BuyWhere Product Search MCP

The package takes a single API key through an environment variable, the architecture clearly shows the local stdio bridge sending requests to the hosted BuyWhere API, and the registry workflow declares narrowly scoped contents:read and id-token:write permissions. SECURITY.md advises against committing keys and recommends rotation. Deductions apply because there is no documented redaction, server-side key storage, request-retention, or third-party-sharing policy. Most tools appear read-only, but ingest_products creates an external write effect without a confirmation, deletion, reversal, or idempotency contract. The dependency set is small, but the MCP SDK uses a broad ^1.0.0 range, no lockfile or security-audit evidence is supplied, and the registry workflow downloads and executes a latest release artifact. Repository, package, copyright, and reporting attribution are consistent, while catalog-source and hosted-service provenance remain limited; unknown publisher identity was not treated as inherently negative.

README and package metadata specify Node 18+, while CI builds on Node 18, 20, and 22; installation routes and the hosted endpoint are also explicit, providing reasonable ordinary dependency-availability evidence. Self-consistency is reduced because the README alternately states 13 remote tools and 10 stdio tools while listing 13, and SECURITY.md supports only 0.3.x although package.json is version 0.4.0. No supplied file documents error classes, timeout behavior, rate-limit responses, retries, service-outage behavior, or representative user-facing failure messages, so failure_messages receives zero.

The documentation thoroughly covers shopping agents, comparison, deals, cross-border commerce, and multi-agent scenarios, with configurations or examples for Claude Desktop, Cursor, VS Code, Cline, Windsurf, Codex, Continue, Mastra, LangChain, LlamaIndex, and CrewAI. Tool descriptions, the architecture, the explicit exclusion of store management, and v2 deliver_to notes provide useful boundaries. Full marks are withheld from boundaries and trigger precision because complete schemas, validation constraints, tool-selection rules, and ambiguity handling are absent.

The README has strong information architecture and comprehensive quick-start, configuration, client, development, contribution, and support sections. MIT metadata matches a complete LICENSE, justifying full license credit. Deductions apply because v1 and v2 names coexist without a migration or deprecation policy, tool counts conflict, SECURITY.md trails the package version, and no changelog is supplied. Numerous examples are present, but there is no focused FAQ, troubleshooting section, or failure example. Limitations are only scattered across market coverage, Node requirements, and a sample registration rate limit. Security email, Issues, Discussions, and a CONTRIBUTING reference provide maintenance routes, but named maintainers and a complete release/support policy are not shown.

Search, detail, similarity, deals, best-price, ingestion, and comparison tools form a practically useful shopping-research surface, and examples describe structured products, prices, merchants, and links. Multi-market aggregation would provide material marginal value, and the example unverified tier discloses limits of 20 requests per minute and 1000 per day. Deductions reflect the absence of actual response schemas, representative complete outputs, ranking-quality evidence, latency or coverage measurements, paid pricing, and resource-cost details. Claims such as 300M+ products, 150,000+ stores, and real-time data remain primarily self-asserted in the supplied material.

Package identity, installation commands, Node requirements, license, CI matrix, and repository naming are corroborated across multiple supplied files. Core commercial and quality claims—including catalog size, store count, real-time availability, download figures, and geographic coverage—lack accompanying datasets, methods, tests, or independent evidence, limiting traceability. Marketing assertions and repository-verifiable facts are presented together, including use of terms such as “verified” without a verification procedure in the supplied sources, so fact and inference are not cleanly separated.