# io.github.48x-ai/marketbasketanalysis-mcp

> Co-purchase intelligence and merchant ops tools for AI shopping, ecommerce, and B2B agents

- name: io.github.48x-ai/marketbasketanalysis-mcp
- version: 0.7.1
- connection class: R1 (autonomous)
- trust: 94/100
- quality: 74/100 (needs work)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/io.github.48x-ai%2Fmarketbasketanalysis-mcp
- tools: https://api.protogrid.dev/v1/servers/io.github.48x-ai%2Fmarketbasketanalysis-mcp/tools

**An agent can connect on its own if it already holds `MARKETBASKETANALYSIS_MCP_TOKEN`.** Remote endpoint behind a static API key or header. The registry never sees the value; the agent fills the placeholder.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "marketbasketanalysis-mcp": {
      "type": "http",
      "url": "https://mcp.marketbasketanalysis.com/mcp",
      "headers": {
        "Authorization": "Bearer ${MARKETBASKETANALYSIS_MCP_TOKEN}"
      }
    }
  }
}
```

Placeholders to fill: `${MARKETBASKETANALYSIS_MCP_TOKEN}`.

## Trust

- hygiene: 100
- liveness: 100
- freshness: 85
- provenance: 90
- drivers: +repository +namespace-matches-repo +website +reachable +uptime-100% ~updated-48d-ago
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 74/100 (needs work)

### protocol: 75 (weight 25)

- warn `protocol.modern`: newest supported version is 2025-11-25; 2026-07-28 not supported, older versions are deprecated until 2027-07-28
- n/a `protocol.stateless`: only applies to 2026-07-28 servers
- pass `protocol.transport`: streamable HTTP
- n/a `protocol.list_ttl`: only applies to 2026-07-28 servers

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 71 (weight 30)

- pass `tools.descriptions`: every tool has a description
- pass `tools.description_length`: descriptions are concise
- pass `tools.schemas`: every tool has an object input schema
- fail `tools.annotations`: no tool declares readOnlyHint or destructiveHint, so clients cannot tell safe calls from risky ones
- fail `tools.directory_hints`: no tool declares all four of readOnlyHint, destructiveHint, idempotentHint and openWorldHint; missing: get_recommendations (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); score_return_risk (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); predict_reorder (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); …
- pass `tools.token_cost`: about 4,248 tokens to load every tool
- pass `tools.api_dump`: tools are not a one-to-one API dump

### stability: 100 (weight 15)

- pass `stability.changes`: no tool changes in 30 days
- pass `stability.rug_pull`: no tool changed its meaning under the same name

### dependencies: 50 (weight 15)

- warn `deps.known_vulns`: 1 advisory of lower severity or without a published fix: GHSA-5r4p-p66f-jhc7 in hono@4.13.9 (indirect, fixed in 4.13.11)
- fail `deps.mcp_sdk_version`: @modelcontextprotocol/sdk 1.30.1 has 3 known advisories (GHSA-22jm-h49p-29qw, GHSA-6prh-2h8m-c8cw, GHSA-6qxp-vccf-f47h); update @modelcontextprotocol/sdk to 1.32.0 or later
- pass `deps.resolvable`: @marketbasketanalysis/mcp@0.7.1 resolved: 117 packages

- tools: 19, about 4,248 tokens to load them all
- tool set hash: 74f8642eb0aaf2929d7becdcbc7242fc
- badge: [![protogrid quality](https://protogrid.dev/badge/io.github.48x-ai/marketbasketanalysis-mcp.svg)](https://protogrid.dev/servers/io.github.48x-ai/marketbasketanalysis-mcp)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

_No tool definition changes recorded._

## Dependencies

- npm @marketbasketanalysis/mcp@0.7.1: resolved, 116 dependencies, MCP SDK @modelcontextprotocol/sdk 1.30.1
  - GHSA-22jm-h49p-29qw (high) in `` @modelcontextprotocol/sdk@1.30.1 ``, direct, fixed in `` 1.32.0 ``, advisory summary: "MCP TypeScript SDK: Experimental tasks were not tied to the session that created them" https://osv.dev/vulnerability/GHSA-22jm-h49p-29qw
  - GHSA-6qxp-vccf-f47h (high) in `` @modelcontextprotocol/sdk@1.30.1 ``, direct, fixed in `` 1.31.0 ``, advisory summary: "MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server" https://osv.dev/vulnerability/GHSA-6qxp-vccf-f47h
  - GHSA-6prh-2h8m-c8cw (moderate) in `` @modelcontextprotocol/sdk@1.30.1 ``, direct, fixed in `` 1.32.0 ``, advisory summary: "MCP TypeScript client SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies" https://osv.dev/vulnerability/GHSA-6prh-2h8m-c8cw
  - GHSA-5r4p-p66f-jhc7 (moderate) in `` hono@4.13.9 ``, indirect, fixed in `` 4.13.11 ``, advisory summary: "Hono: \`serveStatic\` decodes the request path a second time, leading to bypass of middleware on static paths" https://osv.dev/vulnerability/GHSA-5r4p-p66f-jhc7

Dependency graphs from deps.dev; advisories from OSV.dev, including the GitHub Advisory Database and the PyPI Advisory Database; all CC BY 4.0.

## Remotes

- https://mcp.marketbasketanalysis.com/mcp (streamable-http, auth api_key ${MARKETBASKETANALYSIS_MCP_TOKEN}, reachable true, uptime30d 1)

## Packages

- npm @marketbasketanalysis/mcp@0.7.1 secrets: MBA_API_KEY

## Tools (19)

- `analyze_basket`: Run market-basket analysis on a proposed basket / bundle to score its cohesion. Given 2+ products, returns a cohesion score 0..1 representing how strongly they bind together (their affinity) in the merchant's order data. Use this to vet a proposed bundle BEFORE recommending it, so agents can avoid suggesting bundles that look plausible but have no statistical signal. Also useful for 'is this a good bundle?', 'analyze this basket', or 'do these products go together?' questions.
- `execute_weekly_plan_action`: Execute a specific action from the merchant's weekly plan (publish bundle, run mining job, archive rule, etc.). Idempotent by action_id, safe to retry. Use this AFTER the merchant has confirmed which action from get_weekly_plan they want to run; do not call preemptively.
- `explain_drift`: Explain ONE drift alert: return its prior and current confidence (plus support, lift, and order sample count when the rule is still live) and a short plain-language narrative of how the pair moved versus the prior mining run. Use this when a merchant asks 'why did this pair drift?', 'explain this alert', or 'what changed for these two products?' after seeing it in get_drift_alerts. Different from get_drift_alerts: that lists the feed, this drills into a single alert_id with the change spelled out in a sentence. Handles a disappeared pair gracefully (only the prior confidence is available). BigCommerce only today.
- `explain_opportunity`: Explain ONE mined opportunity: return its support, confidence, lift, and order sample count plus a short plain-language narrative of why the pair is a good cross-sell. Use this when a merchant asks 'why is this a good cross-sell?', 'explain this opportunity', or 'why should I bundle these?' after seeing it in get_opportunities. Different from get_opportunities: that lists the ranked set, this drills into a single opportunity_id with the stats spelled out in a sentence. Different from get_rationale: rationale is a generic pair 'why', this is the specific mined opportunity's own numbers. BigCommerce only today.
- `find_substitutes`: For a given product, recommend the top substitute items that could REPLACE it (not complement it). Substitutes are the inverse of cross-sell: this answers 'what to buy instead', not 'what to buy with'. Use this when the user asks 'what's a substitute for X?', 'X is out of stock, what's a good alternative?', 'recommend a replacement for Y', 'find an equivalent product', or when a procurement agent needs to swap an unavailable SKU. Returns a ranked list with a similarity score and a reason (context_similar / category_match / vendor_match). Works for Shopify, Magento, and WooCommerce merchants.
- `forecast_bundle`: For an inventory, purchasing, or merchant-ops agent: forecast weekly sales and recommend a buy quantity for a specific bundle over a configurable horizon. Uses additive Holt-Winters on the bundle's stored historical sales (demand forecasting). Use this when the agent asks 'how many of bundle X should I order?', 'what should I stock for the next N weeks?', 'what's the demand outlook for bundle Y?', or 'forecast the next 8 weeks for the camera bundle'.
- `get_bundle_for_cart`: Given a list of products already in the cart, recommend products that frequently bundle with the cart to complete a high-confidence bundle. This is multi-item basket analysis for cart completion. Use when the user describes a multi-item cart and asks 'what else do I need?', 'what completes this set?', 'what's missing from this bundle?', 'recommend add-ons for this cart', or similar. Different from get_recommendations: this takes MULTIPLE products and returns items that pair with the cart as a whole, not single-item pairings.
- `get_drift_alerts`: For a merchant-ops or analytics agent: list active drift alerts, the recommendation rules whose confidence has materially changed (weakened, strengthened, disappeared, emerged) versus the prior mining job. Use this when a merchant asks 'what's changed?', 'is my model still accurate?', 'are any rules drifting?', or wants to investigate a SKU swap / seasonal shift.
- `get_forecast_alerts`: For an inventory or merchant-ops agent: list forecast-based alerts, the bundles with stockout risk, demand drop, demand spike, or an unreliable forecast curve. Use this when a merchant asks 'what's at risk of stockout?', 'which bundles are losing demand?', 'do I need to reorder anything?', or 'what should I restock?'. Pair with forecast_bundle to drill into a specific bundle.
- `get_opportunities`: List the merchant's ranked bundle / cross-sell opportunities mined from order history, with support / confidence / lift / revenue-weighted score. Use this when a merchant asks 'what are my top opportunities?', 'show me the best bundles I haven't published yet', or 'what should I prioritize?'. Pair with triage_opportunity to act on a specific one.
- `get_rationale`: Fetch the one-sentence rationale for why product B is recommended alongside product A. Returns a short merchandiser-grade explanation ('these are commonly bought together by customers buying X') suitable for surfacing in a recommendation tile or chat reply. Use this after get_recommendations / get_bundle_for_cart when the agent or user asks 'why are these recommended together?' or 'explain this pairing'.
- `get_recommendations`: For a given product, recommend the top complementary, frequently-bought-together products customers also bought, based on mined order-history association rules. This is the single-product cross-sell tool. Use this when the user asks 'what goes with X?', 'what should I bundle with X?', 'what do customers also buy with X?', 'recommend products to cross-sell with X', or similar single-product co-purchase questions. Works for Shopify, Magento, and WooCommerce merchants.
- `get_weekly_plan`: Fetch the current weekly action plan for the merchant: a ranked list of typed actions (publish opportunity, retire stale bundle, reorder inventory, investigate drift, etc.) the merchant should take this week. Use this when a merchant asks 'what should I work on this week?', 'what's on my plate?', 'show me my weekly plan', or wants a summary of pending tasks before opening the admin.
- `mine_hui_itemsets`: Run high-utility itemset (HUI) mining on a caller-supplied payload of orders + per-line unit_profit. Returns top-K itemsets ranked by aggregate utility (sum of profit across all occurrences). Use this when an agent needs to evaluate which item combinations drive the most profit (not just frequency) for a specific time window or product subset. Plus or Enterprise tier required on the merchant account.
- `predict_reorder`: For a sales-rep or inventory / account-management agent: predict when a B2B customer / account is due to reorder. Returns predicted next-order dates for every SKU the customer has ordered >=2 times, with confidence based on the regularity of their cadence (reorder prediction / replenishment forecasting). Bucketed into 'overdue' / 'due_soon' / 'on_track' / 'not_predictable'. Use this when the agent asks 'what's Acme Corp due to reorder?', 'when will customer X need more of Y?', 'show me stockout risks for my B2B accounts', or for proactive replenishment workflows. Works on the Shopify, BigCommerce, WooCommerce, and Magento backends. Not available on OroCommerce.
- `propose_subscription_bundle`: Propose a recurring subscription bundle for a customer based on their first-order items. Given 1-5 seed products the customer has bought, returns a recurring subscription bundle (3-6 items) of the seeds plus complementary products, with a predicted cadence (median days between reorders), a 0..1 confidence score, and a rough monthly_value when prices are known. Use this when a merchant agent asks 'what should they subscribe to?', 'build a monthly subscription bundle from this order', 'propose a subscription bundle', 'recommend a recurring replenishment bundle', or 'what's the right subscription frequency for this customer?'. If a customer_id is supplied the tool blends in the customer's per-SKU reorder cadence; without one it falls back to the seed catalog cohesion alone. Works for Shopify, Magento, and WooCommerce merchants.
- `score_cross_sell`: Score the cross-sell strength (product affinity) between two specific products. Returns the confidence the merchant's real co-purchase data supports for the pair, or a clear 'no signal' result when there's no qualifying rule. Use this to validate a proposed pair before recommending it, or to answer 'is X a good cross-sell for Y?', 'how strong is the affinity between X and Y?', or 'how often are X and Y bought together?'.
- `score_return_risk`: Predict return risk for a candidate bundle of 2-6 products. Returns the composite bundle return rate (max of items, since one returned item typically returns the whole bundle), each item's historical return rate, and a low/medium/high risk recommendation. Use this when the user asks 'will this bundle get returned?', 'predict return risk for these items', 'fashion bundle risk', 'is this set risky to ship together?', or when an agent is composing a bundle and wants to verify it won't tank the merchant's return KPIs. Backed by return-aware mining over the merchant's real order + refund history.
- `triage_opportunity`: Pause, activate, or archive a specific opportunity from get_opportunities. State-mutating; guarded by confirm=true. Use this after the merchant has explicitly picked an opportunity to act on. Pass action='activate' to publish a proposed rule, 'pause' to temporarily hide an active one, 'archive' to permanently retire it.