CommerceBook
ai.commercebook/commercebookcommercebook.aistreamable-httpv0.3.0Scanned
Search and buy products from sellers and verified warehouses, sell surplus stock, post requests.
11 tools: 1 do something that can't be undone, 3 change things and 7 only read.
- Reads private data · 1
- Reads text others write · 1
- Can send data out · 2
- No findings
Anlyon alternative
4 of these tools change something. Run those as governed actions.
Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.
Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.
Import an OpenAPI spec →Tools
Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.
11 tools
Can't be undone 1Claude Code: ask
signup_confirmPOST /signup/confirm: the email and the 8-digit code the owner read in the email.Can send data outNo findings
Why it is in this group
- The description's first verb is "post" and "email": it sends a message, which cannot be taken back.
- The input takes a statement or command to run (input.code), which can change anything it can reach.
What it can reach
- outboundThe description's first verb is "post": it sends or publishes something to other people.
Description, as the server wrote it POST /signup/confirm: the email and the 8-digit code the owner read in the email. Makes the account and answers the key (the agent link key, shown once), the agent link and the member’s document. Connect again with Authorization: Bearer <key> for the full tool list. Selling and buying with money still need the owner’s Stripe steps.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
Changes things 3Claude Code: ask
commercebook_feedbackPOST /feedback: a note on a tool or a page, what happened and what would have helped, with an optional rating from 1 to 5.Can send data outNo findings
Why it is in this group
- The description's first verb is "post": a word for a change.
What it can reach
- outboundThe description's first verb is "post": it sends or publishes something to other people.
Description, as the server wrote it POST /feedback: a note on a tool or a page, what happened and what would have helped, with an optional rating from 1 to 5. A person at CommerceBook reads every note; the What is coming list in the briefing is shaped by them. With no key, 20 notes per address per day; with a key, the note is recorded against the key and on the owner’s ledger.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
network_nowThe older name of commercebook_network_now, kept so agents that call it keep working.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it The older name of commercebook_network_now, kept so agents that call it keep working. GET /network/now (no key needed): verified members, leads listed in the last 7 days, prices posted and savings confirmed this month, cached 15 minutes.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
signup_startPOST /signup/start: asks to open a CommerceBook account for the owner.Reads text others writeNo findings
Why it is in this group
- The name "signup_start" says "start": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it POST /signup/start: asks to open a CommerceBook account for the owner. The owner gets one email with an 8-digit code and no link; the code lives 30 minutes; three starts per email per day. kind is warehouse, seller or buyer (a Shop account that buys on the market: the company is optional and no address is asked); a warehouse also gives its street address. The key starts read-only; the owner turns activities on at Agent access. Then ask the owner for the code and call signup_confirm.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
Only reads 7Show 7 read-only tools
commercebook_market_bookGET /market/book: what is on the market and what buyers ask for, by category, with live numbers only.No findings
Why it is in this group
- The description's first verb is "get": a word for reading.
Description, as the server wrote it GET /market/book: what is on the market and what buyers ask for, by category, with live numbers only. supply: public products, the sellers behind them, and by_category the products, sellers and the lowest price from 1 unit (from_unit_cents). demand: open public requests, the quantity asked for and, by category, the ceilings as bands (no buyer named). fills_30d: orders in the last 30 days, those that filled a request, the median hours from request to quote and from quote to order (null when none). sellers: delivered and on time across every seller’s orders, each {n, of, rate, shown_as}, a count until it is built on 10 orders, then a percent. Every category key is listed and zero reads zero, so a category with requests and no products shows where a seller can quote, and one with products and no requests where a buyer can post. Cached 15 minutes. No key needed.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
commercebook_market_intentsGET /market/intents: the demand side of the book.No findings
Why it is in this group
- The description's first verb is "get": a word for reading.
Description, as the server wrote it GET /market/intents: the demand side of the book. Every open public request (an intent in the API) with its title, category, quantity, the most the buyer pays each (ceiling_unit_cents; a band when the buyer hid it), the state it goes to, the expiry and the open quotes; no buyer is named. category narrows it, and categories counts the open requests by category (zero when there are none). With a key the answer adds mine, the member’s own requests in every state. No key needed.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
commercebook_market_lotGET /market/lots/{id}: one public product (lot_id) as its product page shows it (the count, the condition, the date the seller last confirmed the count, the photos, the shipping) w…No findings
Why it is in this group
- The description's first verb is "get": a word for reading.
Description, as the server wrote it GET /market/lots/{id}: one public product (lot_id) as its product page shows it (the count, the condition, the date the seller last confirmed the count, the photos, the shipping) with every active offer and the states it ships to. No key needed.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
commercebook_market_searchGET /market/search: the products for sale on CommerceBook, by words on the title, description, brand and part number (every word must match a whole word, with an optional plural en…No findings
Why it is in this group
- The name "commercebook_market_search" says "search": a word for reading.
Description, as the server wrote it GET /market/search: the products for sale on CommerceBook, by words on the title, description, brand and part number (every word must match a whole word, with an optional plural ending, so stretch never matches stretcher), category (a key from commercebook_market_book), price per unit in cents (min_price, max_price), the ship-to state, the condition. Sorted by relevance, then price. Each item has the offer id, the price, the quantity available, the minimum, how it reaches the buyer, the seller and the product page URL. A product priced by quantity also carries price_mode schedule, schedule_kind, price_schedule (the tiers) and price_text (for example "from $2.40 each, 50 or more at $1.90 each"); unit_price_cents is the price from 1 unit, and a quote at a quantity returns the price of that quantity. No key needed.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
commercebook_market_sellerGET /market/sellers/{slug}: the record CommerceBook computes for one seller (seller_slug of a search item or a product): the tier (new, standard or trusted, with founding beside it…Reads private dataNo findings
Why it is in this group
- The description's first verb is "get": a word for reading.
What it can reach
- private-dataThe description's first sentence says "get" and "file": it reads files.
Description, as the server wrote it GET /market/sellers/{slug}: the record CommerceBook computes for one seller (seller_slug of a search item or a product): the tier (new, standard or trusted, with founding beside it), the last 90 days and all time (delivered, on time, accurate, cancelled, disputed, refunded; each with n, of, rate and shown_as, a count until it is built on 10 orders, then a percent), the ratings kept apart (confirmed at delivery, rated by shoppers), the live products, where the goods are stored, and the terms a buyer accepts (return terms, the days to file a dispute, the payout days, offers below the listed price). The seller writes none of it. No key needed.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
commercebook_network_nowGET /network/now (no key needed): verified members, leads listed in the last 7 days, prices posted and savings confirmed this month, cached 15 minutes.No findings
Why it is in this group
- The description's first verb is "get": a word for reading.
Description, as the server wrote it GET /network/now (no key needed): verified members, leads listed in the last 7 days, prices posted and savings confirmed this month, cached 15 minutes.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
instructionsGET /instructions with no key: the buyer briefing, how the market is read, priced with shipping and bought, the rules, what is coming and how to send feedback.No findings
Why it is in this group
- The description's first verb is "get": a word for reading.
Description, as the server wrote it GET /instructions with no key: the buyer briefing, how the market is read, priced with shipping and bought, the rules, what is coming and how to send feedback. A key gets the briefing of its own kind.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.
Exfil surface
Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.
2 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 1 untrusted-input tool breaks every one.
- Reads private data1
- Reads files, mail, messages, databases, secrets, calendars or repositories.
- Reads text others write1
- Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
- Can send data out2
- Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
{
"permissions": {
"deny": [
"mcp__commercebook__signup_start"
]
}
}Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.
Findings
Matches of fixed checks, with the text they matched.
No check matched anything in these tool definitions. That is not a safety guarantee.
History
Changes to its tool definitions and to its remote endpoint, newest first.
No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.
Install
Pinned to version 0.3.0. Values in angle brackets are yours to fill in.
claude mcp add --transport http commercebook https://commercebook.ai/mcpclaude mcp add --transport http commercebook https://commercebook.ai/mcpRun in a terminal.
Claude Code permissions
Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.
{
"permissions": {
"allow": [
"mcp__commercebook__commercebook_network_now",
"mcp__commercebook__instructions",
"mcp__commercebook__commercebook_market_search",
"mcp__commercebook__commercebook_market_lot",
"mcp__commercebook__commercebook_market_seller",
"mcp__commercebook__commercebook_market_intents",
"mcp__commercebook__commercebook_market_book"
],
"ask": [
"mcp__commercebook__signup_start",
"mcp__commercebook__signup_confirm",
"mcp__commercebook__network_now",
"mcp__commercebook__commercebook_feedback"
],
"deny": []
}
}Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as commercebook. Review it before you use it.
Capability tags behind 4 rules
- mcp__commercebook__signup_start untrusted-input
- mcp__commercebook__signup_confirm outbound
- mcp__commercebook__commercebook_feedback outbound
- mcp__commercebook__commercebook_market_seller private-data
Pin
Keep the decision: fail CI when the tools change, follow every change, or show a badge.
Pin in CI
Fail a build when the tools you reviewed are not the tools the server serves today.
curl -s "https://anlyon.dev/api/v1/servers/ai.commercebook/commercebook/verify?hash=86c2c05e02834cef809a78754a5e511acefddaade7246944054aedd3a165f3e7" | jq -e '.changed == false'Pinned hash 86c2c05e0283, from Oct 26, 2026, 20:17 UTC.
Watch
Get told when its tools change: a new tool, a new description, a new class.
https://anlyon.dev/servers/ai.commercebook/commercebook/changes.xmlAn Atom feed. Works in any feed reader or Slack's RSS app.
Badge
[](https://anlyon.dev/servers/ai.commercebook/commercebook)Source: MCP Registry. Synced Oct 26, 2026, 20:17 UTC.