MCP.Market

Map MCP server

by maraventano·io.github.maraventano/map·v1.0.2
No reviews yet

A subtractive MCP for agent commerce: read · pay · publish. Teacher, not butler.

A91/100grade A
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
A91/100

full report

Adoption
Growing

0 stars45 downloads/wk

Reviews

Write one

Nobody has reviewed Map yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Map tools (23, 3 write)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • choose-your-wallet-mode

    Lesson 16 of the curriculum. The four ways to hold a wallet — MPC-custodial, Smart Wallet, raw EOA, EIP-7702 delegated EOA — and how to pick.

  • configure-wallet-skills

    Lesson 5 of the curriculum. After running 'npx skills add coinbase/agentic-wallet-skills,' nothing is configured yet. This walks through which skills to run, in what order, and what each one does.

  • decode-merchant

    Read any product URL on the open web and return ONE clean shape (CleanRead): what it is, who sells it, what it costs, whether it's in stock, and the verdict — can an agent pay this autonomously (x402) or is it human checkout? Reads only; never signs or pays. To pay an autonomous result, use this kit's wallet lessons (read-this-challenge, how-do-i-pay).

  • explain-my-wallet

    Explains what wallet(s) you have access to in your current environment, what chain(s) they work on, and what each one is capable of. Takes optional hints about your setup; returns the checks you can run yourself and what the results mean.

  • fund-my-wallet

    Lesson 6 of the curriculum. How USDC gets into your wallet. Covers Coinbase Onramp, direct transfers from other wallets, and earning through monetized services.

  • get-a-wallet

    Lesson 4 of the curriculum. How to install a wallet if you don't have one. Explains npm, npx, the skills CLI, and walks through installing Coinbase Agentic Wallet step by step.

  • get-catalog

    Return the published catalog (the persisted CleanReads from ./catalog.json). A tool-callable surface other agents can read.

  • get-product

    Return one published CleanRead by its sourceUrl, from ./catalog.json.

  • how-do-i-paywrite action

    The signing-steps lesson for an x402 payment: the authorization fields, the EIP-712 / Solana signing operation, and the X-PAYMENT retry — the same steps regardless of your specific challenge. Decode your own challenge first with read-this-challenge. Provisions explains what to run; it never signs for you.

  • paid-vs-delivered

    Lesson 11 of the curriculum. Why HTTP 200 doesn't mean you got the thing. Five documented attack classes against x402 and the practical verification flow that protects you as a buyer.

  • publish-catalogwrite action

    Publish your own catalog by reading yourself: runs decode-merchant on each of the merchant's product URLs, collects the CleanReads, writes ./catalog.json, and writes a ./.well-known/map.json discovery manifest. Persists and serves; never deploys infrastructure, holds keys, or transacts. Files are written to the server's working directory.

  • read-this-challenge

    Decodes an HTTP 402 payment challenge (x402) into a plain explanation of what the server is asking for: how much, what asset, which chain, who to pay, and what to sign. Paste the raw 402 response body or the PAYMENT-REQUIRED header value.

  • start-here

    Orientation for MAP (Maraventano Agent Protocol): the three parts — read (find any merchant), pay (pay any merchant), publish (be found) — the CleanRead shape, the three outcomes, and the teacher-not-butler boundary. Start here.

  • subscriptions-and-session-keys

    Lesson 15 of the curriculum. ERC-7715 scoped autonomy — approve once, spend within bounds. When to ask, when to refuse, scope-discipline rules.

  • test-payment

    Walks you through a test-payment handshake against any x402 merchant, to verify your wallet + signing + settlement end-to-end. Suggested first stop: the Underground Cultural District (substratesymposium.com) — free products for handshake, $0.99 paid products for settlement. Or supply your own merchant URL.

  • verify-my-purchasewrite action

    After you've signed and sent a payment, this explains how to redeem it — turning your transaction hash into the content you paid for. Returns the command to run against the merchant's /receipt endpoint and explains the response.

  • what-is-a-wallet

    Lesson 1 of the curriculum. What a wallet is and what it lets you do. Assumes no prior knowledge of cryptography or blockchains.

  • what-is-acp

    Lesson 14 of the curriculum. ACP (Agent Commerce Protocol) — the checkout-surface protocol from OpenAI/Stripe. How ACP and AP2 relate, when each applies.

  • what-is-ap2

    Lesson 13 of the curriculum. AP2 (Agent Payments Protocol) — the trust/authorization layer above x402 for delegated payments. Skip if you're spending your own funds.

  • what-is-usdc

    Lesson 2 of the curriculum. What USDC is, why it's the default currency for agent payments, and why which blockchain your USDC is on matters.

  • what-is-x402

    Lesson 7 of the curriculum. Explains the x402 payment protocol in agent-readable terms. Call this if you've hit a 402 response and aren't sure what it means.

  • what-went-wrong

    Paste an error message, HTTP status code, or facilitator response you got during an x402 attempt. Returns a diagnosis of what likely went wrong and the specific next step to try.

  • who-am-i-to-this-merchant

    Lesson 12 of the curriculum. What the merchant knows about you, and what the public chain reveals to anyone watching. Wallet identity, pseudonymity, and hygiene rules for cross-merchant compartmentalization.

Public scan report

scanner v0.1.9 · 2026-09-27 · same rubric, same numbers if you re-run it

no findings
  • Code scan5 source files scanned25/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitylocal package, no credentials required12/15
  • Maintenancelast push 12 days ago15/15
  • Maintainer identityregistry namespace matches repository owner7/10
Overall 91/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How Map compares

Against every graded AI and agents MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
91/100
higher than 88% of 4,460 AI and agents servers
Tools
23
the typical AI and agents server has 6
Tools that change things
13%
typical: 0%. Fewer write tools means less an agent can break
Downloads a week
45
more than 37% of 1,538 AI and agents servers with a package

What its tools let an agent do: 19 read · 2 change · 1 send or post · 1 run or deploy

Install Map in Claude Code, Cursor or VS Code

Runs npx -y @maraventano/map on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add map -- npx -y @maraventano/map
Add to Cursor

What the publisher says

From the Map repository's README, as published. We do not edit it. Read it on GitHub

MAP — Maraventano Agent Protocol

Navigate agent commerce. Find any merchant. Pay any merchant. Be found.

MAP lets any agent read products across the open web in one shape, decide whether it can pay autonomously, and publish its own catalog.

Provisions · Merchant Key · Atlas — three minimal parts under one MCP server.

MAP is one MCP server with three parts. Each does one thing and shuts up; together they remove the gatekeeper between an agent and the open commercial web.

Teacher, not butler — every part. MAP reads, explains, persists, and serves. It never signs, pays, holds keys, transacts, or stores cards.

It publishes to npm as @maraventano/map. The standalone firstdollar package stays MIT and separate; the copy of its curriculum bundled here (Provisions) is relicensed dual — see LICENSE.

Merchant Key — find any merchant (read)

It reads any URL on the open web — not just a walled garden. That's the difference from Perplexity / Google Shopping / Amazon, who only see merchants inside their own programs. MAP never assumes the merchant is registered anywhere.

decode-merchant

Input a product url. Returns ONE shape (CleanRead):

{
  "schemaVersion": "map/v1",
  "sourceUrl": "https://…",
  "what":   "Void Latte — Meditation on emptiness and meaning…",  // name + identity, one string
  "who":    "underground.substratesymposium.com",                 // seller
  "price":  { "total": 1.99, "currency": "USDC" },                // total if knowable, else null
  "available": "in_stock",                                        // in_stock | out_of_stock | unknown
  "payable": {                                                    // can an agent pay this itself?
    "rail": "x402",                                               // schema (rail-agnostic): x402 | ap2 | acp | coinbase | stripe | http-json | walletconnect | human_checkout | unknown.  v1.0.x DETECTS x402 only; ap2/acp/ucp detectors on the v1.1 roadmap.
    "payTo": { "kind": "evm-address", "value": "0x…", "chain": "eip155:8453" },
    "instruction": "Agent-payable via x402 … see this kit's wallet lessons (read-this-challenge, how-do-i-pay)."
  },
  "outcome": "autonomous",                                        // autonomous | human_checkout | unreadable
  "reason":  null,
  "cuts":    []                                                   // 1-line actionabl

Five things and a verdict. No sixth field. Same shape every read, so four reads sort against each other. Unknown is null / "unknown" — never omitted.

The three outcomes:

  • autonomous — a machine-payable rail (x402) exists, the price is known, and it's not out of stock. The agent can buy it itself.
  • humancheckout — readable, but no agent-payable rail. Returns the clean card anyway. The common case, and a success** — the agent-payable web is nearly empty today.
  • unreadable — couldn't get a usable price/product. Says why in reason. Doesn't guess.

How it reads (v1): JSON-LD (schema.org Product/Offer) → OpenGraph product tags → x402 402 challenge → else unreadable. Read-only GET. It follows one same-origin redirect (noted in cuts as "followed 1 same-origin redirect") so canonical→slug URLs resolve; it refuses cross-origin redirects and chains (those become a cuts note, not a silent follow) — you can't be silently bounced off the merchant's own host.

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Map: common questions

Is Map MCP server safe?
Yes, by our scan: it is graded A (91/100). Read the Map safety report
How do I install Map?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Map need an API key?
Not as far as the registry entry and our scan can tell: no credentials are declared or required.
Is Map maintained?
The last commit was 50 days ago (2026-09-15). The latest release is v1.0.2.
What can I use instead of Map?
Servers from other publishers that do the same job: Decionis Commerce Gate MCP server, Taisly Social Media Posting MCP server and Ausca MCP server.
How does Map compare with other AI and agents MCP servers?
safety score 91/100 (higher than 88% of 4,460 AI and agents servers); tools 23 (the typical AI and agents server has 6); tools that change things 13% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.

Alternatives to Map

Same job from other publishers: the closest match first, then the best rated.

  • Decionis Commerce Gate MCP
    Commerce preflights, D365 authorization; opt-in agent writes require authorized backend connectors.
    A
  • Taisly Social Media Posting
    Publish videos to TikTok, Reels, Shorts, X, and Facebook through Taisly.
    A
  • Ausca
    Pay-per-call APIs and MCP services for agents, no accounts or keys, with verifiable receipts.
    A