Agent Commerce
Star on GitHub

Commands

agent-commerce validate

Run the config checks the gateway runs at startup, and exit non-zero on any of them.

Usagebash
agent-commerce validate [--config <path>] [--env-file <path>]

Options

--config <path>
Path to the config. Default: AGENT_COMMERCE_CONFIG, then config.yaml.
--env-file <path>
Load environment variables before reading the config. Variables already set in the environment take precedence.

Runs the same config validation as gateway startup and exits 1 on any failure. No running gateway is needed.

Output

$ agent-commerce validate --config config.yaml
PASS  Configuration is valid
      merchant: Demo Merchant (demo-merchant)
      resources: 2
      protocols: http=on mcp=on a2a=off acp=off
      payments: x402=on mpp=off
      authorization: ap2=off

What it checks

  • unknown keys, missing fields, unsupported version, unresolved ${VAR};
  • duplicate resource ids, pricing.type: dynamic, paid resources without payments;
  • exposure on disabled protocols, overlapping or conflicting mounts;
  • input bindings, backend headers, ACP mappings, AP2 trust keys, deprecated store paths that collide with each other or the receipt database, MPP challenge settings;
  • x402 offers: duplicate options or ones that mix local, testnet and mainnet, two networks sharing one RPC endpoint, a redeclared built-in network, a misplaced x402.accepts, a local facilitator on any network but eip155:31337, another token on Solana or NEAR, and a price label other than USD or USDC for a network's USDC;
  • invalid URLs: auth.type: cdp with a url other than CDP's, or an RPC URL outside http(s);
  • addresses, networks and every mainnet guardrail.

An EVM address is checked for its form, 0x and 40 hex characters. Gateway startup also checks the EIP-55 checksum of a mixed-case address, and provider construction checks keys and RPCs.

It also warns about JSON Schema keywords the validator ignores, such as pattern and minLength. These warnings go to stderr and start with [agent-commerce], not WARN.