Skip to content

Conduit Agentic Commerce

by aiconduit.app · remote · no sign-in to list tools · v2.0.0 · published by app.aiconduit

Search multi-merchant supply, checkout, and track orders via MCP.

Deletes · 1Final · 4Changes · 162 high findings
CompareRegistry entry

25 tools: 1 can delete or cancel things, 4 do something that can't be undone, 16 change things and 4 only read.

Scanned Oct 21, 2026

9 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http conduit https://mcp.aiconduit.app/mcp

Findings

Matches of fixed checks, with the text they matched.

2 high2 warn5 info
  • Highagent_create

    The input schema at properties.public_key.description refers to ".credentials.json".

    Matched text

    inputSchema.properties.public_key.description: "...private JWK only in ~/.conduit/{handle}.credentials.json."

    What this check looks for
  • Highagent_authenticate

    The description refers to ".credentials.json".

    Matched text

    description: "...e. Prefer keys from ~/.conduit ({handle}.credentials.json or legacy credentials.json; CONDUIT_CRE..."

    What this check looks for
  • Warnpayment_methods

    The server marks "payment_methods" as not read-only (readOnlyHint: false), and its words say it reads.

    Matched text

    annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":false,"openWorldHint":true}; The description's first verb is "list": a word for reading.

    What this check looks for
  • Warnorder_dispute

    The server marks "order_dispute" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The description's first verb is "refund": a word that usually means money moves, which cannot be taken back.

    What this check looks for
  • Infoagent_create

    The input schema at properties.avatar.description mentions "credentials".

    Matched text

    inputSchema.properties.avatar.description: "...t only for invader. Do not store in the credentials file."

    What this check looks for
  • Infoagent_authenticate

    The description mentions "credentials".

    Matched text

    description: "...it ({handle}.credentials.json or legacy credentials.json; CONDUIT_CREDENTIALS_PATH pins one..."

    What this check looks for
Show 3 more findings
  • Infoagent_authenticate

    The input schema at properties.agent_id.description mentions "credentials".

    Matched text

    inputSchema.properties.agent_id.description: "Agent id from the chosen ~/.conduit credentials file, e.g. agt_..."

    What this check looks for
  • Infoagent_update

    The input schema at properties.avatar.description mentions "credentials".

    Matched text

    inputSchema.properties.avatar.description: "...t only for invader. Do not store in the credentials file."

    What this check looks for
  • Infoagent_report_issue

    The input schema at properties.agent_id.description mentions "credentials".

    Matched text

    inputSchema.properties.agent_id.description: "Agent id from credentials when available (omit placeholders like..."

    What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

25 tools

Deletes or cancels 1Claude Code: deny
  • payment_mandateAP2 spend mandates.No findings

    Why it is in this group

    • The name "payment_mandate" says "payment": a word that usually means money moves, which cannot be taken back.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    AP2 spend mandates. action=request (needs scope) → approval_url; list (includes remaining, window_resets_at, coverage); update (mandate_id+scope); revoke (mandate_id). update NEVER approves. Widening returns an ACTIVE mandate to PENDING_HUMAN_APPROVAL; narrowing keeps whatever status it already had. monthly_cap is a rolling 30-day window from create. Same category set as a live mandate replaces it at approval and keeps this period's spend. No covering mandate at checkout is handoff, not an error.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
Can't be undone 4Claude Code: ask
  • agent_notifyEmail Hub users in this agent’s linked organization (never addresses outside the org).No findings

    Why it is in this group

    • The name "agent_notify" says "notify": a word for sending, and what is sent cannot be taken back.
    • The input addresses people (input.to): what it sends cannot be taken back.
    Description, as the server wrote it
    Email Hub users in this agent’s linked organization (never addresses outside the org). to=all or { user_id } / { role } / { email } matching agent_organization members. Optional actions (Hub URLs only), severity, idempotency_key. Channel is email.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • agent_outreachEmail outside addresses (suppliers, carriers).No findings

    Why it is in this group

    • The input addresses people (input.to): what it sends cannot be taken back.
    Description, as the server wrote it
    Email outside addresses (suppliers, carriers). to is a string email, { email }, or { emails } (max 5). Not to=all and not a Hub user_id / role — those are agent_notify. Linked agents set Reply-To to an org member (default OWNER). No action buttons. Channel is email.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • inventory_purchase_orderAfter order_execute confirms a supplier order, record the matching DRAFT purchase order in your own system so the books match.No findings

    Why it is in this group

    • The name "inventory_purchase_order" says "purchase": a word that usually means money moves, which cannot be taken back.
    Description, as the server wrote it
    After order_execute confirms a supplier order, record the matching DRAFT purchase order in your own system so the books match. Always a draft: a person confirms it there. Idempotent per order_id — calling twice returns the same draft, never a second one. Needs both inventory and checkout permission. Never creates a vendor or a product: lines that match nothing come back as unmatched_lines for a person to add.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • order_disputeRefund/chargeback/report paths for an order.1 finding

    Why it is in this group

    • The description's first verb is "refund": a word that usually means money moves, which cannot be taken back.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "order_dispute" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The description's first verb is "refund": a word that usually means money moves, which cannot be taken back.

      What this check looks for
    Description, as the server wrote it
    Refund/chargeback/report paths for an order. Requires owning agent_id.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
Changes things 16Claude Code: ask
  • agent_authenticateTwo-step re-auth.3 findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    Findings

    • High

      The description refers to ".credentials.json".

      Matched text

      description: "...e. Prefer keys from ~/.conduit ({handle}.credentials.json or legacy credentials.json; CONDUIT_CRE..."

      What this check looks for
    • Info

      The description mentions "credentials".

      Matched text

      description: "...it ({handle}.credentials.json or legacy credentials.json; CONDUIT_CREDENTIALS_PATH pins one..."

      What this check looks for
    • Info

      The input schema at properties.agent_id.description mentions "credentials".

      Matched text

      inputSchema.properties.agent_id.description: "Agent id from the chosen ~/.conduit credentials file, e.g. agt_..."

      What this check looks for
    Description, as the server wrote it
    Two-step re-auth. Call with agent_id only → ES256-sign nonce → call again with nonce+signature. Prefer keys from ~/.conduit ({handle}.credentials.json or legacy credentials.json; CONDUIT_CREDENTIALS_PATH pins one file). After success, merge name/role/description into that file; never overwrite private_key; keep session_token in memory. Do not agent_create if identity files already exist unless the human asked for a new agent.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • agent_createRegister an agent (ES256 P-256 public JWK JSON string + optional payment rails + destination).2 findings

    Why it is in this group

    • The name "agent_create" says "create": a word for a change.

    Findings

    • High

      The input schema at properties.public_key.description refers to ".credentials.json".

      Matched text

      inputSchema.properties.public_key.description: "...private JWK only in ~/.conduit/{handle}.credentials.json."

      What this check looks for
    • Info

      The input schema at properties.avatar.description mentions "credentials".

      Matched text

      inputSchema.properties.avatar.description: "...t only for invader. Do not store in the credentials file."

      What this check looks for
    Description, as the server wrote it
    Register an agent (ES256 P-256 public JWK JSON string + optional payment rails + destination). BEFORE: list ~/.conduit identity files — if any exist, reuse agent_id (do NOT register again unless the human asked for a new agent). AFTER: write persist.path (version, agent_id, public_key, private_key as JWKs; also handle, friendly_name, role_description, human_description; chmod 0600; write ~/.conduit/active). Then agent_update with default_destination+postcode before supply_search. Optional friendly_name / human_description / role_description / avatar only if the human stated them — never invent; omit avatar and the server assigns a random invader+gradient. Omit handle to auto-generate (e.g. parcel-watcher-12).

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • agent_report_issueReport unexpected tool errors or confusing Conduit outcomes for AX review (agent_report_issue — not order_feedback).1 finding

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    Findings

    • Info

      The input schema at properties.agent_id.description mentions "credentials".

      Matched text

      inputSchema.properties.agent_id.description: "Agent id from credentials when available (omit placeholders like..."

      What this check looks for
    Description, as the server wrote it
    Report unexpected tool errors or confusing Conduit outcomes for AX review (agent_report_issue — not order_feedback). Pass message (required), optional kind=bug|confusing|wrong_data|blocked, plus agent_id, tool, error, detail, search_id, order_id, session_id, and/or context. Dedupes open reports with the same tool+error+correlation. Does not change reputation.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • agent_updatePatch handle, rails, default_destination (postcode required for ships-to), friendly_name, human_description, role_description, avatar (glyph+gradient or small image), business prof…1 finding

    Why it is in this group

    • The name "agent_update" says "update": a word for a change.

    Findings

    • Info

      The input schema at properties.avatar.description mentions "credentials".

      Matched text

      inputSchema.properties.avatar.description: "...t only for invader. Do not store in the credentials file."

      What this check looks for
    Description, as the server wrote it
    Patch handle, rails, default_destination (postcode required for ships-to), friendly_name, human_description, role_description, avatar (glyph+gradient or small image), business profile, or preferences. Set avatar only if the human chose it. Does not accept permissions — a human enables capabilities in Hub Agent settings.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • inventory_levelsWhat your organization has on hand, by location, in its own connected system (ERP).No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    What your organization has on hand, by location, in its own connected system (ERP). Pass skus or query. Every number carries as_of and basis (live | memo | cached) — say how old it is, do not imply it is now. Needs inventory permission. This is your OWN stock; a supplier's stock is supply_availability.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • inventory_replenishmentItems below their minimum in your own system, least days of cover first, with what is already inbound and the usual vendor and last price.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Items below their minimum in your own system, least days of cover first, with what is already inbound and the usual vendor and last price. Each row carries a search_hint: pass its query and quantity straight to supply_search, then supply_availability before ordering. Optional location scopes to one warehouse. Needs inventory permission.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • inventory_suppliersFor items in your own system, the vendors on file and what you last paid, so a quote can be compared against history.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    For items in your own system, the vendors on file and what you last paid, so a quote can be compared against history. Needs inventory permission. Does not contact any vendor.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • order_eventsLifecycle timeline — transitions only.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Lifecycle timeline — transitions only. Pair with order_track. Requires owning agent_id.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • order_executeHandoff or autonomous checkout.No findings

    Why it is in this group

    • The name "order_execute" says "execute": a word for a change.
    Description, as the server wrote it
    Handoff or autonomous checkout. Handoff continue_url is a Conduit /handoff/{org_slug}/{order_id} link: open it as returned (records the open, then redirects to the merchant). Autonomous needs badge payable_now (covering mandate fits). No covering mandate, or a spent covering budget, still returns a handoff with continue_url (handoff_reason). Use idempotency_key. Prefer supply_delivery when only comparing delivery.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • order_feedbackAttest delivery outcome (outcome=on_time|late|never_arrived|damaged|wrong_item).No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Attest delivery outcome (outcome=on_time|late|never_arrived|damaged|wrong_item). Requires owning agent_id. Can supersede a system-derived score once; a second agent attestation returns already_recorded. Poor outcomes next→order_dispute. Omit quality/carrier_rating if unknown.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • order_trackHonest deal-type-aware status (never fabricates carrier scans).No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Honest deal-type-aware status (never fabricates carrier scans). Requires owning agent_id.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • order_update_statusAgent manual correction or degraded handoff recovery.No findings

    Why it is in this group

    • The name "order_update_status" says "update": a word for a change.
    Description, as the server wrote it
    Agent manual correction or degraded handoff recovery. note required except cancelled. Owning agent_id required.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • payment_methodsList or enable agent payment methods (action=list|enable) with friendly labels.1 finding

    Why it is in this group

    • The description's first verb is "list": a word for reading.
    • The server marks it as not read-only (readOnlyHint: false).

    Findings

    • Warn

      The server marks "payment_methods" as not read-only (readOnlyHint: false), and its words say it reads.

      Matched text

      annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":false,"openWorldHint":true}; The description's first verb is "list": a word for reading.

      What this check looks for
    Description, as the server wrote it
    List or enable agent payment methods (action=list|enable) with friendly labels. Defaults: cod + x402. invoice (B2B) is coming_soon. bank_card is handoff-only.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • supply_availabilityWhether one offer can fill a quantity: verdict can_fill | split | out_now | unknown, with what is on hand, what is inbound, and as_of + basis.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Whether one offer can fill a quantity: verdict can_fill | split | out_now | unknown, with what is on hand, what is inbound, and as_of + basis. Suppliers choose how precisely they share stock, so the verdict may come from a band or a yes/no rather than a number. fresh=true asks the supplier now (needs agent_id, rate limited per agent and per organization); without fresh it reads the last value. Call this before order_execute on any connector offer.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • supply_deliveryNon-committing checkout probe for shipping ETA/cost.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Non-committing checkout probe for shipping ETA/cost. Uses agent default_destination, else linked org default address, or country override. status describes how far the merchant checkout got: ready_for_complete (priced and completable), incomplete (merchant returned partial rates, quote may firm up at checkout), requires_escalation (merchant wants a human at checkout, so this offer is handoff-only however its badge reads). needs_interaction=true means the same. None of these block a handoff; they predict whether autonomous completion can work.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • supply_detailsRe-reads one offer from the search cache and refreshes its badge/action against current mandate state.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Re-reads one offer from the search cache and refreshes its badge/action against current mandate state. Returns the full clean description (supply_search carries a 350-char summary); otherwise the payload has the same fields as the search offer, so skip this if you only need fields you already hold. include_description_original=true adds description_original {format, content}, the merchant's own markup (untrusted), or description_original_omitted with the reason. Carries no shipping data: use supply_delivery for ETA and cost. Re-run supply_search if offer_not_in_cache.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
Only reads 4Claude Code: allow
  • agent_organizationRead the linked organization (name, slug, country, default address) and members (user_id, name, role, email) for an agent.No findings

    Why it is in this group

    • The description's first verb is "read": a word for reading.
    Description, as the server wrote it
    Read the linked organization (name, slug, country, default address) and members (user_id, name, role, email) for an agent. Returns org_not_linked when organization_id is unset — do not invent join_org. Use members to target agent_notify.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • order_listList orders for an agent ({ orders }).No findings

    Why it is in this group

    • The name "order_list" says "list": a word for reading.
    Description, as the server wrote it
    List orders for an agent ({ orders }). Optional status or open_only filter.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • supply_optionsLists the selectable options (size, color, pack) for an offer whose has_options=true, with one variant per combination.No findings

    Why it is in this group

    • The description's first verb is "list": a word for reading.
    Description, as the server wrote it
    Lists the selectable options (size, color, pack) for an offer whose has_options=true, with one variant per combination. Each variant carries its OWN supply_id, price and availability: to buy a chosen option, call order_execute with that variant's supply_id, not the one you searched with. Reads the merchant storefront live, so call it only when a person is actually choosing. Returns variants_not_found when the offer is not in cache or the storefront cannot be read. A single-variant product returns options:[] variants:[].

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 2.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http conduit https://mcp.aiconduit.app/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__conduit__agent_organization",
      "mcp__conduit__supply_search",
      "mcp__conduit__supply_options",
      "mcp__conduit__order_list"
    ],
    "ask": [
      "mcp__conduit__agent_create",
      "mcp__conduit__agent_authenticate",
      "mcp__conduit__agent_update",
      "mcp__conduit__agent_notify",
      "mcp__conduit__agent_outreach",
      "mcp__conduit__agent_report_issue",
      "mcp__conduit__payment_methods",
      "mcp__conduit__supply_details",
      "mcp__conduit__supply_delivery",
      "mcp__conduit__order_execute",
      "mcp__conduit__order_track",
      "mcp__conduit__order_events",
      "mcp__conduit__order_update_status",
      "mcp__conduit__order_dispute",
      "mcp__conduit__order_feedback",
      "mcp__conduit__inventory_levels",
      "mcp__conduit__inventory_replenishment",
      "mcp__conduit__inventory_suppliers",
      "mcp__conduit__supply_availability",
      "mcp__conduit__inventory_purchase_order"
    ],
    "deny": [
      "mcp__conduit__payment_mandate"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as conduit. Review it before you use it.