A project starter for an Agentic Commerce Protocol (ACP) merchant server. It sets up dependencies, imports API descriptions and data schemas, configures the environment, and creates initial endpoint placeholders.

Use it when starting an ACP implementation in a supported web framework, including setting up validation, authentication-related libraries, configuration, and checkout endpoints.

It removes much of the repetitive setup needed before implementing an ACP service and gives the project a starting structure based on the protocol specification.

acp-setup — Skill for Claude Code by OrcaQubits

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add OrcaQubits/agentic-commerce-skills-plugins --skill acp-setup

Clone the repo

git clone --depth 1 https://github.com/OrcaQubits/agentic-commerce-skills-plugins

Made for: Claude Code.

Or install acp-agentic-commerce, the plugin that ships this one along with the rest of its 17 skills, 1 agent.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/orcaqubits/agentic-commerce-skills-plugins/acp-setup/github.svg)](https://agentmods.dev/skills/orcaqubits/agentic-commerce-skills-plugins/acp-setup)

Your own site

<a href="https://agentmods.dev/skills/orcaqubits/agentic-commerce-skills-plugins/acp-setup"><img src="https://agentmods.dev/badge/skills/orcaqubits/agentic-commerce-skills-plugins/acp-setup/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/orcaqubits/agentic-commerce-skills-plugins/acp-setup"><img src="https://agentmods.dev/badge/skills/orcaqubits/agentic-commerce-skills-plugins/acp-setup.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 44 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 726 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00044	$0.00726
Opus 5.5	$0.00018	$0.00290
Sonnet 5.5	$0.00009	$0.00145
Haiku 4.5	$0.00004	$0.00073

Measured 1mo ago against content hash fe9c5e5f5f3d, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

acp-setup scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

acp-agentic-commerce/skills/acp-setup/SKILL.md · 59 lines

How it starts

The opening of the file, as written. The whole thing — 59 lines — stays where its author put it; the contents beside it link to each section on GitHub.

ACP Project Setup

Before writing code

Fetch the latest spec version: Web-search site:github.com agentic-commerce-protocol CHANGELOG for the current spec version
Fetch the OpenAPI specs: Fetch from https://github.com/agentic-commerce-protocol/agentic-commerce-protocol/tree/main/spec — download the latest versioned checkout and delegate-payment OpenAPI YAML files
Fetch the get-started guide: Fetch https://developers.openai.com/commerce/guides/get-started/ for onboarding steps
Check for SDK packages: Search PyPI for agentic-commerce-protocol and npm for ACP-related packages. Note: there is no official standalone SDK — most implementations use the OpenAPI spec directly or reference implementations like Medusa.js

What This Skill Does

Scaffolds a new ACP merchant server project:

Detect language/framework — Python (FastAPI/Flask/Django), TypeScript (Express/Fastify/Medusa), Go, etc.
Install dependencies — HTTP framework, JSON schema validation, HMAC library, UUID generation
Import OpenAPI spec — Download the latest versioned spec from the GitHub repo
Create configuration — Environment variables for API keys, webhook secrets, API version, PSP credentials
Stub endpoints — Create route stubs for the 5 checkout operations + webhook receiver
Set up middleware — Bearer token auth, idempotency key extraction, API version header validation, request logging

Configuration Essentials

These must be externalized (env vars or config file):

ACP_API_KEY — Bearer token for authentication
ACP_API_VERSION — Spec version (YYYY-MM-DD format)
ACP_WEBHOOK_SECRET — HMAC signing key for webhooks
STRIPE_API_KEY — If using Stripe as PSP for delegated payment
ACP_MERCHANT_ID — Merchant identifier for SPT scoping

Project Structure Pattern

merchant-server/
├── config/                  # Environment and settings
├── routes/
│   ├── checkout.py/ts       # 5 checkout endpoints
│   ├── webhooks.py/ts       # Webhook receiver
│   └── health.py/ts         # Health check
├── middleware/
│   ├── auth.py/ts           # Bearer token validation
│   ├── idempotency.py/ts    # Idempotency key handling
│   └── versioning.py/ts     # API-Version header validation
├── models/                  # Data models from JSON schema
├── services/
│   ├── checkout.py/ts       # Business logic
│   ├── payment.py/ts        # PSP integration
│   └── inventory.py/ts      # Stock management
├── schemas/                 # OpenAPI + JSON schemas
└── tests/

Read the full file on GitHub · 59 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

1mo ago Changed · -1 lines fe9c5e5f5f3d
1mo ago First seen · 60 lines · 44 tokens per session scan A 60b94abc724c

Subscribe to this mod's changes

acp-setup is a skill published in the GitHub repository OrcaQubits/agentic-commerce-skills-plugins (40 stars, last pushed 1mo ago), licensed MIT. It adds 44 tokens to every session and 726 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Backend and APIs E-commerce Magento a2a acp agentic-commerce ucp webmcp

archestra-dev-llm-providers

Use when adding an LLM provider, changing proxy adapters or provider routes, fixing streaming/tool-call translation bugs, editing model fetchers or model handling, or touching provider credentials/enums and model constants.

archestra-ai/archestra · 49 tokens

archestra-dev-backend

Use when adding or changing Archestra backend routes, models, services, API request/response schemas, endpoint permissions, or OpenAPI/codegen for the generated API client.

archestra-ai/archestra · 40 tokens

archestra-dev-interactions-migrations

Use BEFORE writing or running any Drizzle migration that touches the interactions table (or any other very large, write-hot table). The interactions table is the platform's biggest, append-heavy table — every LLM proxy call writes a row — so a careless migration can take a write-blocking lock and stall the proxy.…

archestra-ai/archestra · 118 tokens

acp-setup