drcano/readback

The safe way to let your AI shop with PayPal. Every purchase your agent makes, on the record.
Agent purchase mandates and dispute evidence, built entirely on PayPal's own records. Runs against the PayPal sandbox. Built for the PayPal AI Hackathon (2026).
The dispute layer the agent-payment standards leave out. Google's AP2 and Mastercard's Verifiable Intent define the evidence: the shopper's approved limits, pinning her agent's key, and a request her agent signs for each purchase. Both put dispute resolution out of scope. Readback is that missing procedure, running on PayPal today: it records both on PayPal's rails, and when she says "my AI bought that," it rebuilds the case from PayPal's records and checks it. (Why this, why PayPal)
| Rulings | 59/59 labeled scenarios behave as labeled. 0 wrong suggestions toward the seller, 0 toward the buyer (results) |
| Tampering | 2,000 random single-field mutations of an upheld case: 0 still upheld. 10,000 more in the core test suite |
| Storage | Zero. No database, no files, no caches of customer data. PayPal is the only system of record |
| Accessibility | axe-core: 0 WCAG 2.1 AA violations on 9 pages, light and dark |
Try it live: (PayPal sandbox, up through Dec 15, 2026). The home page shows both verdicts on two real sandbox charges, read from PayPal as you load it and re-checked in your browser; no sign-in needed. Or run it locally in a few minutes (Run it): both verdicts, the investigator, the evals and the AP2 check work without any credentials, on labeled fixture data. Watch the demo video.
Judging it in two minutes, no sign-in:
1. Open the live demo. "Same claim, two verdicts" shows two real sandbox charges on one shopper's agreement, read from PayPal as the page loads: one her agent signed (uphold the charge), one the store made itself (refund the buyer).
2. Open either case. Readback rebuilds it record by record from PayPal's APIs, then re-checks the signature and all eleven checks in your browser. Press Explain this case in plain English for Claude's brief, where every sentence cites a check or a PayPal record.
3. Try to break it. Run all eight attacks and see which layer stops each one: her agent, the store's gate, PayPal, or the investigator.
Then: ask the dispute queue a question (AG Grid, with Claude picking the filter), have Claude draft a shopper's terms, and see the change we ask PayPal to make.
## The problem
Maya asks her AI to keep her dog's food stocked. A month later a charge appears and someone says "I didn't buy this. My AI did."
PayPal says it evaluates such claims on the transaction itself, regardless of whether a person or an AI started it, and that it does not assess AI intent; an agent acting without authorization is typically reviewed as an unauthorized payment. Nothing in that review records what the shopper actually delegated. (WHY-PAYPAL.md §1, source S1)
Where a billing agreement existed but the dates and amounts agreed to couldn't be shown, UK ombudsman decisions have gone against PayPal. In the US, authorization turns on what authority the consumer gave. (§2)
PayPal's own developer blog says agent actions should stay attributable to the person who authorized them and the agent that executed them. (§1, P9)