From 0 to Agent-Ready: The Trusteed Developer Guide

This guide walks you through every step of connecting your e-commerce store to AI agents via Trusteed. By the end, you will have a live MCP endpoint, a synced product catalog, agent-ready tools (search_products, create_cart, complete_checkout), a trust score visible to agents, and a merchant dashboard showing real-time sessions and analytics. Time required: about 10 minutes for basic setup, about 30 minutes for full configuration. Prerequisites: an active store on Shopify, WooCommerce, or Odoo with at least one published product.

Trusteed acts as a bridge between your existing e-commerce platform and AI agents. It syncs your product catalog to a normalized database (30-minute cache), exposes standardized MCP tools that any agent can call, handles rate limiting, authentication, and trust scoring, and is not a payment processor or merchant of record: where a charge happens, it is made on your own payment account. On a Shopify store, complete_checkout hands the buyer a link to your native checkout. Agents browse and create carts; customers complete payment on your checkout.

Sign up at trusteed.xyz/dashboard. Authentication uses magic links: enter your email, click the link, you are in. No passwords to manage. Public access is currently handled as free beta onboarding with fair-use protections, including enough MCP capability to test search, browsing, cart, and checkout flows end-to-end before any later commercial rollout.

For Shopify: click Add Store, enter your mystore.myshopify.com domain, and authorize via OAuth. The platform syncs your catalog automatically using cursor-based pagination (handles 10K+ products). Uses Shopify GraphQL Admin API with auto-refreshing OAuth tokens. Inventory tracked via inventoryQuantity with fallback to in_stock. For WooCommerce: install the Trusteed WordPress plugin, copy your Consumer Key and Consumer Secret from WooCommerce Settings REST API. The plugin pushes changes via WordPress hooks (on_product_save, on_stock_change, on_product_delete). Uses REST API v3 with HTTP Basic Auth, supporting full and incremental sync. For Odoo: enter your instance URL (SaaS or self-hosted), authenticate with API key (recommended over password), and select product categories to sync. Uses Odoo XML-RPC API. After connecting, your store gets a unique slug and your MCP endpoint goes live.

Your endpoint is immediately available for read-only tools without authentication. 11 tools are public (no auth required): search_products, get_product_details, browse_categories, get_merchant_profile, search_global_products, get_store_policies, check_availability, compare_products, get_deals, get_reviews, search_knowledge. Checkout tools (create_cart, preview_checkout, complete_checkout) require an Agent API Key or OAuth Bearer token. Example search: POST https://trusteed.xyz/{slug}/mcp with JSON-RPC body calling search_products.

For checkout flows, agents need to authenticate. Option A (recommended): Agent API Key: generate from Dashboard, Store Settings, API Keys. Pass via X-Agent-Api-Key header. Keys are hashed with HMAC-SHA256; the platform never stores the raw key. Option B: OAuth 2.0 Bearer Token for machine-to-machine (M2M) integrations via /api/v1/auth/login. For Claude Desktop / Claude.ai integration, add an mcpServers entry with your store URL and API key in the headers. Claude can then search products, create carts, and complete checkouts through natural conversation.

The full agent checkout sequence: (1) search_products to find products, (2) get_product_details to confirm price and availability, (3) create_cart to add items and get a cart_id, (4) preview_checkout to see total with shipping and tax, (5) get_shipping_rates for available options, (6) select_shipping_option for the agent to pick a method, (7) complete_checkout, which returns a status: COMPLETED with an order_id, or PENDING_EXTERNAL_CONFIRMATION with the link where the human completes payment (on a Shopify store, your native checkout page). The platform never handles credit cards. Checkout sessions are encrypted (AES-256-GCM) with a 30-minute TTL.

Three discovery mechanisms: (1) Merchant Directory (automatic). Your store is listed at /.well-known/merchant-index.json and /api/v1/stores/directory with slug, categories, trust score, and MCP endpoint. (2) NLWeb Semantic Search: POST /{slug}/ask with natural language queries, uses pgvector embeddings, results stream via SSE. (3) Machine-Readable Discovery Files: /llms.txt, /mcp.json, /.well-known/acp.json, /.well-known/ucp, /.well-known/agent-policy.json, /.well-known/agent-card.json. These files are how Claude, ChatGPT, and other LLMs learn about the platform.

Trust Score v4.1 combines three weighted dimensions with an optional external-assurance bonus and confidence-tier caps. Each response identifies the engine used; some responses fall back to legacy v2. A legacy v2 component breakdown does not explain an overall score produced by v4.1.

Register webhook endpoints via POST /api/v1/webhooks with events: order.created, order.status_changed, checkout.abandoned. Verify payloads using HMAC-SHA256 signature in X-Webhook-Signature header with crypto.timingSafeEqual for constant-time comparison.

Trusteed supports 9 payment protocols: MCP, x402, ACP, UCP, Visa VIC, Mastercard MCAP, PayPal, SCP, and MPP (coming soon), plus AG-UI for human-in-the-loop checkout and A2A for agent-to-agent communication. Each protocol is auto-detected. Agents send requests in their preferred format; the platform normalizes everything to a unified AgentPaymentIntent.