Agentic commerce assurance
CRAB independently reconstructs whether the transaction and the authority behind it remained correct as AI agents move through commerce — from product selection and cart state to delegated intent and payment execution evidence.
PASSFAILBLOCKEDUNPROVEN
Evidence at every step. Not another readiness score.
Why the problem exists
Agentic commerce now runs two ways. Protocols make stores machine-accessible. Browser agents need nothing from the merchant at all. Either way, the commercial transaction can go wrong between the first click and the payment handoff.
An agent can now operate an ordinary storefront even when the merchant has implemented no agentic-commerce protocol.
Run today. Controlled missions on Magento / Adobe Commerce, Shopify, WooCommerce storefronts.
Independent transaction evidence
PASSFAILBLOCKEDUNPROVEN
The same four states, on whichever path the agent takes. CRAB does not implement either path, so it can verify both.
Protocol conformance improves machine access. Protocol availability alone does not prove the intended transaction stays correct.
In scope, being expanded. Today CRAB records which agent-commerce profiles a store publishes (ACP, UCP, MCP), and its evidence model can read the merchant's own cart API on Shopify and WooCommerce to compare it with the browser cart. End-to-end protocol missions are not yet run.
What CRAB tests
Reaching checkout is not success if the wrong transaction got there. CRAB follows the intended transaction step by step and names the step where it stopped being correct.
Did the agent reach the intended product?
Did size, colour or configuration remain correct?
Did the intended SKU actually enter the cart?
Did the commercial price remain correct?
Did geography or fulfilment change the transaction, or leave the total undeterminable?
Did the cart state survive the transition to checkout?
Was the transaction executed against the current authorised intent, limits and lifecycle state? CRAB reconstructs the evidence; it does not initiate payment.
Something in the cart is not success. The right product in the cart is. A sibling SKU, a wrong size, a wrong colour or a wrong edition is a failed transaction, not a near miss.
Transaction correctness is not enough
An agent can select the right product, calculate the right amount and reach the right payment rail — and the transaction can still be wrong if the authority used for execution was stale, revoked, superseded or outside an authorised budget.
Mandate and intent version. CRAB records the authority that was registered, authenticated and in force, including lifecycle state and applicable limits where evidence is available.
Authorised state ↔ state actually used
CRAB compares the current authorised version with the version, lifecycle state and limits relied upon at execution. Initial prompt versus final order is not enough.
Refund, cancellation and dispute. CRAB checks whether later events remain linked to the governing intent and whether participant access or changes can be reconstructed.
Controlled browser missions still stop before payment. Intent-lifecycle review uses available transaction and participant evidence; CRAB does not initiate payment. Emerging standards work, including EMVCo's draft Agentic Payments Framework v1.0, informs this research capability. CRAB does not claim EMV compliance, certification, approval or conformance.
Result model
The expectation was checked against evidence and held.
The expectation was checked against evidence and did not hold. The step where it broke is named.
The system under test prevented the check — a bot wall, a protection layer, a refusal. A statement about the store, not a guess.
The check was attempted, but the evidence does not settle it. A statement about CRAB's evidence, never promoted to a pass.
The worst step decides the result: a blocked or unproven step is never hidden by a neighbouring pass. A step that was never attempted is reported as NOT TESTED, not as a pass. No numeric score — a critical failure cannot be averaged away.
Readiness versus execution
A storefront can publish correct protocol metadata and still fail during execution. A browser agent can click through a site and still select the wrong variant, lose cart state, calculate an unexpected total, hit a shipping restriction, fail at checkout — or hand the wrong transaction to payments.
Is the required surface available?
Did the intended transaction remain correct — and was it executed under the authority actually in force?
CRAB does not sell manifest validation, a readiness score or an “AI-ready” badge. CRAB reconstructs the evidence chain from authorised intent to executed transaction.
The critical path is deterministic and evidence-driven. The result does not depend on whether one AI model happened to get through a site once, or on a model's judgement of whether a task felt successful.
A store can pass dozens of technical checks and still fail the one step that matters. CRAB reports the state of each step and where the transaction stopped being correct.
CRAB does not build feeds, integrations or protocol implementations. Your team, agency or platform makes the change; CRAB verifies whether the transaction actually holds. That independence is the product.
Who CRAB is for
Browser-agent infrastructure, agent runtimes, browser automation platforms, AI shopping agents.
The problem
Your agent can operate a browser. Your customers need proof that real commerce missions stay commercially correct.
What CRAB gives you
Shopify and WooCommerce agencies, ecommerce integrators, plugin vendors, managed commerce hosts, commerce platforms.
The problem
A theme, plugin, shipping, tax or checkout change can break agentic execution while human checkout still works.
What CRAB gives you
PSPs, acquirers, payment networks, issuers, bank fraud/risk teams, payment orchestration providers and agent-payment developers.
The problem
An agentic payment can be technically valid while relying on the wrong, stale, revoked, superseded or exceeded authority.
What CRAB gives you
How a controlled mission works
Agree the store, the product, the variant and the path to test.
CRAB runs the bounded mission on the agreed path.
Each step is captured as it happens, not reconstructed afterwards.
Every assertion is tied to captured evidence, or it is not made.
PASS, FAIL, BLOCKED or UNPROVEN per step, with the exact failure location.
After your team changes something, the same mission runs again.
Browser missions are bounded and authorised. They stop at the payment boundary: no order is placed, no payment is submitted, no customer identity is fabricated. Separate intent-lifecycle evidence reviews can analyse supplied or observable participant records without executing a payment.
Why now
Commerce protocols, browser agents and agent-payment infrastructure are moving into real merchant environments. That creates a new assurance problem: the infrastructure can work while the transaction is still wrong. CRAB exists to test that gap, independently.
Validated inspection support
What one CRAB mission covers
CRAB verifies whether the intended product and variant survive into the resulting cart state.
Learn more
Every assertion is tied to captured evidence. Nothing is asserted without it.
Learn more
A failure is located at the step where the transaction stopped being correct.
Learn more
Missions stop at the payment boundary. No order placed, no payment submitted.
Learn more
Independent
The first engagement
CRAB runs a bounded agentic-commerce mission against an agreed transaction path and returns:
Start with your own store
Free first check. No card. We confirm you are authorised for the store, then CRAB runs the mission — results are not instant.
Full evidence pack: CRAB Inspection — €149 per store, one-time, including one reinspection after you have fixed what it found.
Agencies, platforms, agent and payment infrastructure: scope a mission — regression missions and client assurance are agreed per engagement.
No. CRAB stops at the payment boundary. It never submits payment and never places an order.
No. Every step is PASS, FAIL, BLOCKED or UNPROVEN, backed by evidence.
Readiness tools report whether a surface is available to agents. CRAB observes execution and reports whether the intended transaction remained correct, with evidence.
Protocols make agent transactions possible. Implementing one does not prove the transaction behaves correctly — and agents on the browser path will not use it at all.
Not end to end. Today CRAB records published agent-commerce profiles, and its evidence model can compare the merchant's own cart API with the browser cart on Shopify and WooCommerce. Protocol-path missions are being expanded.
No. CRAB uses an evidence-driven process with defined probes and classification rules.
No purchase. No payment submitted. No customer data fabricated. No admin credentials. No numeric score.
