Connect

8 clients · secrets stay placeholders

JSON (mcpServers)Claude CodeCodexOpenCodeCursorVS CodeGemini CLIGoose

{
  "mcpServers": {
    "commerce": {
      "type": "http",
      "url": "https://branddesign.ltd/mcp"
    }
  }
}

claude mcp add --transport http commerce https://branddesign.ltd/mcp

[mcp_servers.commerce]
url = "https://branddesign.ltd/mcp"

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "commerce": {
      "type": "remote",
      "url": "https://branddesign.ltd/mcp",
      "enabled": true
    }
  }
}

{
  "mcpServers": {
    "commerce": {
      "type": "http",
      "url": "https://branddesign.ltd/mcp"
    }
  },
  "deeplink": "cursor://anysphere.cursor-deeplink/mcp/install?name=commerce&config=eyJ0eXBlIjoiaHR0cCIsInVybCI6Imh0dHBzOi8vYnJhbmRkZXNpZ24ubHRkL21jcCJ9"
}

{
  "servers": {
    "commerce": {
      "type": "http",
      "url": "https://branddesign.ltd/mcp"
    }
  }
}

{
  "mcpServers": {
    "commerce": {
      "httpUrl": "https://branddesign.ltd/mcp"
    }
  }
}

extensions:
  "commerce":
    enabled: true
    name: "commerce"
    type: streamable_http
    uri: "https://branddesign.ltd/mcp"
    timeout: 300

Quality 92 / 100strong

protocol100 · weight 25

pass
protocol.modernsupports 2026-07-28 (server/discover)
pass
protocol.statelessanswers without a session
pass
protocol.transportstreamable HTTP
pass
protocol.list_ttltool list is cacheable (ttlMs 3600000)

authorizationn/a · weight 15

n/a
auth.prm, auth.as_metadata, auth.cimdno remote uses OAuth
n/a
auth.secret_in_urlno templated URL

tool hygiene93 · weight 30

pass
tools.descriptionsevery tool has a description
pass
tools.description_lengthdescriptions are concise
pass
tools.schemasevery tool has an object input schema
pass
tools.annotations10 of 10 tools declare readOnlyHint or destructiveHint
warn
tools.directory_hints6 of 10 tools declare all four hints; missing: catalog (destructiveHint, idempotentHint); manifest (destructiveHint, idempotentHint); kya_status (destructiveHint, idempotentHint); …
pass
tools.token_costabout 3,601 tokens to load every tool
pass
tools.api_dumptools are not a one-to-one API dump

stability75 · weight 15

warn
stability.changes8 tool changes in 30 days
pass
stability.rug_pullno tool changed its meaning under the same name

dependenciesn/a · weight 15

n/a
deps.known_vulns, deps.mcp_sdk_version, deps.resolvableno npm or PyPI package

10 tools, about 3,601 tokens to load them all · tool set 13b44765aeb4 · tools last changed 2026-10-09 · checked 2026-10-19 10:20 UTC

Tool changes

2026-10-09accept_offerchangedinput schema
2026-10-05start_paymentchangeddescription
before
Start payment for a stage. Needs credentials. Without sharedPaymentToken you receive a hosted payment session, which you may complete yourself with a payment instrument issued to you, or hand to the person you act for. With a delegated shared payment token the payment settles directly. A self-registered agent must first have current DNS domain-control KYA for its HTTPS contact domain; read the manifest for challenge, verification and status endpoints. KYA does not grant buyer payment authority. On-chain payment is not accepted. Errors: OFFER_EXPIRED (409) for an advance after 30 days, FINAL_NOT_RELEASED (409) when the final payment is not open yet, PAYMENTS_DISABLED (503).
after · 89% of words in common
Start payment for a stage. Needs credentials. Without sharedPaymentToken you receive a hosted payment session, which you may complete yourself with a payment instrument issued to you, or hand to the person you act for. With a delegated shared payment token the payment settles directly. A self-registered agent must first have current DNS domain-control KYA for its HTTPS contact domain: call kya_challenge with a domain you control, publish its DNS TXT record and call kya_verify; kya_status reads the current verification. KYA does not grant buyer payment authority. On-chain payment is not accepted. Errors: OFFER_EXPIRED (409) for an advance after 30 days, FINAL_NOT_RELEASED (409) when the final payment is not open yet, PAYMENTS_DISABLED (503).
2026-10-05create_orderchangedinput schema
2026-10-05kya_statusadded
Read DNS domain-control verification for your currently authenticated agent. Needs commerce.read for OAuth. Returns verification status and, when present, DNS instructions and validity timestamps. This does not change the contact, challenge or verification.
2026-10-05kya_verifyadded
Check the DNS TXT challenge for your currently authenticated agent and record domain-control verification. Needs commerce.order for OAuth. First call kya_challenge and publish its exact DNS TXT record. The response gives verifiedAt and validUntil; verification is currently valid for 24 hours. This does not authorize a purchase or a payment.
2026-10-05kya_challengeadded
Issue a fresh DNS TXT challenge for your currently authenticated agent identity. Needs commerce.order for OAuth. Supply an HTTPS contact URL on a domain you control, especially on the first OAuth connection. Omitting contact reuses the current contact. This replaces the previous challenge and clears its verification. Publish the returned txtValue at dnsName, then call kya_verify. Domain control does not establish buyer identity or grant spending authority. Do not publish secrets in DNS.
2026-09-29start_paymentchangeddescription, annotations
before
Start payment for a stage. Needs credentials. Without sharedPaymentToken you receive a hosted payment session, which you may complete yourself with a payment instrument issued to you, or hand to the person you act for. With a delegated shared payment token the payment settles directly. On-chain payment is not accepted. Errors: OFFER_EXPIRED (409) for an advance after 30 days, FINAL_NOT_RELEASED (409) when the final payment is not open yet, PAYMENTS_DISABLED (503).
after · 68% of words in common
Start payment for a stage. Needs credentials. Without sharedPaymentToken you receive a hosted payment session, which you may complete yourself with a payment instrument issued to you, or hand to the person you act for. With a delegated shared payment token the payment settles directly. A self-registered agent must first have current DNS domain-control KYA for its HTTPS contact domain; read the manifest for challenge, verification and status endpoints. KYA does not grant buyer payment authority. On-chain payment is not accepted. Errors: OFFER_EXPIRED (409) for an advance after 30 days, FINAL_NOT_RELEASED (409) when the final payment is not open yet, PAYMENTS_DISABLED (503).
2026-09-26create_orderchangedinput schema

Full history: list_changes · trend: quality JSON.

Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed. How it is computed.

Trust 79 / 100

no-repository

provenance45

liveness99

freshness100

hygiene80

+dns-namespace +reachable +uptime-98% +updated-4d-ago -no-repository

Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed. How it is computed.

Endpoints

remote	auth	reachable	uptime 30d	p50	protocol	last ok
`https://branddesign.ltd/mcp` streamable-http	none	yes	98%	444 ms	2026-07-28, 2025-11-25, 2025-06-18, 2025-03-26	2026-10-19

Tools (10)

`accept_offer`	Accept the offer on behalf of the buyer. Needs credentials. This locks the billing identity, the offer version and the hash of the terms as they stand at this moment. A later change to the website cannot pass for what was agreed. Errors: OFFER_CHANGED (409) if the offer or the terms changed since you read them; read order_status and use the new values. OFFER_EXPIRED (409) 30 days after the order. MANUAL_OFFER_REQUIRED (409) while a person has not priced the service yet.
`catalog`read-only	Read the service catalogue: names, prices, currency and terms. No credentials needed. All amounts are integers in the minor unit; 100000 means 1000.00 EUR.
`create_order`	Place an order for a service. Needs credentials. Returns the order id, the offer and an accessToken you must keep for the following calls. The offer is pinned to the hash of the service page; accept_offer needs offer.version and offer.terms.<language>.hash from it. Services without a catalogue price return an offer with no total and wait for a person to price it. Errors: MISSING_<field> when a required brief field is absent, UNEXPECTED_FIELD when the brief has a key the service does not declare.
`kya_challenge`	Issue a fresh DNS TXT challenge for your currently authenticated agent identity. Needs commerce.order for OAuth. Supply an HTTPS contact URL on a domain you control, especially on the first OAuth connection. Omitting contact reuses the current contact. This replaces the previous challenge and clears its verification. Publish the returned txtValue at dnsName, then call kya_verify. Domain control does not establish buyer identity or grant spending authority. Do not publish secrets in DNS.
`kya_status`read-only	Read DNS domain-control verification for your currently authenticated agent. Needs commerce.read for OAuth. Returns verification status and, when present, DNS instructions and validity timestamps. This does not change the contact, challenge or verification.
`kya_verify`	Check the DNS TXT challenge for your currently authenticated agent and record domain-control verification. Needs commerce.order for OAuth. First call kya_challenge and publish its exact DNS TXT record. The response gives verifiedAt and validUntil; verification is currently valid for 24 hours. This does not authorize a purchase or a payment.
`manifest`read-only	Read the commerce manifest: protocol, endpoints, authentication scheme, payment instrument and limits. No credentials needed.
`order_status`read-only	Read the current state of the order, its offer and its payments, including the invoice number once one has been issued. Needs credentials.
`register_agent`	Register yourself and receive a client identifier and a secret. No approval and no prior arrangement. The secret is returned once and cannot be recovered. Put them in the Authorization header as "Bearer <clientId>:<secret>" for the other tools.
`start_payment`destructive	Start payment for a stage. Needs credentials. Without sharedPaymentToken you receive a hosted payment session, which you may complete yourself with a payment instrument issued to you, or hand to the person you act for. With a delegated shared payment token the payment settles directly. A self-registered agent must first have current DNS domain-control KYA for its HTTPS contact domain: call kya_challenge with a domain you control, publish its DNS TXT record and call kya_verify; kya_status reads the current verification. KYA does not grant buyer payment authority. On-chain payment is not accepted. Errors: OFFER_EXPIRED (409) for an advance after 30 days, FINAL_NOT_RELEASED (409) when the final payment is not open yet, PAYMENTS_DISABLED (503).

Schemas: list_tools.

Similar MCP servers

Official server.json

{
  "name": "ltd.branddesign/commerce",
  "title": "Brand Design Ltd.",
  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
  "remotes": [
    {
      "url": "https://branddesign.ltd/mcp",
      "type": "streamable-http"
    }
  ],
  "version": "1.1.0",
  "description": "Branding, design and web services you can order and pay for without a human on the seller side."
}