MCP.Market

Marketplace MCP server

by llmops-pro·io.github.llmops-pro/marketplace-mcp·v0.2.3

Publish Nostr marketplace listings (NIP-15 + Shopstr kinds 30019/30402) so agents can run a store.

B71/100grade B
What users say
No reviews yet
Be the first
Safety scan
B71/100

full report

Adoption
New

0 stars83 downloads/wk

Reviews

Write one

Nobody has reviewed Marketplace yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Marketplace tools (7, 5 write)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • marketplace_confirm_publishwrite action

    Execute a previously-prepared marketplace publish, identified by its one-time token. Only meaningful when NOSTR_REQUIRE_CONFIRM=true. Single-use token; the safety pipeline re-runs before signing. For Shopstr-modern tools (kind:30019/30402), the Shopstr cache POST hook is re-attached automatically.

  • marketplace_create_or_update_productwrite action

    Create or update a NIP-15 product (kind:30018) within a stall. The `stall_id` must match an existing stall's `id`. The `id` is the product's parameterized-replaceable d-tag \u2014 republishing with the same id replaces it. `categories` are surfaced as `t` tags for discoverability. Runs the safety pipeline (read-only, signer, rate limit, optional confirm).

  • marketplace_create_or_update_stallwrite action

    Create or update a NIP-15 marketplace stall (kind:30017). The `id` field is the parameterized-replaceable identifier \u2014 publishing with the same id replaces the prior stall on relays that honor replaceability. Shopstr is the canonical UI for these events. Runs the safety pipeline (read-only, signer, rate limit, optional confirm).

  • marketplace_list_my_products

    Fetch + parse the current signer's NIP-15 products (kind:30018). Returns each product's event id, created_at, `d` tag, category `t` tags, and parsed JSON (name, description, price, currency, stall_id, etc.). Optionally filter by stall_id (applied client-side after fetch \u2014 NOSTR relays don't index the JSON content). Products with non-JSON or schema-invalid content are returned with `parsed: nu

  • marketplace_list_my_stalls

    Fetch + parse the current signer's NIP-15 stalls (kind:30017). For each stall event found on the configured relays, returns the event id, created_at, `d` tag, and the parsed stall JSON (name, description, currency, shipping). Stalls that don't pass the NIP-15 schema are returned with `parsed: null` so you can see what's wrong.

  • shopstr_create_or_update_productwrite action

    Create or update a Shopstr-compatible product as a NIP-99 Classified Listing (kind:30402). All product data lives in tags; `summary` is the event content. The `d` tag is the supplied `id` \u2014 republishing replaces the prior listing. After relay publish, POSTs to Shopstr's cache (SHOPSTR_CACHE_URL) so the storefront UI surfaces the product. Runs the safety pipeline (read-only, signer, rate limit

  • shopstr_create_or_update_shopwrite action

    Create or update the seller's Shopstr shop profile (kind:30019). The `d` tag is the seller's pubkey hex \u2014 one shop per pubkey. After relay publish, POSTs the event to Shopstr's cache (SHOPSTR_CACHE_URL) so the storefront UI surfaces it. Runs the safety pipeline (read-only, signer, rate limit, optional confirm).

Public scan report

scanner v0.1.9 · 2026-09-27 · same rubric, same numbers if you re-run it

no findings
  • Code scan2 source files scanned25/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitystatic API keys via environment variables6/15
  • Maintenancelast push 104 days ago8/15
  • Maintainer identityregistry namespace matches repository owner7/10
Overall 71/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How Marketplace compares

Against every graded E-commerce MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
71/100
higher than 43% of 2,174 E-commerce servers
Tools
7
the typical E-commerce server has 6
Tools that change things
71%
typical: 0%. Fewer write tools means less an agent can break
Downloads a week
83
more than 64% of 411 E-commerce servers with a package

What its tools let an agent do: 7 change

Install Marketplace in Claude Code, Cursor or VS Code

Runs npx -y marketplace-mcp on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add marketplace-mcp -- npx -y marketplace-mcp
Add to Cursor

What the publisher says

From the Marketplace repository's README, as published. We do not edit it. Read it on GitHub

marketplace-mcp

A NOSTR storefront for your LLM agent — speaks both dialects. MCP server that lets an agent create + update marketplace events on your behalf, in two dialects out of the box:

  • NIP-15 (kind:30017 stalls + kind:30018 products) for NIP-15-native clients (Plebeian Market, etc.).
  • Shopstr-modern (kind:30019 shop profile + kind:30402 NIP-99 classified listings) — what shopstr.store actually renders. Includes an automatic cache-POST so events appear on the storefront, not just on relays.

Seven tools, defense-in-depth safety, MIT licensed.

v0.2 — dual-dialect publisher. v0.1.x shipped NIP-15-only and the listings never appeared on shopstr.store because Shopstr is a Postgres-backed CMS that only renders events from its own DB (populated via POST /api/db/cache-event) and its cacheable-event allowlist excludes NIP-15 kinds. v0.2 adds the Shopstr-modern tools and the cache-POST hook so the storefront actually populates. NIP-15 tools left in place for non-Shopstr targets.

Why this server exists

Shopstr (the canonical Bitcoin-Lightning marketplace UI on NOSTR) is not a relay-reading Nostr client — it's a Next.js app with a Postgres cache. Its marketplace page renders products from its own DB, populated when clients POST signed events to /api/db/cache-event. The cacheable-event allowlist (in shopstr-eng/shopstr → utils/db/cache-event-policy.ts) excludes NIP-15 stall/product kinds; modern Shopstr uses kind:30019 (shop profile with merchants: []) and kind:30402 (NIP-99 Classified Listings, all data in tags). Without a ["t","shopstr"] tag the listing won't surface; without at least one ["image",] tag the card silently never renders.

marketplace-mcp v0.2 builds the right events, POSTs them to Shopstr's cache after the relay publish, and keeps the legacy NIP-15 tools intact for anyone targeting other clients.

What you can build with this

  • A self-driving Shopstr storefront — agent generates shop profile + product listings from a config file, republishes whenever metadata changes, drops fresh t-tag categories per product for discoverability. Same call publishes to relays AND mirrors to Shopstr's cache.
  • A sales-channel multiplexer — the same product events propagate to every NIP-15- or NIP-99-aware client (Shopstr, Plebeian Market, etc.) by virtue of being on shared relays. Pick your dialect per-tool; publish to both if your audience spans clients.
  • A listing-as-code workflow — version-control your product JSON in git; CI calls shopstrcreateorupdateproduct to deploy. Republish with the same id = idempotent update (parameterized-replaceable events).
  • Cross-server identity — pair with nostr-ops-mcp and nwc-mcp to wire identity + commerce. Same signer, same npub, three specialized tool surfaces.

The seven tools

Shopstr-modern (new in v0.2) — required for shopstr.store visibility

NIP-15 legacy — for NIP-15-native clients (not Shopstr)

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Marketplace: common questions

Is Marketplace MCP server safe?
Mostly: it is graded B (71/100). Read the Marketplace safety report
How do I install Marketplace?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Marketplace need an API key?
Yes. The registry entry asks for NOSTR_NIP46_URI, NOSTR_PRIVATE_KEY.
Is Marketplace maintained?
The last commit was 142 days ago (2026-06-15). The latest release is v0.2.3.
What can I use instead of Marketplace?
Servers from other publishers that do the same job: Secondhand MCP server, Store Builder MCP server and Apify MCP server.
How does Marketplace compare with other E-commerce MCP servers?
safety score 71/100 (higher than 43% of 2,174 E-commerce servers); tools 7 (the typical E-commerce server has 6); tools that change things 71% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.

Alternatives to Marketplace

Same job from other publishers: the closest match first, then the best rated.

  • Secondhand
    Search Facebook Marketplace, eBay, Depop, and Poshmark from AI — filters, photos, full listings.
    B
  • Store Builder
    Design, fill with real store data, render and publish Store Builder pages from an AI agent.
    B
  • Apify
    Extract data from any website with thousands of scrapers, crawlers, and automations on Apify Store ⚡
    A
  • Mneme Memory
    Cross-session memory for AI coding agents via six tools; local-first SQLite store.
    A
  • Heimdall
    Every App Store Connect + StoreKit 2 endpoint. 929 tools in 13 profiles, narrow to 27.
    B

More from llmops-pro →