# Nagora

> Buy real goods with Nano (XNO) through escrow. Search, purchase, track orders, get signed receipts.

- name: shop.nagora/nagora
- version: 1.0.1
- connection class: R0 (autonomous)
- trust: 93/100
- quality: 76/100 (good)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/shop.nagora%2Fnagora
- tools: https://api.protogrid.dev/v1/servers/shop.nagora%2Fnagora/tools

**An agent can connect right now, no human step.** Remote endpoint, no authentication, reachable on the last probe.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "nagora": {
      "type": "http",
      "url": "https://api.nagora.shop/mcp"
    }
  }
}
```


## Trust

- hygiene: 100
- liveness: 100
- freshness: 85
- provenance: 85
- drivers: +repository +dns-namespace +website +reachable +uptime-99% ~updated-40d-ago
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 76/100 (good)

### protocol: 75 (weight 25)

- warn `protocol.modern`: newest supported version is 2025-11-25; 2026-07-28 not supported, older versions are deprecated until 2027-07-28
- n/a `protocol.stateless`: only applies to 2026-07-28 servers
- pass `protocol.transport`: streamable HTTP
- n/a `protocol.list_ttl`: only applies to 2026-07-28 servers

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 79 (weight 30)

- pass `tools.descriptions`: every tool has a description
- pass `tools.description_length`: descriptions are concise
- pass `tools.schemas`: every tool has an object input schema
- warn `tools.annotations`: only 5 of 9 tools declare readOnlyHint or destructiveHint
- fail `tools.directory_hints`: no tool declares all four of readOnlyHint, destructiveHint, idempotentHint and openWorldHint; missing: search_listings (destructiveHint, idempotentHint, openWorldHint); register_agent (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_order (destructiveHint, idempotentHint, openWorldHint); …
- pass `tools.token_cost`: about 1,732 tokens to load every tool
- pass `tools.api_dump`: tools are not a one-to-one API dump

### stability: 100 (weight 15)

- pass `stability.changes`: 1 tool changes in 30 days
- pass `stability.rug_pull`: no tool changed its meaning under the same name

### dependencies: 50 (weight 15)

- warn `deps.known_vulns`: 1 advisory of lower severity or without a published fix: GHSA-5r4p-p66f-jhc7 in hono@4.13.9 (indirect, fixed in 4.13.11)
- fail `deps.mcp_sdk_version`: @modelcontextprotocol/sdk 1.30.1 has 3 known advisories (GHSA-22jm-h49p-29qw, GHSA-6prh-2h8m-c8cw, GHSA-6qxp-vccf-f47h); update @modelcontextprotocol/sdk to 1.32.0 or later
- pass `deps.resolvable`: @nagora/mcp@0.1.0 resolved: 98 packages

- tools: 9, about 1,732 tokens to load them all
- tool set hash: 1ea6ba16b450cd010280103cf2ba0ce5
- tools last changed: 2026-10-08T22:37:43.946Z
- badge: [![protogrid quality](https://protogrid.dev/badge/shop.nagora/nagora.svg)](https://protogrid.dev/servers/shop.nagora/nagora)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

- 2026-10-08 `get_order` changed (description)
  - before: Polls an order placed by this agent. Returns orderStatus, escrowStatus, funding timestamps, tracking info, and the receipt ID once available. Poll after funding the deposit address, and after the seller ships, before calling confirm_delivery.
  - after: Polls an order placed by this agent. Returns orderStatus, escrowStatus, funding timestamps, tracking info, and the receipt ID once available. Poll after funding the deposit address, and after the seller ships, before calling confirm_delivery. For digital listings, digitalContent holds what was bought once the order is paid.

Full history: https://api.protogrid.dev/v1/servers/shop.nagora%2Fnagora/changes

## Dependencies

- npm @nagora/mcp@0.1.0: resolved, 97 dependencies, MCP SDK @modelcontextprotocol/sdk 1.30.1
  - GHSA-22jm-h49p-29qw (high) in `` @modelcontextprotocol/sdk@1.30.1 ``, direct, fixed in `` 1.32.0 ``, advisory summary: "MCP TypeScript SDK: Experimental tasks were not tied to the session that created them" https://osv.dev/vulnerability/GHSA-22jm-h49p-29qw
  - GHSA-6qxp-vccf-f47h (high) in `` @modelcontextprotocol/sdk@1.30.1 ``, direct, fixed in `` 1.31.0 ``, advisory summary: "MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server" https://osv.dev/vulnerability/GHSA-6qxp-vccf-f47h
  - GHSA-6prh-2h8m-c8cw (moderate) in `` @modelcontextprotocol/sdk@1.30.1 ``, direct, fixed in `` 1.32.0 ``, advisory summary: "MCP TypeScript client SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies" https://osv.dev/vulnerability/GHSA-6prh-2h8m-c8cw
  - GHSA-5r4p-p66f-jhc7 (moderate) in `` hono@4.13.9 ``, indirect, fixed in `` 4.13.11 ``, advisory summary: "Hono: \`serveStatic\` decodes the request path a second time, leading to bypass of middleware on static paths" https://osv.dev/vulnerability/GHSA-5r4p-p66f-jhc7

Dependency graphs from deps.dev; advisories from OSV.dev, including the GitHub Advisory Database and the PyPI Advisory Database; all CC BY 4.0.

## Remotes

- https://api.nagora.shop/mcp (streamable-http, auth none, reachable true, uptime30d 0.9915254)

## Packages

- npm @nagora/mcp@0.1.0

## Tools (9)

- `cancel_order`: Cancels an order whose escrow is still Initiated (no on-chain funds sent yet). Restores listing stock. Cannot cancel once escrow is Funded; use the dispute or refund flow on the website instead.
- `confirm_delivery`: Confirms the goods or digital content arrived and releases the escrowed funds to the seller. Requires the order's escrowStatus to be Shipped. Call promptly once delivery is verified: the seller is waiting on this to get paid. If never called, an auto-finalise timer releases funds after the configured window.
- `create_purchase`: Places an order against a listing. Returns a depositAddress (per-order escrow Nano account) and amountNano. IMPORTANT: the order is not funded by this call. Send exactly amountNano to depositAddress from the agent's Nano wallet to fund escrow. Once funds are detected the order moves to AwaitingShipment automatically. Physical listings require a shippingAddress.
- `get_listing`: Fetch a single listing by ID. No API key required. Returns full detail including variants, delivery options, and pricing. Use the returned Nano total as quotedTotalNano when purchasing to guard against exchange-rate drift.
- `get_order`: Polls an order placed by this agent. Returns orderStatus, escrowStatus, funding timestamps, tracking info, and the receipt ID once available. Poll after funding the deposit address, and after the seller ships, before calling confirm_delivery. For digital listings, digitalContent holds what was bought once the order is paid.
- `get_receipt`: Returns the cryptographically signed receipt for a completed order, including the seller's Nano address, the on-chain payout block hash, and Nagora's KMS signature. Available only after escrow is Released; returns an error while the order is still in progress.
- `register_agent`: Creates a Nagora agent and mints its API key in one call. No Nagora account or signup required. IMPORTANT: this is a remote server with no local storage, so the key is returned ONCE in the result. Store it securely and pass it as the apiKey argument on subsequent calls in this session; for long-lived setups reconnect with an 'Authorization: Bearer <key>' header instead. Skip this tool if a credential is already configured; check with whoami.
- `search_listings`: Full-text search over active listings on nagora.shop. No API key required. Returns an items array and total count. Use get_listing for full detail before purchasing.
- `whoami`: Verifies the configured credential and returns the agent's identity, spending caps, callback URL, and webhook secret. Call this first to confirm the credential works.