# Aisle

> The store built for AI agents. Current availability: an authenticated mock-only sandbox. Real purchasing is disabled; no live supplier is connected.

## Start here
- [Developer quickstart](https://aisle.market/docs): Access requirements, remote MCP configuration, initialize, tools/list, approval and error handling.
- [Protocol capabilities](https://aisle.market/docs/protocols): Implemented and planned capabilities; limitations and real discovery URLs.
- [Capability status JSON](https://aisle.market/capabilities.json): Informational status only, not a protocol discovery manifest.
- [Supplier inquiries](https://aisle.market/docs/suppliers): Marketing invitation for suppliers to contact Aisle directly about selling through the store. No self-service signup or catalog upload. Email supplier@aisle.market to discuss selling through Aisle.
- [Trust and legal status](https://aisle.market/trust): Seller name supplied by operator: Aisle Market LLC, Delaware, United States. Verification, terms, privacy, shipping/return/refund policy and support contacts pending.
- [Support availability](https://aisle.market/support): Public contact not yet supplied.

## Actual sandbox API
- [Health](https://agent-store-sandbox.agent-store-2ba49950.workers.dev/health): mode=mock, live_purchases=false.
- [OpenAPI](https://agent-store-sandbox.agent-store-2ba49950.workers.dev/openapi.json): Implemented REST API, authenticated private routes.
- [Custom sandbox service discovery](https://agent-store-sandbox.agent-store-2ba49950.workers.dev/.well-known/agent-store.json): Nonstandard service metadata.
- [PAP/Poppy guest preview discovery](https://agent-store-sandbox.agent-store-2ba49950.workers.dev/.well-known/poppy.json): Draft 0.2 signed-out read-only MCP subset.
- [OAuth metadata](https://agent-store-sandbox.agent-store-2ba49950.workers.dev/.well-known/oauth-authorization-server): Actual issuer and token endpoint.
- [MCP resource metadata](https://agent-store-sandbox.agent-store-2ba49950.workers.dev/.well-known/oauth-protected-resource/mcp): Exact bound resource.

MCP endpoint: https://agent-store-sandbox.agent-store-2ba49950.workers.dev/mcp. Streamable HTTP POST JSON-RPC 2.0; protocol version 2025-06-18. Requires an operator-issued scoped bearer credential. No public signup or credential issuance. Do not invent a token or claim connection without a successful response. Server-side clients only for cross-origin use; authenticated GET /mcp returns 405.

Initialize, notify initialized, then tools/list. Eight tools: suppliers, search, quote, buy, track, cancel, return. MCP writes require idempotency_key; REST writes require Idempotency-Key. Quote TTL 120 seconds. Agent credentials cannot mint spending approval; a separate human-held approver credential authorizes a bound quote. Mock payment token is mock_payment_authorized; never send real card data or payment tokens.

MCP: implemented sandbox, not third-party certification. ACP: single-item ACP-shaped mock preview, full conformance unvalidated. PAP/Poppy: guest MCP preview for preregistered clients with ES256 assertions and pinned metadata/JWKS; sign-in, Account Tokens and DPoP unimplemented. Use the existing sandbox hostname as issuer/audience/resource; do not substitute aisle.market. UCP, AP2 and A2A: planned, unimplemented; no discovery manifests or Agent Card.

The default catalog is empty until an operator publishes an approved supplier feed. Catalog-only products have no verified stock or price and cannot be bought. include_mock=true includes test fixtures. All transaction flows, prices, taxes, orders, tracking and payments remain mock. Do not present them as real inventory, offers or purchases. Supplier review drafts do not imply contracts, product rights or connectivity. No platform endorsements or confirmed integrations are claimed. Supplier partnerships begin with direct contact, not self-service enrollment. Supplier inquiries: supplier@aisle.market (direct conversation, no self-service). Public support contact is pending. Status reviewed 2026-10-22.