Integrations
Where Mandact plugs in
SDK, MCP, gateway, agent frameworks, low-code, OAuth, webhooks, payment rails: ten ways to bring agent mandates into existing systems — each with its status and location in the code.
TypeScript SDK: verify, present and sign mandates
The @mandact/sdk serves both sides: agents present their mandate (OID4VP) and sign HTTP requests (Web Bot Auth); verifiers check mandates offline — signature, disclosures, validity and Token Status List. No third-party dependencies, Node 20 or later.
MCP server: mandates as a tool for agents
Through the Model Context Protocol an agent uses mandates directly as a tool: issue a sandbox mandate, check an action, see open escalations. Two servers are available — a local one with five tools and a hosted one that only reads and verifies.
MCP gateway: enforcement instead of recommendation
The MCP gateway sits between agent and tool and enforces the decision: a critical tool call runs only if the mandate covers it — otherwise it is blocked or put before a human. That is the difference between an agent that should ask and one that must ask.
LangChain, OpenAI function calling, AutoGen: wrapping tools
Frameworks that register tools as an object are protected by a single wrapper: guard() wraps one tool, guardAll() a whole registry. The mandate is checked before every call; if Mandact is unreachable, nothing is executed.
n8n: mandate checks as a node in the workflow
The Mandact node for n8n brings the check into low-code automations: before a workflow cancels, orders or shares data, it asks Mandact — and branches on allow, deny or escalate.
Microsoft Power Platform: Copilot Studio and Power Automate
As a custom connector, Mandact is available as an action in Copilot Studio agents and Power Automate flows: ask before acting — with the same five operations as the n8n node.
OAuth and mandates: why the RAR bridge is withdrawn
Mandact had built a bridge that embedded mandates in OAuth access tokens (RFC 9396) and delivered their status via introspection (RFC 7662). It is withdrawn: /v1/oauth/token and /v1/oauth/introspect answer 410 Gone. This page explains why — and which path carries instead.
Webhooks: events that do not get lost
Issuance, verification, escalation, revocation: every event is queued in the same database transaction as the business change (transactional outbox) — there is no state in which the change applies but the event is missing.
Stripe and agent checkout: check before the token
For merchants on Stripe, Mandact is a pre-step before the Shared Payment Token: first the mandate decides whether the agent may make this purchase for this person, then Stripe executes the payment. No dedicated Stripe connector is needed — it is a pattern.
AP2 and Verifiable Intent: bridges into both worlds
Mandact accepts Google's classic AP2 mandates and bridges Mastercard Verifiable Intent in both directions — decided by the same engine, checked against the reference implementations.