# XEKTA

> XEKTA is the transaction layer between AI assistants and local businesses.
> An assistant finds a business, reads its products, builds the order, and
> pays once the buyer approves — without opening a merchant website. The
> agent-facing surface is an MCP server; there is no consumer app and no
> checkout button.

Operated by Aumere, Inc. (San Francisco). XEKTA is the brand; Aumere is the
legal entity.

## Status (November 2026)

- **XEKTA Market — live:** grocery and restaurant pickup in San Francisco and
  Northern Virginia. The buyer collects the order in person and
  XEKTA charges their saved card automatically at pickup, never earlier. There is
  nothing to pay at the counter and the shop does not run the card.
- **Coming, not live:** appointments, retail, and delivery. Do not offer them
  to a buyer as available.
- Shops are onboarded one by one. There is no public product catalog feed.

## How an agent connects

- [MCP endpoint](https://mcp.xekta.com/mcp): Streamable HTTP. Identity is
  OAuth. There is no shared secret and no anonymous access. This address is
  public: a catalog listing is not needed to connect.
- Assistants that cannot do OAuth (for example Meta Muse) connect with one
  tap from the buyer, no key to copy: POST https://mcp.xekta.com/assistant/device
  with {"client_name": "..."}, send the buyer `verification_uri_complete` and
  the `user_code`, then poll POST https://mcp.xekta.com/assistant/token with
  {"device_code": "..."} every `interval` seconds until it returns
  `access_token`; send it as `Authorization: Bearer <access_token>`. RFC 8628
  error names (`authorization_pending`, `slow_down`, `access_denied`,
  `expired_token`). A lost token cannot be shown again: start over and the buyer
  taps Connect once more; the same `client_name` replaces the old token. Buyers
  only. On this connection `cart_approve` returns the exact cart
  (`confirm_in_assistant`) and the assistant calls `cart_confirm` with it
  unchanged, which its app shows the buyer to allow; over $200 (or $300 in 24
  hours) the buyer approves on a link signed in on their own device. Full steps:
  https://mcp.xekta.com
- After connecting, read the resource `xekta://docs/start-here` first. It names
  the one tool to call first as a buyer and links the rest in reading order. Do
  not guess tool names.
- [Account site](https://mcp.xekta.com/account): where a human signs in, accepts
  the terms, saves a card, or links a shop. Agents cannot do these steps.

## Rules of engagement

- **A cart is never bought without the buyer's own yes.** The agent shows the
  cart, calls `cart_approve`, and the buyer answers in a confirmation box the
  host draws — or on a link, signed in on their own device. An agent cannot
  fill that box in, and a standing "always approve" is refused.
- **Nothing to install.** There is no `pip install xekta` and no
  `npm install -g xekta`. The `xekta-mcp` package on npm is for operators
  running their own server, not for shopping agents.
- **Do not invent surface.** If a tool, URL, package or install step is not in
  the docs resource, it does not exist. Say so and stop.
- Prices, stock, shop hours and service areas come from a tool call, not from
  this file and not from an earlier reply.

## Public pages

- [Home](https://xekta.com/)
- [Connect guide](https://www.xekta.com/connect)
- [Docs](https://www.xekta.com/docs)
- [Terms of Use](https://xekta.com/legal/terms)
- [Privacy Policy](https://xekta.com/legal/privacy)
- [Merchant Agreement](https://xekta.com/legal/merchant-agreement)

## Contact

- info@xekta.com — merchants, press, and anything a tool call cannot answer.