feat(agentkit): Add PolicyCheck action provider for pre-purchase seller verification

[vibegpt]

Description

Adds a PolicyCheck action provider that enables AI agents to verify e-commerce seller policies before making purchases. This is the first pre-purchase seller verification tool in AgentKit, addressing the WISHLIST item "Integrate with commerce rails for agent payments".

Why this matters

As agentic commerce grows, AI agents need to verify seller trustworthiness before completing purchases. Visa has documented a 25% increase in malicious bot-initiated transactions, with fraudulent storefronts specifically targeting AI shopping agents. Currently, AgentKit has no tool for pre-purchase seller verification.

PolicyCheck fills this gap by analyzing seller return policies, shipping terms, warranty coverage, and terms of service to produce:

• Risk level (low/medium/high/critical)
• Buyer protection score (0-100)
• Key findings (specific policy issues detected)
• Recommendation (whether to proceed with purchase)

Actions added

Action	Description	Wallet Required
policycheck_analyze	Full policy analysis from text or URL	No
policycheck_check_url	Quick URL-based seller check	No

How it works

The action provider calls the PolicyCheck A2A API using the A2A (Agent-to-Agent) protocol via JSON-RPC 2.0. It's a walletless provider — no blockchain interaction needed, works on all networks.

Risk factors detected include:

• Missing or restrictive return policies
• Binding arbitration clauses
• Liability caps and class action waivers
• No warranty coverage
• Buyer-pays-return-shipping policies

Usage

import { policycheckActionProvider } from "@coinbase/agentkit";

const agentKit = await AgentKit.from({
  actionProviders: [policycheckActionProvider()],
});

Tests

13 unit tests covering success paths, error handling, URL delegation, and request format validation.

PASS src/action-providers/policycheck/policycheckActionProvider.test.ts
  PolicyCheckActionProvider
    constructor
      ✓ should use default API URL when no config provided
      ✓ should use custom API URL from config
    supportsNetwork
      ✓ should return true for any network
    analyze
      ✓ should return low-risk assessment for safe seller policies
      ✓ should return high-risk assessment for risky seller policies
      ✓ should send seller URL as data part with quick-risk-check skill
      ✓ should send policy text as text part
      ✓ should return error for API error response
      ✓ should return error for HTTP failure
      ✓ should return error for network failure
      ✓ should return error when no analysis data in response
      ✓ should include summary text when available
    checkUrl
      ✓ should delegate to analyze with sellerUrl

Test Suites: 1 passed, 1 total
Tests:       13 passed, 13 total

PolicyCheck is also live in the x402 Bazaar (#1 of 100 resources) and available as an MCP tool.

Checklist

• Added documentation to all relevant README.md files
• Added a changelog entry

[cb-heimdall]

🟡 Heimdall Review Status

Requirement	Status	More Info
Reviews	🟡 0/1	Denominator calculation Show calculation 1 if user is bot 0 1 if user is external 0 2 if repo is sensitive 0 From .codeflow.yml 1 Additional review requirements Show calculation Max 0 0 From CODEOWNERS 0 Global minimum 0 Max 1 1 1 if commit is unverified 1 Sum 2