
Security News
/Company News
Securing the Financial Frontier: How Capital One Uses Socket for Open Source Security
Capital One is partnering with Socket to proactively secure its open source supply chain.
@merchantguard/agent-sdk
Advanced tools
Compliance infrastructure for AI agents - GuardScore, 14 vertical coaches, alerts, PSP matching
Compliance infrastructure for AI agents. GuardScore, 14 vertical coaches, real-time alerts, PSP matching.
npm install @merchantguard/agent-sdk
import { createClient } from '@merchantguard/agent-sdk';
const guard = createClient();
// Check wallet compliance
const result = await guard.checkWallet('0x...');
console.log(`Score: ${result.score}, Approved: ${result.approved}`);
// Ask the CBD compliance coach
const decision = await guard.coach.cbd('Can I sell delta-8 gummies online?');
console.log(decision.answer);
// Get critical alerts
const alerts = await guard.alerts.critical(['cbd', 'crypto']);
| Feature | Description |
|---|---|
| Wallet Verification | GuardScore (0-100) + NFT passport check |
| 14 Compliance Coaches | CBD, Crypto, Nutra, VAMP, Gaming, Adult, and more |
| Real-time Alerts | PSP policy changes, regulatory updates, VAMP warnings |
| PSP Matching | Find processors that accept your vertical |
| Passport Management | Soulbound NFT on Base/Arbitrum |
Access 14 vertical-specific AI compliance coaches:
// Ask any coach
const decision = await guard.coach.ask('cbd', 'What health claims can I make?');
// Shorthand methods
await guard.coach.cbd('Can I ship to Idaho?');
await guard.coach.crypto('Do I need a money transmitter license?');
await guard.coach.nutra('What are the FTC rules for free trials?');
await guard.coach.vamp('My chargeback rate is 1.2%, what should I do?');
await guard.coach.highRisk('Stripe rejected me, what now?');
await guard.coach.pspMatch('I need processing for CBD doing $50k/month');
| Vertical | Coach Focus |
|---|---|
cbd | THC compliance, COA requirements, shipping restrictions |
crypto | KYC/AML, Travel Rule, MTL licensing |
nutra | FTC claims, Click-to-Cancel, subscription rules |
adult | 2257 compliance, age verification, billing descriptors |
gaming | State licensing, UIGEA, responsible gambling |
travel | Future delivery risk, cancellation policies |
ticketing | Primary/secondary market, delivery guarantees |
subscriptions | Cancellation flows, auto-renewal disclosures |
ecommerce | PCI DSS 4.0, return policies, FTC Mail Order Rule |
bnpl | CFPB rules, fee disclosures, credit reporting |
mexico | CNBV, Ley Fintech, SPEI/CoDi |
vamp | GuardPay Health Bands, remediation planning |
high-risk | MATCH list recovery, reserve negotiation |
psp-match | PSP recommendations based on vertical + volume |
telehealth | HIPAA, Ryan Haight Act, state licensing |
interface DecisionObject {
vertical: string;
decision: 'allow' | 'block' | 'allow_with_conditions' | 'require_human_review';
risk_level: 'low' | 'medium' | 'high' | 'critical';
confidence: number;
required_actions: Array<{
id: string;
severity: 'must' | 'should' | 'recommended';
description: string;
}>;
policy_citations: Array<{
source: string;
id: string;
title: string;
}>;
answer: string;
disclaimer: string;
}
const result = await guard.checkWallet('0x...');
console.log({
approved: result.approved, // true/false
score: result.score, // 0-100
riskLevel: result.riskLevel, // LOW | MEDIUM | HIGH | CRITICAL
hasNFT: result.hasNFT, // Has GuardScore passport NFT
credentials: result.credentials, // ['MGPASS', 'MGKYB', etc.]
});
const wallets = ['0x...', '0x...', '0x...'];
const results = await guard.checkMultipleWallets(wallets);
results.forEach((result, wallet) => {
console.log(`${wallet}: ${result.score}`);
});
const check = await guard.beforeTrade({
protocol: 'GMX',
counterparty: '0x...',
amount: '10000',
});
if (!check.approved) {
console.log(`Blocked: ${check.reason}`);
}
// Get all alerts for your verticals
const alerts = await guard.alerts.list({
verticals: ['cbd', 'crypto'],
maxResults: 10,
minSeverity: 5,
});
// Critical only (severity >= 8)
const critical = await guard.alerts.critical(['cbd']);
// Subscribe to webhook
await guard.alerts.subscribe('https://your-agent.com/webhook', ['cbd', 'crypto']);
interface Alert {
id: string;
title: string;
summary: string;
severity: number; // 1-10
category: 'PSP' | 'Regulatory' | 'Compliance' | 'Industry' | 'VAMP';
source: string;
date: string;
industries: string[];
actionRequired?: string;
}
const matches = await guard.psp.match({
vertical: 'cbd',
monthly_volume: 50000,
region: 'US',
current_issues: ['Stripe rejected'],
});
console.log(matches.matched_psps);
// [
// { name: 'Durango', fit_score: 95, ... },
// { name: 'Payzli', fit_score: 90, ... },
// { name: 'PayKickstart', fit_score: 85, ... }
// ]
// Calculate GuardScore
const score = await guard.guardscore.calculate({
chargebackRatio: 0.8,
refundRate: 5,
accountAge: 365,
vertical: 'cbd',
});
// Get health band (instant, no API call)
const band = guard.guardscore.getHealthBand(1.2);
// { band: 'ELEVATED', threshold: '1.1% - 1.7%', action: 'Immediate action required...' }
| Band | Threshold | Action |
|---|---|---|
| SAFE | < 0.9% | Maintain current practices |
| WARNING | 0.9% - 1.1% | Take preventive action |
| ELEVATED | 1.1% - 1.7% | Implement RDR and 3DS |
| CRITICAL | > 1.7% | Contact acquirer immediately |
Note: These are internal conservative thresholds. Always verify official Visa VAMP thresholds with your acquirer.
// Check passport
const passport = await guard.passport.get('0x...');
if (passport) {
console.log(`Tier: ${passport.tier}, Score: ${passport.score}`);
}
// Issue passport (requires API key)
const guard = createClient({ apiKey: 'your-key' });
await guard.passport.issue({ wallet: '0x...', initialScore: 75 });
// Update score
await guard.passport.updateScore('0x...', 85);
const guard = createClient({
apiUrl: 'https://merchantguard.ai/api', // API endpoint
apiKey: 'your-api-key', // For authenticated ops
network: 'arbitrum', // or 'base'
minScore: 60, // Minimum for approval
requireNFT: false, // Require passport NFT
strictMode: false, // Only verified wallets
cacheTTL: 300000, // Cache 5 minutes
});
| Method | URL | Best For |
|---|---|---|
| NPM Package | npm install @merchantguard/agent-sdk | AI agents, Node.js apps |
| MCP Server | https://merchantguard-mcp-810654658669.us-central1.run.app | Claude.ai, MCP clients |
| REST API | https://merchantguard.ai/api/v2/coach/{vertical} | Any HTTP client |
| OpenClaw Skill | openclaw skill install guardbot-verification | OpenClaw agents |
MIT - See LICENSE file
Built with love by MerchantGuard
FAQs
Compliance infrastructure for AI agents - GuardScore, 14 vertical coaches, alerts, PSP matching
We found that @merchantguard/agent-sdk demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
/Company News
Capital One is partnering with Socket to proactively secure its open source supply chain.

Security News
Socket CTO Ahmad Nassri discusses how to keep AI agents from bypassing package blocks, limit credential access, and monitor their actions.

Security News
GPT-6 Astra tried to plant malicious code in simulated open source projects using fake GitHub accounts and deceptive PRs during an assigned CTF challenge.