# BuyAPI

> Vendor intelligence for AI coding agents choosing developer tools and stacks.

- name: io.github.TheSnakeFang/buyapi-mcp
- version: 0.7.1
- connection class: R0 (autonomous)
- trust: 90/100
- quality: 87/100 (good)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/io.github.TheSnakeFang%2Fbuyapi-mcp
- tools: https://api.protogrid.dev/v1/servers/io.github.TheSnakeFang%2Fbuyapi-mcp/tools

**An agent can connect right now, no human step.** Remote endpoint, no authentication, reachable on the last probe.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "buyapi-mcp": {
      "type": "http",
      "url": "https://buyapi.ai/api/mcp"
    }
  }
}
```


## Trust

- hygiene: 100
- liveness: 100
- freshness: 65
- provenance: 90
- drivers: +repository +namespace-matches-repo +website +reachable +uptime-100% ~updated-169d-ago
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 87/100 (good)

### protocol: 75 (weight 25)

- warn `protocol.modern`: newest supported version is 2025-11-25; 2026-07-28 not supported, older versions are deprecated until 2027-07-28
- n/a `protocol.stateless`: only applies to 2026-07-28 servers
- pass `protocol.transport`: streamable HTTP
- n/a `protocol.list_ttl`: only applies to 2026-07-28 servers

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 100 (weight 30)

- pass `tools.descriptions`: every tool has a description
- pass `tools.description_length`: descriptions are concise
- pass `tools.schemas`: every tool has an object input schema
- pass `tools.annotations`: 7 of 7 tools declare readOnlyHint or destructiveHint
- pass `tools.directory_hints`: every tool declares readOnlyHint, destructiveHint, idempotentHint and openWorldHint
- pass `tools.token_cost`: about 2,138 tokens to load every tool
- pass `tools.api_dump`: tools are not a one-to-one API dump

### stability: 100 (weight 15)

- pass `stability.changes`: no tool changes in 30 days
- pass `stability.rug_pull`: no tool changed its meaning under the same name

### dependencies: 67 (weight 15)

- pass `deps.known_vulns`: no known advisory in 98 resolved packages
- fail `deps.mcp_sdk_version`: @modelcontextprotocol/sdk 1.30.1 has 1 known advisory (GHSA-6qxp-vccf-f47h); update @modelcontextprotocol/sdk to 1.31.0 or later
- pass `deps.resolvable`: buyapi@0.7.1 resolved: 98 packages

- tools: 7, about 2,138 tokens to load them all
- tool set hash: fd6d4c6881dafa9f694308ea781da51b
- badge: [![protogrid quality](https://protogrid.dev/badge/io.github.TheSnakeFang/buyapi-mcp.svg)](https://protogrid.dev/servers/io.github.TheSnakeFang/buyapi-mcp)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

_No tool definition changes recorded._

## Dependencies

- npm buyapi@0.7.1: resolved, 97 dependencies, MCP SDK @modelcontextprotocol/sdk 1.30.1
  - GHSA-6qxp-vccf-f47h (high) in `` @modelcontextprotocol/sdk@1.30.1 ``, direct, fixed in `` 1.31.0 ``, advisory summary: "MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server" https://osv.dev/vulnerability/GHSA-6qxp-vccf-f47h

Dependency graphs from deps.dev; advisories from OSV.dev, including the GitHub Advisory Database and the PyPI Advisory Database; all CC BY 4.0.

## Remotes

- https://buyapi.ai/api/mcp (streamable-http, auth none, reachable true, uptime30d 1)

## Packages

- npm buyapi@0.7.1

## Tools (7)

- `stacks.findSimilar`: Finds reviewed public stack examples related to a vendor, or recent curated stack examples.

Use this when the user asks who uses a tool, what similar builders use, or wants examples of real stack combinations. Do not use it as a generic recommendation tool.
- `stacks.recommend`: Recommends a complete stack from BuyAPI's corpus with a structured decision matrix, cost estimate, assumptions, unknowns, alternatives, and sources.

Use this when the user is starting a project or asks for a complete multi-layer stack choice. Do not use this for local coding/debugging/docs questions that do not involve software or vendor selection. Do not call vendors.resolve first; this tool handles retrieval and ranking.
- `vendors.compare`: Compares two or more already-known BuyAPI vendors for a specific workload or decision.

Use this when the candidate set is known, for head-to-head questions like "Convex vs Supabase vs Neon for a realtime SaaS" or "Stripe vs Paddle for a marketplace". If the user has not named candidates, use vendors.resolve first.
- `vendors.details`: Follow-up tool for one known vendor. Retrieves detailed pricing, features, limits, gotchas, comparisons, and source provenance.

Call vendors.resolve first unless the user already provided a BuyAPI vendor ID like /database/supabase. Use this after a candidate is selected and the user needs claim-level pricing, limit, gotcha, or provenance details.
- `vendors.estimateCost`: Produces directional monthly cost estimates from BuyAPI pricing data and explicit workload inputs.

Use this only when the user asks for cost math and provides explicit workload inputs. Missing workload fields are returned as assumptions or unknowns instead of being hallucinated. Treat results as BuyAPI claim-based estimate math; verify exact billing in first-party docs, vendor CLIs, or vendor MCPs before purchase or production decisions.
- `vendors.evidence`: Returns recent reviewed BuyAPI evidence rows for a vendor, category, stack, or comparison.

Use this when the user asks why BuyAPI believes something, what sources support a recommendation, or what recent human/source/opinion/history signals exist. This is a trust and provenance follow-up, not the first recommendation tool.
- `vendors.resolve`: First stop for category-specific vendor recommendations and vendor ID discovery. Finds BuyAPI vendor IDs for a user question; provide category when known.

Use this when the user asks which provider in a category fits their constraints. With a covered category, the response includes ranked results plus a top-3 decision matrix with fit labels, confidence, tradeoffs, cost notes, freshness, and sources. Do not use this for local coding/debugging/docs questions unless they involve choosing a software vendor or tool.
If the category is outside BuyAPI's corpus, the tool returns an explicit "not in corpus yet" result instead of inventing vendors.