# io.github.sonpiaz/openaffiliate-mcp

> Search and discover affiliate programs with agent-ready data and commission details.

- name: io.github.sonpiaz/openaffiliate-mcp
- version: 0.0.3
- connection class: R0 (autonomous)
- trust: 79/100
- quality: 75/100 (good)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/io.github.sonpiaz%2Fopenaffiliate-mcp
- tools: https://api.protogrid.dev/v1/servers/io.github.sonpiaz%2Fopenaffiliate-mcp/tools

**An agent can connect right now, no human step.** Remote endpoint, no authentication, reachable on the last probe.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "openaffiliate-mcp": {
      "type": "http",
      "url": "https://openaffiliate.dev/api/mcp"
    }
  }
}
```


## Trust

- hygiene: 100
- liveness: 100
- freshness: 45
- provenance: 65
- drivers: +repository +reachable +uptime-100% -stale-186d
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 75/100 (good)

### protocol: 75 (weight 25)

- warn `protocol.modern`: newest supported version is 2025-11-25; 2026-07-28 not supported, older versions are deprecated until 2027-07-28
- n/a `protocol.stateless`: only applies to 2026-07-28 servers
- pass `protocol.transport`: streamable HTTP
- n/a `protocol.list_ttl`: only applies to 2026-07-28 servers

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 100 (weight 30)

- pass `tools.descriptions`: every tool has a description
- pass `tools.description_length`: descriptions are concise
- pass `tools.schemas`: every tool has an object input schema
- pass `tools.annotations`: 3 of 3 tools declare readOnlyHint or destructiveHint
- pass `tools.directory_hints`: every tool declares readOnlyHint, destructiveHint, idempotentHint and openWorldHint
- pass `tools.token_cost`: about 697 tokens to load every tool
- pass `tools.api_dump`: tools are not a one-to-one API dump

### stability: 50 (weight 15)

- pass `stability.changes`: 4 tool changes in 30 days
- fail `stability.rug_pull`: 3 tools kept their name but changed most of their description in 30 days; review before trusting them

### dependencies: 50 (weight 15)

- warn `deps.known_vulns`: 1 advisory of lower severity or without a published fix: GHSA-5r4p-p66f-jhc7 in hono@4.13.9 (indirect, fixed in 4.13.11)
- fail `deps.mcp_sdk_version`: @modelcontextprotocol/sdk 1.30.1 has 3 known advisories (GHSA-22jm-h49p-29qw, GHSA-6prh-2h8m-c8cw, GHSA-6qxp-vccf-f47h); update @modelcontextprotocol/sdk to 1.32.0 or later
- pass `deps.resolvable`: openaffiliate-mcp@0.0.3 resolved: 98 packages

- tools: 3, about 697 tokens to load them all
- tool set hash: 5ea2ba69d6c201308b5d143b82ada33d
- tools last changed: 2026-10-20T00:21:53.837Z
- badge: [![protogrid quality](https://protogrid.dev/badge/io.github.sonpiaz/openaffiliate-mcp.svg)](https://protogrid.dev/servers/io.github.sonpiaz/openaffiliate-mcp)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

- 2026-10-20 `get_program` changed (outputSchema)
- 2026-10-19 `list_categories` changed (description, outputSchema, annotations) **meaning changed**
  - before: List all affiliate program categories with the number of programs in each
  - after: Use to browse category names and active program counts before filtering a search. Returns all registry categories, including categories with zero active listings. Do not use for program details or commission comparisons; call search_programs with a returned category, then get_program for individual terms.
- 2026-10-19 `get_program` changed (description, inputSchema, outputSchema, annotations) **meaning changed**
  - before: Get full details of an affiliate program including agent instructions, commission terms, restrictions, and signup info
  - after: Use with a known slug or alias to read full program details, status, agentPrompt recommendation guidance, restrictions, signup information, and a citable markdownUrl. Also returns paused entries and dated answers with alternatives for discontinued or no_program brands. Do not use for broad discovery; call search_programs first if the slug is unknown. Read status and agentPrompt before recommending; if no entry exists, use search_programs to find a match.
- 2026-10-19 `search_programs` changed (description, inputSchema, outputSchema, annotations) **meaning changed**
  - before: Search affiliate programs by keyword, category, or commission type
  - after: Use to discover active affiliate programs by keyword, category, commission type, or verified status. Returns matching summaries with canonical slugs, commission figures, signup links, and citable markdownUrl fields. Do not use to check a known brand's paused or no-program status; call get_program with its slug. Call list_categories for category names, then get_program for recommendation guidance and restrictions before recommending a match.

Full history: https://api.protogrid.dev/v1/servers/io.github.sonpiaz%2Fopenaffiliate-mcp/changes

## Dependencies

- npm openaffiliate-mcp@0.0.3: resolved, 97 dependencies, MCP SDK @modelcontextprotocol/sdk 1.30.1
  - GHSA-22jm-h49p-29qw (high) in `` @modelcontextprotocol/sdk@1.30.1 ``, direct, fixed in `` 1.32.0 ``, advisory summary: "MCP TypeScript SDK: Experimental tasks were not tied to the session that created them" https://osv.dev/vulnerability/GHSA-22jm-h49p-29qw
  - GHSA-6qxp-vccf-f47h (high) in `` @modelcontextprotocol/sdk@1.30.1 ``, direct, fixed in `` 1.31.0 ``, advisory summary: "MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server" https://osv.dev/vulnerability/GHSA-6qxp-vccf-f47h
  - GHSA-6prh-2h8m-c8cw (moderate) in `` @modelcontextprotocol/sdk@1.30.1 ``, direct, fixed in `` 1.32.0 ``, advisory summary: "MCP TypeScript client SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies" https://osv.dev/vulnerability/GHSA-6prh-2h8m-c8cw
  - GHSA-5r4p-p66f-jhc7 (moderate) in `` hono@4.13.9 ``, indirect, fixed in `` 4.13.11 ``, advisory summary: "Hono: \`serveStatic\` decodes the request path a second time, leading to bypass of middleware on static paths" https://osv.dev/vulnerability/GHSA-5r4p-p66f-jhc7

Dependency graphs from deps.dev; advisories from OSV.dev, including the GitHub Advisory Database and the PyPI Advisory Database; all CC BY 4.0.

## Remotes

- https://openaffiliate.dev/api/mcp (streamable-http, auth none, reachable true, uptime30d 1)

## Packages

- npm openaffiliate-mcp@0.0.3

## Tools (3)

- `get_program`: Use with a known slug or alias to read full program details, status, agentPrompt recommendation guidance, restrictions, signup information, and a citable markdownUrl. Also returns paused entries and dated answers with alternatives for discontinued or no_program brands. Do not use for broad discovery; call search_programs first if the slug is unknown. Read status and agentPrompt before recommending; if no entry exists, use search_programs to find a match.
- `list_categories`: Use to browse category names and active program counts before filtering a search. Returns all registry categories, including categories with zero active listings. Do not use for program details or commission comparisons; call search_programs with a returned category, then get_program for individual terms.
- `search_programs`: Use to discover active affiliate programs by keyword, category, commission type, or verified status. Returns matching summaries with canonical slugs, commission figures, signup links, and citable markdownUrl fields. Do not use to check a known brand's paused or no-program status; call get_program with its slug. Call list_categories for category names, then get_program for recommendation guidance and restrictions before recommending a match.