Automate the pre-payment stages freely: product search, cart assembly, coupon application, and shipping address selection carry low financial risk and are reversible.
Before submitting payment, pause and present the full order summary (items, total, shipping, merchant name) to a human confirmation step — treat payment submission as a non-reversible action requiring explicit authorization unless the agent has a pre-approved budget for this merchant and amount.
If operating within a pre-approved budget: validate merchant domain against your allowlist, check the total against the per-transaction cap, confirm no 3DS challenge is expected for this card/merchant pair, then proceed.
For payment form submission, use a server-side tokenization flow where possible (e.g., if the merchant uses Stripe Elements or a known PSP, interact via API rather than DOM); direct DOM manipulation of payment fields is fragile and may violate PSP terms.
After order submission, capture the order confirmation number, receipt URL, and estimated delivery from the confirmation page; store these in your audit trail before the session ends.
If the checkout flow presents unexpected steps — CAPTCHA, phone verification, 2FA, or 3DS — immediately surface to the human rather than attempting to bypass; these signals exist to verify human presence.
Known gotchas
Many PSPs and merchants explicitly prohibit automated card entry in their terms of service — using a headless browser to fill payment fields may terminate your merchant account or the customer's account; check ToS before automating.
E-commerce checkout flows change frequently; a hardcoded DOM selector will break silently, causing the agent to submit incomplete or incorrect orders — build detection for unexpected page states and fail loudly.
Session and cookie state built up during cart assembly is often required for checkout; if the agent loses session continuity between steps (e.g., new browser context), the cart may empty or prices may change.
Give your agent this knowledge — and 200+ more routes
One MCP install gives any agent live access to the full route map, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp