MCP servers › com.logimu › shopping-mcp
MCP server · registry snapshot 2026-10-23 · last tested 2026-10-23
com.logimu/shopping-mcp
Amazon (11 marketplaces) and Walmart US product data: search, prices, stock, history, sellers. — the publisher's description
Summary
com.logimu/shopping-mcp is a remote MCP server listed in the official MCP registry at version 1.8.0. On 2026-10-23 ProtocolProbe connected to it in read-only mode and read its inventory: 18 tools, 0 resources and 7 prompts.
Record checks
4 of 5 record checks met · 4 do not apply
- met: Registry entry is active and says how to run it
- met: Source repository link opens
- met: Repository is not archived
- met: Code pushed to the repository in the 90 days before our check
- not met: Repository publishes a security policy (SECURITY.md)
- not applicable: Package names its licence with a standard (SPDX) identifier
- not applicable: The version the registry lists can be installed and is not withdrawn
- not applicable: npm package carries build provenance (attestation)
- not applicable: No known critical or high advisory in the package or its dependencies
- Not ranked by downloads: a remote server publishes no download figure
- Not ranked by stars: 1 star (ranked from 10)
From public records, not a safety rating. Each check with its reason · Is it safe to install?
Key facts
- Runs
- remote (hosted by the publisher)
- Transport
- streamable HTTP
- Sign-in
- none needed to open a session
- Repository
- public
- Tools
- 18
- Described as changing data
- 2 of 18 toolsAI-classified
- Mainly works on
- accounts and data in outside web servicesAI-classified
- Topic
- commerce-and-marketingAI-classified
- Pricing
- freemiumAI-classified
- Last tested
- 2026-10-23
Observed fact
This server accepted a session without any credential and lists 1 tool whose name or declaration suggests it changes data (batch). That is our reading of the names; we did not call it. Source: our connection, 2026-10-23.
Worth knowing before you connect it
- 2 tools are described as changing something (track_product, batch): our AI model's reading of the descriptions, not something we tested, and the server opened a session without any credential. We did not call them.
Each line comes from a section below, with its source and date.
How fresh this is
- Live-tested
- yes, a real session (not a text-only review)
- Last tested
- 2026-10-23
- Mode
- read-only (no tool calls)
- Latest version
- 1.8.0, published 2026-10-18 (registry, as of the 2026-10-23 snapshot)
- First listed version
- 2026-10-15 (earliest version still in the registry; older removed versions would be earlier)
- Version history
- 2 versions listed, 2026-10-15 to 2026-10-18; 2 in the 90 days before the 2026-10-23 snapshot.(versions still listed in the registry only)
Most recent 2 versions
1.8.0· 2026-10-181.7.7· 2026-10-15
- Registry data
- snapshot 2026-10-23
- Package and repository
- checked 2026-10-22
- Engine
- mcp-runtime-engine@0.1.0 · sdk@1.32.0
Changes since the last refresh
New in the registry: not in the list of 2026-10-04, listed on 2026-10-23 with version 1.8.0 (published 2026-10-18).
Source: the official MCP Registry list on 2026-10-04 and on 2026-10-23.
What it is
What does this server offer?
Observed inventoryWhat it mainly works on, as our AI model read its tool descriptions: accounts and data in outside web services.
2 of 18 tools are described as changing something (creating, editing, deleting, sending or running).
“Full dossier for ONE known product: its current snapshot plus its observed history.”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
13 inputs, 1 required
asinstringrequired“10-character Amazon ASIN, or a numeric Walmart item ID when country=walmart.”gtinstring“GTIN / UPC / EAN barcode (12, 13 or 14 digits; punctuation and leading zeros are tolerated), resolved to an ASIN in the requested marketplace.”countrystring“Marketplace to look the product up in.”modestring“cache = stored observation only; live = force an on-demand scrape (Amazon only, takes a few seconds); auto = serve cache when fresher than max_age_days, otherw…”max_age_daysinteger“How old a cached observation may be before mode=auto triggers a live scrape.”include_usedboolean“Include used, refurbished, open-box and collectible offers in current_sellers (default false keeps the new-condition list).”offer_historyboolean“Attach the buy-box owner timeline and per-seller daily price series (US buy-box depth back to Dec 2024) plus buybox_price_history, the lowest buy-box price of …”history_sellersinteger“With offer_history: how many of the most-observed sellers carry a point series (default 10, max 50).”history_pointsinteger“With offer_history: points per series, the most recent N observed days (default 500, max 20,000).”bsr_historyboolean“Attach the full per-category BSR rank history (era-tagged daily points back to Oct 2023 for US; legacy top-100 segments are flagged censored).”history_onlyboolean“Return ONLY the stored history series - bsr_history, offer_history and buybox_price_history - with no snapshot, content or seller table, for 0.05 credit.”trackboolean“Answer AND track (paid plans): after this answer the ASIN is pinned into our hot lane, which re-reads its all-offers page every `interval` for 30 days and adds…”intervalstring“With track=true: how often the lane re-reads the all-offers page (1h = 24 snapshots a day).”
- shoppingreads or searches
“Curated product discovery: a shopping keyword in, a ranked and grouped shortlist out, in under ~100ms.”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
13 inputs, 1 required
qstringrequired“What to search for, e.g.”countrystring“Marketplace to search.”groupstring“How to group the shortlist.”min_pricenumber“Minimum price, in the marketplace's local currency.”max_pricenumber“Maximum price, in the marketplace's local currency.”brandstring“Restrict to one exact brand.”in_stockboolean“Only products currently in stock.”formatstring“Books/media only: return only this format - kindle, paperback, hardcover, mass_market, audiobook, audio_cd, board_book, spiral, library_binding or other (comma…”collapseboolean“true (default): one row per book, its other formats listed in the row's `formats` (each with its own ASIN and price).”include_unavailableboolean“false (default): only products with a current offer, so the shortlist is buyable.”sortstring“relevance (default) | price (cheapest first) | rating.”limitinteger“Max products to return (default 20).”detailboolean“Attach per-product intelligence to every product returned (30-day price and stock change events, full stock history and state, bought-past-month badge, current…”
“Filtered query over the tracked-product warehouse (24M+ Amazon and Walmart products).”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
20 inputs
qstring“Keyword matched against the product title.”brandstring“Exact brand name.”sellerstring“Restrict to products this seller has been observed offering.”categorystring“A department or sub-category name (e.g.”marketplacestring“Which tracked marketplace to query.”price_minnumber“Minimum current price, in the marketplace's local currency.”price_maxnumber“Maximum current price, in the marketplace's local currency.”rating_maxnumber“Maximum average star rating.”seller_count_mininteger“Minimum number of sellers competing on the listing.”seller_count_maxinteger“Maximum number of sellers competing on the listing.”fbmboolean“Only merchant-fulfilled listings.”rating_minnumber“Minimum star rating, on a 0-5 scale.”reviews_mininteger“Minimum number of reviews.”bsr_mininteger“Minimum Best Sellers Rank.”bsr_maxinteger“Maximum Best Sellers Rank.”fbaboolean“true = only Fulfilled by Amazon offers, false = only merchant-fulfilled.”fulfillmentstring“Buy-box fulfilment of the listing: amz = sold by Amazon itself, fba = a third party fulfilled by Amazon, fbm = merchant-fulfilled.”sortstring“Field to order results by.”max_per_categoryinteger“Cap how many results may come from any one category, to spread results across categories.”limitinteger“Maximum rows to return (up to 100).”
“Amazon SELLER profile by seller id, optionally with the products the seller sells.”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
14 inputs
seller_idstring“Amazon seller id: 'A' + 8-24 letters/digits.”namestring“Instead of seller_id: the seller's display name as Amazon prints it (e.g.”countrystring“Amazon marketplace.”modestring“Profile lane (see description).”max_age_daysinteger“auto only: how old the stored observation may be before fetching live (default 14 = the tracker's cadence).”historyboolean“Also return history{} (rating + storefront-size change points, oldest first, UTC).”history_pointsinteger“history=true: the latest N change points per series (1-5000).”productsboolean“Also return the seller's products (billed separately, see description).”products_modestring“cache = observed products (fast); live = the storefront now (seconds).”pageinteger“Products page (cache: 25 per page; live: Amazon's page 1-10).”max_pageinteger“live products only: auto-paginate up to this page (max 10); billed per page fetched.”brandsboolean“Also return the operator footprint: brands this seller was observed winning the buy box on (16 months), 25 per page (brands_page).”brands_pageintegernetworkboolean“Also return connected sellers: sellers winning the buy box on the same brands, strongest overlap first (max 50).”
“LIVE Amazon search-results (SERP) fetch: a real browser navigates Amazon's search page RIGHT NOW and returns the parsed organic result grid plus everything around it.”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
9 inputs, 1 required
qstringrequired“The search query, exactly as a shopper would type it into Amazon's search box.”countrystring“Amazon marketplace to search, or walmart (a live walmart.com search).”pageinteger“Start page (1-10).”max_pageinteger“Auto-paginate page..max_page and concatenate (positions stay continuous across pages).”sort_bystring“Amazon's own sort orders; default is Amazon's Featured.”category_idstring“Amazon browse-node id to scope the search (becomes &node=).”refinementsstring“Amazon rh= refinement value.”exclude_sponsoredboolean“Drop inline sponsored results.”number_of_resultsinteger“Truncate the returned result list.”
- bestsellersreads or searches
“LIVE Amazon Best Sellers list for one category: up to 100 products in Amazon's rank order, the category's full breadcrumb name, and its subcategories with their URLs.”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
3 inputs
urlstring“An Amazon Best Sellers URL: a category (e.g.”countrystring“Without url: that marketplace's root list of top-level categories (start here when you have no URL yet).”pagesinteger“1 = ranks 1-50 (1 credit), 2 = ranks 1-100 (default, 2 credits).”
- offersreads or searches
“LIVE Amazon offers page for one product: every seller offering it right now, read from Amazon's 'All offers' view at request time, every page of it (up to 10).”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
5 inputs
asinstring“The product's 10-character Amazon ASIN (a print book's ISBN-10 works too).”gtinstring“A barcode instead of an ASIN: UPC-12, EAN-13, GTIN-14 or ISBN-13.”countrystring“The Amazon marketplace to read the offers page on.”include_usedboolean“true also lists the used, refurbished, open-box and collectible offers in current_sellers.sellers.”zipstring“Optional (2026-10-14): a US 5-digit ZIP - the offers page as Amazon shows it to a shopper at that ZIP, with location (Amazon's confirmed 'Deliver to' answer) a…”
“LIVE Amazon Today's Deals: the deals page of one marketplace, read from Amazon at request time and filtered the way Amazon's own page filters it - department (category_id), deal collection (deal_type…”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
16 inputs
countrystring“The Amazon marketplace whose deals page to read.”urlstring“Optional: an Amazon deals URL (/deals, /events/deals or /gp/goldbox).”category_idstring“A deals department id from categories[] of a previous answer (Amazon applies one department at a time).”deal_typesstring“One of Amazon's stable deal collections.”collectionstring“Any other collection id from collections[] of a previous answer (collections differ per marketplace and over time).”discountstring“Rainforest form of min_discount (50_percent_off = at least 50% off).”min_discountnumber“Minimum percent off (0-100).”max_discountnumber“Maximum percent off (0-100).”min_pricenumber“Minimum deal price in the marketplace currency (Amazon applies whole units; a fraction is rounded down).”max_pricenumber“Maximum deal price in the marketplace currency (Amazon applies whole units; a fraction is rounded up).”prime_exclusiveboolean“true = Prime Exclusive deals only.”minimum_ratinginteger“Only products rated at least this many stars (1-4).”brandstring“A brand id from facets.brands of a previous answer (e.g.”pageinteger“1-based page of the deals list.”page_sizeinteger“Deals per page; Amazon serves steps of 30 only.”pagesinteger“Consecutive pages merged into one answer, starting at page (stops early on a short page).”
“Amazon BRAND dossier from Logimu's own buy-box observations (derived intelligence, not estimates): catalog size, how many sellers win the buy box, control score (share of buy-box days won by FBA offe…”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
7 inputs, 1 required
brandstringrequired“Brand name as Amazon prints it (case-insensitive).”countrystring“Amazon marketplace.”historyboolean“Add history.monthly (up to 24 months).”sellersboolean“Add the full seller list (25 per page).”pageinteger“Seller-list page (with sellers=true).”networkboolean“Add the seller map: connected brands + weighted edges.”network_limitinteger“Edges to return with network=true (1-50).”
“Amazon CATEGORY landscape from Logimu's observations: size (ASINs, brands, sellers), pricing and rating averages, Amazon's own retail share, FBA penetration, Amazon private-label share, seller concen…”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
7 inputs
category_idinteger“Logimu category id (warehouse id, as returned by every search result and listing).”node_idinteger“Instead of category_id: the Amazon browse-node id.”qstring“Instead of an id: part of a category name or path (English alias included) - returns candidate categories, free.”listboolean“Walk the taxonomy: the marketplace's root categories, or the children of parent_id.”parent_idinteger“With list=true: list this category's children instead of the roots.”countrystring“Amazon marketplace.”historyboolean“Add history.monthly.”
- market_listsreads or searches
“Ranked LISTS from Logimu's observations, 25 per page: kind=brand_movers (brands gaining or losing distinct buy-box sellers fastest over 30 or 90 days), seller_movers (sellers whose buy-box footprint …”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
8 inputs, 1 required
kindstringrequiredcountrystring“Amazon marketplace.”windowinteger“movers: comparison window in days.”directionstring“movers: gaining (up) or losing (down).”sortstring“top_*: the ranking field (see description).”category_idinteger“top_brands: root category id to narrow to.”parent_idinteger“top_categories: list this category's children instead of roots.”pageinteger
“Amazon's OWN autocomplete suggestion lists for a seed term, from Logimu's continuous harvest (since Aug 2026, 11 marketplaces): up to 6 lists - one per crawled prefix / department - each term with it…”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
4 inputs, 1 required
seedstringrequired“A seed term or prefix, at least 3 characters, e.g.”countrystring“Amazon marketplace (ignored when compare is given).”historyboolean“Also return each list's observation history (+0.5 credit when a closed observation exists).”comparestring“Comma-separated marketplaces to compare instead of one lookup, e.g.”
Show 6 more tools
- keyword_rankingsreads or searches
“Page 1 of Amazon US search for a keyword, as Logimu last OBSERVED it (head search terms taken from Amazon's own autocomplete, each observed about once a week, all departments, one US delivery ZIP): t…”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
3 inputs, 1 required
keywordstringrequired“A search term, e.g.”countrystring“Amazon US only: the map covers amazon.com search.”historyboolean“Also return every weekly observation and the products' rank series; +0.5 credit when more than one exists.”
- product_keywordsreads or searches
“REVERSE ASIN on Amazon US: every observed keyword (head search terms taken from Amazon's own autocomplete, page 1 observed about once a week) whose latest page 1 shows the product, organically with i…”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
8 inputs
asinstring“A 10-character Amazon ASIN: the keywords it shows up for.”asinsarray“Up to 10 ASINs, the product first, then the competitors to compare it with.”countrystring“Amazon US only: the map covers amazon.com search.”placementstring“Organic and sponsored (default), organic only, or sponsored only.”gapsboolean“With asins: only the keywords where a competitor is on page 1 organically and the first product is not.”limitinteger“Keywords per answer (1 credit per 25 returned, per ASIN).”offsetinteger“Skip this many keywords (paging).”historyboolean“Also return the first product's rank on each keyword in every observation; +0.5 credit when a keyword has more than one.”
“TRACK a product: pin an Amazon ASIN into our hot lane so its all-offers page is re-read every hour or every 2, 4, 12 or 24 hours, for as long as the plan is active (or a ttl_days you set), with e-mai…”
Publisher declares: read-only no · destructive no · idempotent yes · open-world no
12 inputs
actionstring“track (default) creates or renews the tracking(s); stop ends one or many at once; sync (2026-10-14) makes the key's active set on one marketplace EQUAL to asin…”idinteger“With action=stop: the tracking id (from list_tracked).”idsarray“With action=stop: several tracking ids at once (up to 1,000).”asinstring“The product's 10-character Amazon ASIN (one product).”asinsarray“Bulk (2026-10-14): up to 1,000 ASINs in one call - with action=track all get the same interval / ttl_days / alerts (results[] in input order: created / renewed…”dry_runboolean“With action=sync: return what would be created and stopped without writing.”countrystring“The Amazon marketplace to track the product on.”intervalstring“How often the lane re-reads the all-offers page.”ttl_daysinteger“Optional: stop after this many days (1-365).”alert_emailstring“Optional: e-mail alerts for the notify_if thresholds - 'true' for the account's own address, or an address.”webhook_urlstring“Optional: an https URL Logimu POSTs to when a notify_if threshold fires on a new observation (signed X-Logimu-Signature: sha256=HMAC-SHA256(secret, body); the …”notify_ifobject“With webhook_url and / or alert_email: the thresholds.”
“LIST the products this API key tracks (track_product): each with its status, interval, expiry, whether the hot lane has picked it up, the lane's last and next read, plus the plan's tracking allowance…”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
5 inputs
countrystring“Only this marketplace's trackings (default: every marketplace).”statusstring“Only trackings in this state (default: all, newest first).”limitinteger“Maximum rows to return.”offsetinteger“Rows to skip (paging; total says how many there are).”events_forinteger“A tracking id: return that tracking's webhook events instead of the list - which notify_if threshold fired on which observation, the payload, and the delivery …”
“BATCHES: run any Logimu endpoint over a whole list in one job and come back for the results - the same batch API as REST /v1/batches (see https://api.logimu.com/docs#batch).”
Publisher declares: read-only no · destructive yes · idempotent no · open-world no
29 inputs, 1 required
actionstringrequired“What to do (see the tool description).”batch_idinteger“For run / status / results / schedule / delete.”run_idinteger“For status (one run's progress) and results.”namestring“create: the batch's name (1-120 characters).”kindstring“estimate / create: product (default), search, seller, brand, category, keywords, or any endpoint kind named in the description.”countrystring“estimate / create: us, uk, de, ca, au, fr, it, es, jp, mx, br, walmart (search batches Amazon only).”modestring“product / seller batches: cache = warehouse only, live = scrape every row, auto = warehouse when fresh enough (required on create for product batches).”max_age_daysintegerasinsarray“product batches: the ASINs (or Walmart item ids).”gtinsarray“product batches: barcodes instead of ASINs.”sourcestring“product batches: tracked = the ASINs this key tracks on the marketplace instead of a list.”termsarray“search / shopping / warehouse_search / category_search batches: the queries.”seller_idsarray“seller, seller_products, seller_brands, seller_network batches.”brandsarray“brand, brand_sellers, brand_network batches.”category_idsarray“category / categories batches (ids, or root); deals batches (deals department ids, or all for the whole deals page).”seedsarray“keywords / keywords_compare batches: seed terms.”urlsarray“bestsellers batches: Best Sellers URLs.”pagesinteger“search batches: pages per term (1-3); ranked-list batches: pages of 25 rows (1-40).”paramsobject“endpoint kinds: the endpoint's query parameters, fixed for every row.”includearray“Extras: history (seller / brand / category / keywords), reviews, used, offer_history, bsr_history, history_only (product), blocks (search).”history_sellersintegerhistory_pointsintegerstartboolean“create: also launch the first run at once.”schedulestring“schedule: how often the batch re-runs (none stops the schedule).”schedule_enabledboolean“schedule: pause without deleting.”
and 4 more not listed here.
“ACCOUNT: the calling key's balance, plan, 30-day usage by endpoint and its product-tracking allowance (snapshots a day: total, used, remaining) - the same as REST GET /v1/account.”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
Takes no inputs.
Each quoted sentence is the first sentence of the publisher’s own description. The kind of tool and the “changes data” mark are our AI model’s reading of that description, not something we tested: two differently worded runs had to agree, otherwise no label is shown, and nobody has checked them by hand. A tool without the “changes data” mark is described as only reading, searching or calculating, or the two runs did not agree. No tool was called. Read the publisher’s full description before relying on it. “Publisher declares” lists the hints the server itself sends with the tool (MCP annotations: read-only, destructive, idempotent, open-world); they are the publisher's claims, not checked by us. Inputs are the parameters in the tool's own input schema: name, declared type, whether it is required, and the first sentence of its description. Read 2026-10-23.
How well are its tools described?
Features #4 and #5
How clearly this server's own tool descriptions say what a tool does, and how consistent its tool list is. The first part is an AI model's yes/no reading of each description; the second part is counted. We do not turn it into a grade.
Descriptions
AI reading of each description
- Says what the tool does
- 100% of 18 tools
- Says what it returns
- 100% of 18 tools
- States limits, defaults or errors
- 100% of 18 tools
- Says when to use it
- 100% of 18 tools
- Items covered per tool
- 4.0 of 4 on average
Counted from the listing
- Parameters with a description
- 97% of 176
- Tools with a description
- 100% of 18
- Typical description length
- 2,112 characters
The tool set
Counted from the listing
- Tools
- 18
- Size of the list
- about 18,982 tokens for an agent to load (characters ÷ 4)
- Naming
- 13 of 18 names use single lower-case words
AI reading: easy to mix up
No pair found.
The AI items cover 18 of 18 tools: for a tool where two differently worded runs disagreed, that item is left out. They were not checked by hand, and no tool was called. “Easy to mix up” means two tools whose names or descriptions overlap without saying how they differ; the AI found none. We do not rate whether the tool set is complete or whether side effects are spelled out, because our AI reading of those was not reliable enough.
How do I add it to my client?
Config from the registry entry
From the remote endpoint (Streamable HTTP)
We connected to this URL on 2026-10-23 (a read-only session: no tool was called).
Add to CursorAn install link in the format Cursor documents, holding the Cursor config below.
Claude Desktop or claude.ai
Settings → Connectors → Add custom connector, then paste: https://api.logimu.com/mcp
Cursor · .cursor/mcp.json in a project, or ~/.cursor/mcp.json
{
"mcpServers": {
"shopping-mcp": {
"url": "https://api.logimu.com/mcp"
}
}
}VS Code · .vscode/mcp.json
{
"servers": {
"shopping-mcp": {
"type": "http",
"url": "https://api.logimu.com/mcp"
}
}
}VS Code (command line) · Bash or zsh terminal (macOS, Linux)
code --add-mcp '{"name":"shopping-mcp","type":"http","url":"https://api.logimu.com/mcp"}'Claude Code
claude mcp add --transport http shopping-mcp https://api.logimu.com/mcp
Try it in the MCP Inspector · runs on your machine, opens in your browser · Node 22.19+
npx @modelcontextprotocol/inspector@2.11.0 --server-url https://api.logimu.com/mcp --transport http
- The server runs on the operator's infrastructure; it may ask you to sign in when you first connect.
- The MCP Inspector lists the server's tools, resources and prompts; a tool you call there runs for real.
Built from the server's registry entry with each client's documented format (checked 2026-10-14; the Cursor link and the VS Code command 2026-10-19; the MCP Inspector command 2026-10-21). Values in < > are yours to fill in; this page never contains a key. Where the server needs a setting the entry does not declare, it can still fail to start.
Does the registry listing match what we found?
Feature #6The registry verifies a package once, when it is published, and does not re-check it. A difference below is about the listing, not a judgement of the publisher.
| Registry says | We found | Result | Source · date |
|---|---|---|---|
| Remote endpoint api.logimu.com/mcp | Session opened | matches | our test · 2026-10-23 |
| No credential declared as required | Opened a session without any credential | matches | our test · 2026-10-23 |
| Repository github.com/ncosic/logimu-shopping-mcp | Opens publicly | matches | api.github.com · 2026-10-22 |
Who made it?
Feature #7 · lineage
Facts about the publisher. We do not turn them into a trust score.
- Namespace
- com.logimu
- GitHub owner
- a personal account (ncosic)
- Repository
- github.com/ncosic/logimu-shopping-mcp
- Stars
- 1
- Repository age
- 31–90 days
- Last push
- 0–30 days ago
- Archived
- no
- Security policy
- none found (we looked for SECURITY.md in the repository and in its owner’s .github repository)
Source: the registry entry and api.github.com · 2026-10-22; security policy read from GitHub · 2026-10-23.
Publish this server? Run these checks against it yourself before release, from your own machine: a server the command starts, or your own server at its URL after a one-time proof that you control it: npx protocolprobe-selftest.
Choosing
Record checks
Public records · not a safety rating4 of 5 record checks met · 4 do not apply
- Not ranked by downloads: a remote server publishes no download figure
- Not ranked by stars: 1 star (ranked from 10)
- MetRegistry entry is active and says how to run itActive, with a package or a remote address.
- MetSource repository link opensThe linked GitHub repository is public.
- MetRepository is not archivedNot archived.
- MetCode pushed to the repository in the 90 days before our checkLast push 0-30 days before our check.
- Not metRepository publishes a security policy (SECURITY.md)No SECURITY.md in the places GitHub reads it from.
- Does not applyPackage names its licence with a standard (SPDX) identifierRemote server: it ships no package.
- Does not applyThe version the registry lists can be installed and is not withdrawnRemote server: it ships no package.
- Does not applynpm package carries build provenance (attestation)Remote server: it ships no package.
- Does not applyNo known critical or high advisory in the package or its dependenciesRemote server: it ships no package.
Read from public records only: the registry entry, npm/PyPI, GitHub and advisory databases, checked 2026-10-22. No tool was called. Only “met” and “not met” are counted, so the total differs between servers; a check that does not apply or that we could not run is listed, never counted against it. It is not a safety rating. How each check works · Leaderboards
Common questions about com.logimu/shopping-mcp
Answered from the data aboveIs com.logimu/shopping-mcp safe to install?
We do not rate servers as safe or unsafe. 4 of its 5 applicable record checks are met (facts from public records, each listed on this page). What the records show: Its source repository opens publicly. Its repository had a push in the last 90 days. 2 of its tools describe changing data (our AI model's reading of the descriptions). These are facts with their sources on this page, not a safety guarantee, and we did not run its tools.
Is com.logimu/shopping-mcp free to use?
Its website (www.logimu.com/shopping-mcp/) describes a freemium pricing model. This is an AI-classified reading of the page on 2026-10-23, so check the page itself before relying on it.
Does com.logimu/shopping-mcp need an API key or sign-in?
It opened a session without any credential on 2026-10-23. The registry entry declares no required credential; no declaration is not a guarantee.
Has com.logimu/shopping-mcp been security tested?
Partly. 5 of the 16 checks that apply to it were exercised. It accepted a session without any credential and lists tools whose names suggest they change data. We did not call them. No security verdict is published before verification.
What can com.logimu/shopping-mcp do?
It lists 18 tools. In our AI model's reading of their descriptions (two runs had to agree, nobody checked it by hand), they include tools that read or search, create or change data and run code or commands. We did not call any tool, so this describes the text, not the behaviour.
Can com.logimu/shopping-mcp change or delete data?
2 of its tools say in their description that they create, edit, delete, send or run something (our AI model's reading). We did not call any tool, so we cannot say what actually happens.
Does com.logimu/shopping-mcp publish a security policy?
We found no SECURITY.md in its repository (root, .github/ or docs/) or in its owner's .github repository.
Where is the source code of com.logimu/shopping-mcp?
In github.com/ncosic/logimu-shopping-mcp, which opens publicly.
Found this page useful?
Anonymous · no sign-inA quick, anonymous reaction — no account, no email. One per kind from your browser. The tally updates when the page is next refreshed, and it is only a rough count, never a safety rating or a measured number of people.
Similar servers
Same topic · AI-read
- com.mcparmory/google-analyticsalso has tools that creates or changes data, runs code or commands, reads or searchescompare with this one
- io.github.adwarp-dev/adwarpAdwarpalso has tools that creates or changes data, runs code or commands, reads or searchescompare with this one
- io.github.MoonEyes/google-ecommerce-mcpGoogle E-commerce (GA4, Search Console, Merchant Center, Ads)also has tools that creates or changes data, runs code or commands, reads or searchescompare with this one
- io.github.hermoso-ai/hermosoHermosoalso has tools that creates or changes data, runs code or commands, reads or searchescompare with this one
- com.gtmotto/linkedinGTM Ottoalso has tools that creates or changes data, runs code or commands, reads or searchescompare with this one
- io.github.ANAMIZED/deskANAMIZED Deskalso has tools that creates or changes data, runs code or commands, reads or searchescompare with this one
Active servers whose topic is also “commerce-and-marketing” and that have at least one tool of the same kind; most kinds in common first, then most GitHub stars. The topic and the tool kinds are an AI model's reading of the publishers' descriptions, not checked by hand. Similar is not a recommendation.
Compare with another server
Side by side: registry entry, our read-only session, the tools and the 18 classification fields. Same values as each page; no score.
Security testing
What did we test, and what did we leave out?
18 checks · features #1, #2
Open without sign-in
It accepted a session without any credential and lists tools whose names suggest they change data. We did not call them. No security score is given; a check we did not run is never counted as passed.
- Inventory: exercised
- Hidden instructions: exercised
- Real execution: not run · our policy
- Secret leak: not run · nothing to check it against
- Internal addresses: not run · our policy
- Unconfirmed changes: not run · our policy
- Bad input: not run · our policy
- Model requests: not run · nothing to check it against
- Sensitive questions: not run · nothing to check it against
- Folder boundary: not run · our policy
- Log leaks: not run · nothing to check it against
- Hidden content: exercised
- Fake assistant turns: exercised
- Token passthrough: not applicable
- Token audience: not applicable
- Sign-in redirect: not run · our policy
- Consent handling: not testable from outside
- Sign-in metadata: exercised
5 exercised11 not run (reason given)2 not applicable
Each check ends in exactly one state: exercised, not run (with the reason), or not applicable (with the reason). 5 of the 16 checks that apply to it were exercised. We do not publish security-check outcomes for named servers.
- 1Inventory
tool-listReads the declared tools, resources and prompts.exercised - 2Hidden instructions
description-poisoningLooks for hidden instructions in tool descriptions.exercised - 12Hidden content
audience-hidingChecks resources that hide content from the user.exercised - 13Fake assistant turns
fake-assistant-turnChecks prompts that pose as the assistant's own words.exercised - 18Sign-in metadata
oauth-url-schemeChecks the published sign-in metadata for unsafe URLs.exercised
- 3Real execution
real-executionCalls a tool and checks what really happens.This check calls the server's tools. ProtocolProbe calls no server's tools for anything it publishes; an operator can run this check on their own server with our self-test command.not run · our policy - 4Secret leak
canary-leakPlants a fake secret and checks whether it leaks.This check needs at least one successful tool call to have something to check, and no tool was called.not run · nothing to check it against - 5Internal addresses
ssrfChecks whether a tool can be steered to internal addresses.This check calls the server's tools. ProtocolProbe calls no server's tools for anything it publishes; an operator can run this check on their own server with our self-test command.not run · our policy - 6Unconfirmed changes
write-without-confirmationChecks whether tools that change data act without asking.This check calls the server's tools. ProtocolProbe calls no server's tools for anything it publishes; an operator can run this check on their own server with our self-test command.not run · our policy - 7Bad input
error-handlingSends bad input and watches how the server answers.This check calls the server's tools. ProtocolProbe calls no server's tools for anything it publishes; an operator can run this check on their own server with our self-test command.not run · our policy - 8Model requests
samplingChecks whether the server asks the client's model to act for it.This check needs at least one successful tool call to have something to check, and no tool was called.not run · nothing to check it against - 9Sensitive questions
elicitation-sensitive-dataChecks whether the server asks users for sensitive data.This check needs at least one successful tool call to have something to check, and no tool was called.not run · nothing to check it against - 10Folder boundary
root-boundaryChecks whether the server reaches outside the folders it was given.This check calls the server's tools. ProtocolProbe calls no server's tools for anything it publishes; an operator can run this check on their own server with our self-test command.not run · our policy - 11Log leaks
logging-side-channelChecks whether log messages carry data they should not.This check needs at least one successful tool call to have something to check, and no tool was called.not run · nothing to check it against - 16Sign-in redirect
open-redirectChecks the sign-in redirect for abuse.Testing the sign-in redirect means sending probes to the operator's sign-in service, which we do not do.not run · our policy - 17Consent handling
confused-deputyChecks consent handling when one service acts for another.Depends on the operator's own consent screen, which differs per server and cannot be tested from outside.not testable from outside
- 14Token passthrough
token-passthroughChecks whether the server forwards a user's token to other services.The server opened a session without sign-in, so there is no token flow to check.not applicable - 15Token audience
token-audience-validationChecks whether tokens meant for another service are accepted.The server opened a session without sign-in, so there is no token flow to check.not applicable
Source: our own test, 2026-10-23, mcp-runtime-engine@0.1.0. Which checks count and why follows our published scoring model.
What happened during the test?
Feature #8
The steps in order, as the test record holds them.
- 0 msStarted a read-only session with the server's remote endpoint
- 3,009 msConnected after 0 redirects. No credential was sent or needed.
- Read the inventory: 18 tools, 0 resources, 7 prompts.
- 10,051 msFinished: 5 checks exercised.
Reference
How is it classified?
18 fields
One value per field, each with its source. Fields written by AI models are marked. A field with no value says why.
“Free, no signup: 30 queries a day.”
“Not stated” means the source did not state it; “does not apply” means it does not apply to this kind of server; “our limit” means our own lookup failed. A linked value opens the directory filtered to the same value.
Cite or correct this page
Sources and corrections
Suggested citation
ProtocolProbe. “com.logimu/shopping-mcp: MCP server record.” Data checked 2026-10-23. https://protocolprobe.com/mcp/servers/com.logimu/shopping-mcp
Figures are valid for the date shown. Our facts on this page are CC BY 4.0: reuse them with a link and the check date. Quoted text (the publisher’s descriptions, website quotes, tool names) is not ours to license.
As JSON: this record in the API · API documentation.
Badge for your README
[](https://protocolprobe.com/mcp/servers/com.logimu/shopping-mcp)
It shows this server's record-check count: facts from public records, no tool called. It is not a security rating or a pass. It links here and updates after each data reload.
Something wrong, or is this yours?
If a fact here is wrong, tell us and we will re-check it. If you operate this server, you can run our checks on it yourself with the free self-test command; we call no server’s tools ourselves for anything shown here.
Write to hello@protocolprobe.com · corrections log · methodology