerce
Advanced tools
MCP server that lets an AI agent check a price change, inventory update, order, fulfillment step, promotion, refund or return against your margin, stock and refund policy before it acts, authorize Dynamics 365 transactions within an agent budget, and read
CommerceGate MCP gives operations agents a tenant-bound Shadow Mode preflight for price, inventory, order, fulfillment, promotion, refund, and return actions, plus enforced Dynamics 365 transaction authorization, signed decision evidence, and reports.
The server runs locally over STDIO and calls the Decionis API. commercegate_evaluate_action records a Shadow Mode policy evaluation; it does not execute the proposed action in a marketplace or ERP. commercegate_validate_erp_transaction performs enforced binary policy and agent-budget authorization for a complete Dynamics 365 transaction, but it does not post, release, modify, or otherwise write that transaction. Refund, oversell, and other connector execution paths remain separate and are available only when the connected platform exposes the required API, the merchant grants its required scope, and the Commerce Gate connector implements and enables that path.
Package: @decionis/commerce
PRICE_CHANGEINVENTORY_MUTATIONORDER_ACCEPTANCEFULFILLMENT_ACTIONPROMOTION_CHANGEREFUND_REQUESTRETURN_AUTHORIZATIONcommercegate_validate_erp_transactionOutcomes map to the operator vocabulary used across Commerce Gate: APPROVE → PROCEED, REVIEW → HOLD, ESCALATE → HOLD, and REJECT → BLOCK. Stop on HOLD, BLOCK, an error, or an ambiguous response. PROCEED is a policy result, not consent to execute.
CommerceGate requires Node.js 20 or later. Start the pinned public package with:
npx -y @decionis/commerce@0.1.3
The process starts without credentials so an MCP client can discover its capabilities. The ERP guard requires DECIONIS_API_KEY; Protocol evaluation and evidence tools require both DECIONIS_API_KEY and DECIONIS_ORG_ID. Store DECIONIS_API_KEY in the MCP client’s secret or environment manager; never place it in command arguments, source control, prompts, or logs. DECIONIS_API_BASE is optional and defaults to https://api.decionis.com.
For a capability-only startup, omit the credential variables and call commercegate_describe_capabilities. Every authenticated call fails closed until its required configuration is available.
Forward the three named variables from the environment that launches Codex:
[mcp_servers.commercegate]
command = "npx"
args = ["-y", "@decionis/commerce@0.1.3"]
env_vars = ["DECIONIS_API_KEY", "DECIONIS_ORG_ID", "DECIONIS_API_BASE"]
enabled = true
required = false
startup_timeout_sec = 20
tool_timeout_sec = 45
default_tools_approval_mode = "writes"
enabled_tools = [
"commercegate_describe_capabilities",
"commercegate_validate_erp_transaction",
"commercegate_evaluate_action",
"commercegate_get_dossier",
"commercegate_get_proof_packet",
"commercegate_list_shadow_reports",
"commercegate_summarize_shadow_reports",
]
| Tool | Purpose | External effect |
|---|---|---|
commercegate_describe_capabilities | Inspect action coverage, safety guarantees, connector boundaries, and connection state | None; local only |
commercegate_validate_erp_transaction | Enforced binary authorization for one complete D365 transaction | Policy decision and idempotent agent-budget authorization only |
commercegate_evaluate_action | Check a price change, stock change, order, fulfillment step, promotion, refund or return | Writes only a Shadow Mode evaluation/evidence record |
commercegate_get_dossier | Read a signed Decision Dossier by UUID | Protocol tenant read |
commercegate_get_proof_packet | Read a dossier proof packet by UUID | Protocol tenant read |
commercegate_list_shadow_reports | Read recent Shadow Mode evaluation rows | Protocol tenant read |
commercegate_summarize_shadow_reports | Read aggregate Shadow Mode outcomes and near misses | Protocol tenant read |
Every action includes a stable actor, a platform, and a bounded idempotency_key. The payload is selected by action_type:
| Action type | Payload |
|---|---|
ORDER_ACCEPTANCE | nullable order_id, gross_amount, discount_amount, estimated_cost, optional currency |
PRICE_CHANGE | sku, nullable from_price, to_price, optional nullable estimated_cost, optional currency |
INVENTORY_MUTATION | sku, nullable from, to, optional location_id |
FULFILLMENT_ACTION | order_id, action (acknowledge, ship, cancel, or hold) |
PROMOTION_CHANGE | nullable promotion_id, percentage_fraction, ends_at, status, and combines_with |
REFUND_REQUEST | order_id, amount, optional currency and reason_code |
RETURN_AUTHORIZATION | order_id, optional rma_id and amount |
Order acceptance and price change have native CommerceGate margin mappings. The other five action types are generic Protocol Shadow evaluations: the server validates and normalizes their shape, but the result is only as complete as the active tenant policy and the submitted facts. A verdict says whether the action clears policy, not whether the platform's connector can carry it out.
The ERP guard accepts a bounded erp_region and the complete canonical D365 request: transaction_id, erp_type, tenant_id, timestamp, agent_id, currency, and 1–200 line records. It sends the configured API key as X-Decionis-API-Key and the region as X-ERP-Region. An ALLOW response means the exact request cleared enforced policy and its idempotent agent-budget authorization; it is not user consent and the MCP still performs no ERP write. The guard returns a reason code and message but does not promise a retrievable Decision Dossier or proof packet for that call.
The Shadow Report tools accept an optional days window from 1–365 and limit from 1–100. Both read the canonical /v1/protocol/shadow-reports document; the list tool presents operational rows while the summary tool presents its aggregate view.
With DECIONIS_API_KEY and DECIONIS_ORG_ID set in the MCP process environment, call commercegate_evaluate_action with:
{
"action": {
"action_type": "REFUND_REQUEST",
"actor": { "type": "AGENT", "id": "support-agent" },
"platform": "walmart-marketplace",
"idempotency_key": "order:123:refund:line-1:v1",
"payload": {
"order_id": "123",
"amount": 180,
"currency": "USD",
"reason_code": "CustomerReturn"
}
},
"policy_version": "commerce-2026-09"
}
The response contains the Protocol evaluation, the normalized CommerceGate disposition, and explicit agent guidance. It also states that no downstream action was executed. A separate Walmart connector can submit a product-line refund only for an eligible shipped or delivered line and only up to its remaining refundable product amount; this MCP call neither checks that live order state nor submits the refund.
commercegate_evaluate_action is hard-locked to SHADOW. It may create an evaluation and Decision Dossier, but it never executes the proposed action.commercegate_validate_erp_transaction is an enforced ALLOW/BLOCK decision and can reserve agent budget idempotently. It never writes the transaction to Dynamics 365.APPROVE is evidence, not user consent and not permission to mutate a marketplace.REJECT means stop. REVIEW or ESCALATE means hold and involve an authorized human.DECIONIS_ORG_ID; tools never accept an organization override. The ERP guard instead authenticates the submitted tenant_id with the configured API key.Refund and oversell controls are connector-gated. Depending on the connector, Commerce Gate may return a decision, withhold order release, or submit an explicitly confirmed action. A connected status alone is not enough: execution requires the marketplace API, merchant-granted scope, implemented and enabled connector path, and explicit execution authority. If any condition is missing, the capability remains evaluation-only or unavailable.
Current shipped examples:
| Protocol outcome | CommerceGate disposition | Agent behavior |
|---|---|---|
APPROVE | PROCEED | Preflight passed; proceed only when the user separately authorized execution and the connector confirms support. |
REJECT | BLOCK | Stop. |
REVIEW, ESCALATE | HOLD | Hold and route to an authorized human. |
| Missing or unknown | HOLD | Fail closed and ask an operator to inspect the dossier. |
The ERP guard uses a separate binary vocabulary: ALLOW maps to PROCEED for the exact validated transaction, while BLOCK means stop. ALLOW remains authorization evidence rather than user consent, and no ERP write occurs inside the MCP.
| Environment variable | Required | Secret | Meaning |
|---|---|---|---|
DECIONIS_API_KEY | For every authenticated call | Yes | Sent as bearer for Protocol or X-Decionis-API-Key for ERP guard |
DECIONIS_ORG_ID | For Protocol calls | No | UUID that permanently scopes Protocol evaluation and evidence |
DECIONIS_API_BASE | No | No | API origin; defaults to https://api.decionis.com |
The API base must use HTTPS. HTTP is accepted only for loopback development.
pnpm --filter @decionis/commerce typecheck
pnpm --filter @decionis/commerce test
pnpm --filter @decionis/commerce build
pnpm --silent --filter @decionis/commerce mcp
CommerceGate MCP runs on your machine and talks to one service: the Decionis API at https://api.decionis.com (or the origin you set in DECIONIS_API_BASE). It has no telemetry, no analytics, no crash reporting and no other network destination. The full Decionis privacy policy is at https://decionis.com/privacy; this section describes what this server specifically does.
What it collects. Nothing on its own. Everything it sends is what the agent passes into a tool call: the commerce facts being checked (SKU, current and new price or quantity, landed cost, order amounts, discount, refund amount and reason, promotion facts, actor type and a non-secret actor identifier, platform, idempotency key), a dossier UUID for evidence reads, and a report window for Shadow reports. It never reads files, browser data, clipboard or anything else on the machine.
Where it goes and why. Tool inputs are sent over HTTPS to the Decionis API to evaluate them against your organization's policy and to read evidence you already own. The request carries your DECIONIS_API_KEY as a bearer token, your DECIONIS_ORG_ID to scope the call to your organization, and a user-agent naming this package and version. Credentials are read from the process environment, never written to disk or logs by this server, and never returned in any tool result.
What is stored. Decionis stores the evaluation as a signed Decision Dossier in your organization's workspace so it can be verified later; that is the product. Retention follows your Decionis plan and the Decionis privacy policy. This server itself stores nothing: no cache, no log file, no local database. On a failed request it writes one fixed line to stderr with no request contents.
Third parties. None. Decionis does not sell or share tool inputs, and this server contacts no third-party service. Your MCP client (Claude Desktop, Codex, VS Code or another host) may log tool calls under its own policy.
Personal data. Commerce facts can include order identifiers and, if you pass them, customer-related amounts. Send only what the policy check needs; the server accepts a bounded, typed action and rejects unknown fields.
Your controls. Remove DECIONIS_API_KEY and DECIONIS_ORG_ID and the server can only describe its capabilities. Uninstall the package or extension to stop all processing. To access, correct or delete dossiers held by Decionis, or to ask anything about this policy, write to mailto:commerce@decionis.com; security reports go to mailto:security@decionis.com (see https://commerce.decionis.com/.well-known/security.txt).
FAQs
MCP server that lets an AI agent check a price change, inventory update, order, fulfillment step, promotion, refund or return against your margin, stock and refund policy before it acts, authorize Dynamics 365 transactions within an agent budget, and read
We found that @decionis/commerce demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Security News
Lovable’s OJ rewrites Vite’s dev server in Rust, reducing memory use and preview times as AI lowers the cost of open source reimplementation.
Security News
It has been one year since Shai-Hulud made its first appearance on npm.
Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.