llc.facet/ucp-shopping

Est-ce que llc.facet/ucp-shopping est sûr ?

Au dernier audit MCP Hub, le serveur MCP « llc.facet/ucp-shopping » est classé « Non encore testé ». Référencé dans l'annuaire. Seul le pentest comportemental fait foi, et il n'a pas encore été exécuté sur ce serveur. Le verdict est réévalué en continu ; consultez la fiche pour l'état à jour.

Méthode : MCP Hub analyse la description de chaque outil (couche 1) et, pour le verdict fort, exécute le serveur dans une micro-VM isolée avec leurres et réseau bloqué (couche 2). On publie des noms et des compteurs, jamais le contenu brut renvoyé par un outil.

Les 23 outils

• cancel_cart≈ 76 tokens

  Cancel a cart. Idempotent, owner-scoped, and moves no money. REQUIRES IDENTITY plus an Idempotency-Key on a signature-required Terminal.

  Paramètres, retour & exemple (1)

  Paramètres

  • id · string · requis
    The cart id.

  Exemple d'appel

  {"name": "cancel_cart", "arguments": {"id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• cancel_checkout≈ 104 tokens

  Cancel a checkout session before completion, releasing its inventory hold. Idempotent, owner-scoped, and moves no money (distinct from an escrow refund). REQUIRES IDENTITY plus an Idempotency-Key on a signature-required Terminal.

  Paramètres, retour & exemple (1)

  Paramètres

  • id · string · requis
    The checkout session id.

  Exemple d'appel

  {"name": "cancel_checkout", "arguments": {"id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• complete_checkout≈ 272 tokens

  Complete a checkout you created and place the order by submitting the buyer-signed payment credential. This is the MONEY-MOVING leg: funds capture on-chain to the merchant's pay_to (x402) or into escrow (Boson). The amount is re-derived server-side from the reservation, never your request, and the buyer's signature is verified before any capture. A per-buyer refusal (FORBIDDEN, cap-exceeded, FULFILLMENT_REQUIRED) returns as an error result; a missing or invalid identity is a real 401. REQUIRES IDENTITY plus a signed Idempotency-Key on a signature-required Terminal.

  Paramètres, retour & exemple (2)

  Paramètres

  • payment · object · requis
    The payment container `{ instruments: [{ credential: { type, ... } }] }`, where credential.type is `x402_authorization` or `boson_commit_authorization`. Sign the seller-signed offer LOCALLY with your own wallet; Facet never holds your key.
  • checkout_id · string · requis
    The checkout id from create_checkout.

  Exemple d'appel

  {"name": "complete_checkout", "arguments": {"payment": {}, "checkout_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• create_cart≈ 178 tokens

  Create a pre-checkout cart from catalog line items. A cart is a mutable scratchpad: it moves no money and holds no inventory, so it carries estimated (server-derived) totals and NO payment_handlers. Assemble it, then create_checkout(cart_id) to convert. REQUIRES IDENTITY on a signature-required Terminal.

  Paramètres, retour & exemple (1)

  Paramètres

  • line_items · array · optionnel
    Items, each `{ item: { id }, quantity }`. Prices are catalog-derived, never yours.

  Exemple d'appel

  {"name": "create_cart", "arguments": {"line_items": []}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• create_checkout≈ 296 tokens

  Open a checkout session for one or more catalog line items (or promote a cart with `cart_id`). Returns the session plus server-resolved `payment_handlers` (rail, pay_to, exact amount) to satisfy: the price and pay_to are the MERCHANT's, sealed here, never read from your request. Physical goods REQUIRE a `fulfillment` ship-to (else FULFILLMENT_REQUIRED), sealed at create. REQUIRES IDENTITY on a signature-required Terminal: a Facet KYA as `Authorization: Bearer <kya>`.

  Paramètres, retour & exemple (3)

  Paramètres

  • cart_id · string · optionnel
    Promote an existing cart: its stored lines drive the checkout and any line_items are ignored (the business must use the cart contents).
  • line_items · array · optionnel
    Items to buy, each `{ item: { id }, quantity }`. Omit when using cart_id.
  • fulfillment · object · optionnel
    Ship-to destination. REQUIRED for physical products; sealed at create.

  Exemple d'appel

  {"name": "create_checkout", "arguments": {"cart_id": "texte", "line_items": [], "fulfillment": {}}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• discover_businesses≈ 330 tokens

  Find businesses in the Facet Universal Business Index that an agent can transact with. Returns `featured` (claimed merchants with a live `terminal_url` — point your catalog and checkout calls there) and `results` (the wider directory). Use this first when you do not already know which merchant to talk to. REQUIRES IDENTITY: send a Facet KYA as `Authorization: Bearer <kya>` on the MCP request. A KYA is an ES256 JWT from Facet's default issuer https://issuer.facet.llc (or another issuer this Terminal trusts — see KYA-Issuers in its /.well-known/agents.txt). Calling without one returns 401 with a signup link.

  Paramètres, retour & exemple (4)

  Paramètres

  • near · object · optionnel
    Optional geographic center to rank by proximity.
  • limit · integer · optionnel
    Max matches to return. Default 10, cap 50.
  • query · string · optionnel
    Free-text query, e.g. "flowers" or "makeup brushes".
  • radius_km · number · optionnel
    Search radius around `near`, km. Default 25.

  Exemple d'appel

  {"name": "discover_businesses", "arguments": {"near": {}, "limit": 1, "query": "texte", "radius_km": 1}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• discover_products≈ 321 tokens

  Search products ACROSS every merchant in the Facet network that has opted into cross-merchant discovery. Returns matches each carrying the selling merchant's `terminal_url` (point your catalog and checkout calls there). Filter by free-text `query` (product name + description), exact `category`, and/or `tags` (all must be present); at least one filter is required. Use this when you know WHAT you want but not WHICH merchant sells it. REQUIRES IDENTITY: send a Facet KYA as `Authorization: Bearer <kya>` on the MCP request. A KYA is an ES256 JWT from Facet's default issuer https://issuer.facet.llc (or another issuer this Terminal trusts; see KYA-Issuers in its /.well-known/agents.txt). Calling without one returns 401 with a signup link.

  Paramètres, retour & exemple (4)

  Paramètres

  • tags · array · optionnel
    Tags that must ALL be present on a matching product.
  • limit · integer · optionnel
    Max matches to return. Default 10, cap 50.
  • query · string · optionnel
    Free-text over product name + description, e.g. "lavender soap".
  • category · string · optionnel
    Exact product category to match.

  Exemple d'appel

  {"name": "discover_products", "arguments": {"tags": [], "limit": 1, "query": "texte", "category": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_cart≈ 85 tokens

  Read back one of YOUR carts by id: line items and estimated totals. Owner-scoped, so another agent's id returns not_found. REQUIRES IDENTITY on a signature-required Terminal.

  Paramètres, retour & exemple (1)

  Paramètres

  • id · string · requis
    The cart id.

  Exemple d'appel

  {"name": "get_cart", "arguments": {"id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_checkout≈ 96 tokens

  Read back one of YOUR checkout sessions by id: status, totals, line items, payment_handlers. Owner-scoped, so another agent's id returns not_found. REQUIRES IDENTITY on a signature-required Terminal.

  Paramètres, retour & exemple (1)

  Paramètres

  • id · string · requis
    The checkout session id.

  Exemple d'appel

  {"name": "get_checkout", "arguments": {"id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_order≈ 121 tokens

  Read back one of YOUR orders on this merchant: status, amount, settlement state. Use the order_id returned when you paid. You can only read orders your own agent identity placed — another agent's order returns FORBIDDEN. REQUIRES IDENTITY: Facet KYA as `Authorization: Bearer <kya>`.

  Paramètres, retour & exemple (1)

  Paramètres

  • order_id · string · requis
    The order id returned at payment.

  Exemple d'appel

  {"name": "get_order", "arguments": {"order_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_payment_capabilities≈ 103 tokens

  Which settlement rails this merchant actually accepts (e.g. coin/boson-escrow for escrowed funds that release on fulfilment, coin/usdc-base for direct). Call before get_payment_requirements so you pass a rail_id this merchant registers, rather than guessing. No identity required — this is discovery data.

  Paramètres, retour & exemple (0)

  Exemple d'appel

  {"name": "get_payment_capabilities", "arguments": {}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_payment_requirements≈ 447 tokens

  Turn a `quote_token` from get_quote into a seller-signed payment offer to authorize. Returns `requirements` (escrow address, asset, exact atomic amount, network) — sign it LOCALLY with your own wallet (e.g. @bosonprotocol/x402-client handle402 for `coin/boson-escrow`, producing an X-PAYMENT string). Facet never holds your key and cannot sign for you, which is why paying is two steps and not one. The offer binds to the quote_token's sealed landed total and ship-to, so the amount is the merchant's, not one you name. REQUIRES IDENTITY: same Facet KYA as get_quote, and the SAME `aid` — the offer path rejects a quote_token issued to a different agent than the caller.

  Paramètres, retour & exemple (6)

  Paramètres

  • qty · integer · optionnel
    Must match the quote_token. Default 1.
  • amount · object · requis
    The landed total in ATOMIC units. Must equal the quote_token's sealed total.
  • rail_id · string · requis
    Settlement rail, e.g. "coin/boson-escrow" (escrow: funds release on fulfilment) or "coin/usdc-base". See /v1/payments/capabilities for what this merchant registers.
  • site_id · string · optionnel
    Usually omitted — this Terminal's bound site is used.
  • product_id · string · requis
    Must match the product the quote_token sealed.
  • quote_token · string · requis
    The signed token from get_quote.

  Exemple d'appel

  {"name": "get_payment_requirements", "arguments": {"amount": {}, "rail_id": "texte", "product_id": "texte", "quote_token": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_product≈ 67 tokens

  Get full product detail by product or variant identifier.

  Paramètres, retour & exemple (1)

  Paramètres

  • catalog · object · requis

  Exemple d'appel

  {"name": "get_product", "arguments": {"catalog": {}}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_quote≈ 501 tokens

  Get the real landed cost of a product from this merchant: goods + shipping + tax for a specific destination, plus a signed `quote_token` the payment path binds to. Call this before paying — the token is what makes the price the MERCHANT's, not one you name. Physical products REQUIRE a `fulfillment` ship-to; without one you get FULFILLMENT_REQUIRED. An unserviceable destination returns UNDELIVERABLE (the merchant's own shipping zones, which Facet cannot waive). REQUIRES IDENTITY: send a Facet KYA as `Authorization: Bearer <kya>` (ES256 JWT from https://issuer.facet.llc, or another issuer in this Terminal's agents.txt KYA-Issuers).

  Paramètres, retour & exemple (4)

  Paramètres

  • qty · integer · optionnel
    Quantity. Default 1.
  • site_id · string · optionnel
    Usually omitted — this Terminal's bound site is used.
  • product_id · string · requis
    Product or variant id, e.g. from search_catalog.
  • fulfillment · object · optionnel
    Ship-to destination. REQUIRED for physical products.

  Exemple d'appel

  {"name": "get_quote", "arguments": {"product_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• list_orders≈ 113 tokens

  List YOUR order history on this merchant, newest first. Scoped to your own agent identity — you never see another agent's orders. REQUIRES IDENTITY: Facet KYA as `Authorization: Bearer <kya>`.

  Paramètres, retour & exemple (2)

  Paramètres

  • limit · integer · optionnel
    Max orders to return.
  • cursor · string · optionnel
    Opaque cursor from a previous page.

  Exemple d'appel

  {"name": "list_orders", "arguments": {"limit": 1, "cursor": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• lookup_catalog≈ 85 tokens

  Look up one or more products or variants by identifier (batch).

  Paramètres, retour & exemple (1)

  Paramètres

  • catalog · object · requis

  Exemple d'appel

  {"name": "lookup_catalog", "arguments": {"catalog": {}}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• post_delivery_refund≈ 533 tokens

  Request a refund or return on a DELIVERED order you placed on this merchant. Opens a merchant-approved refund ticket (status `requested`); it moves NO money on its own. The merchant reviews and approves it, and only then does the send-back sign from the merchant's OWN wallet (non-custodial). Amount and recipient are NOT inputs: the refund amount is derived and capped server-side, and the recipient is the order's stamped payer, never one you name. Pass `refund_line_items` to refund only part of the order; omit for the whole order. Owner-scoped: another agent's order returns FORBIDDEN. REQUIRES IDENTITY: a Facet KYA as `Authorization: Bearer <kya>` (an ES256 JWT from https://issuer.facet.llc, or another issuer in this Terminal's agents.txt KYA-Issuers). A wallet-bound KYA also authorizes a platform-originated order by its stamped payer.

  Paramètres, retour & exemple (4)

  Paramètres

  • reason · string · requis
    Why the refund or return is requested. Required.
  • receipt · object · optionnel
    Optional Ed25519-signed settlement receipt (the signed settle response you received). When valid and bound to this order it records receipt_verified on the ticket; it never gates the refund.
  • order_id · string · requis
    The order id returned at payment (settle / checkout complete). A reservation id is not an order id.
  • refund_line_items · array · optionnel
    Optional PARTIAL selection: refund only these lines instead of the whole order. Advisory at request time; the merchant is authoritative and may adjust it at decide. Omit for a full-order refund.

  Exemple d'appel

  {"name": "post_delivery_refund", "arguments": {"reason": "texte", "order_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• search_catalog≈ 108 tokens

  Search the merchant catalog for products matching a free-text query.

  Paramètres, retour & exemple (1)

  Paramètres

  • catalog · object · requis

  Exemple d'appel

  {"name": "search_catalog", "arguments": {"catalog": {}}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• update_cart≈ 150 tokens

  Replace a cart's line items (full replacement), re-priced server-side. Owner-scoped. REQUIRES IDENTITY on a signature-required Terminal.

  Paramètres, retour & exemple (2)

  Paramètres

  • id · string · requis
    The cart id.
  • line_items · array · optionnel
    The new full set of items, each `{ item: { id }, quantity }`.

  Exemple d'appel

  {"name": "update_cart", "arguments": {"id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• update_checkout≈ 108 tokens

  Return a checkout's CURRENT sealed snapshot. Facet seals price and items at create, so this is a no-op that reports the session plus a note: to change line items, update the cart and start a new checkout with create_checkout(cart_id). Owner-scoped.

  Paramètres, retour & exemple (1)

  Paramètres

  • id · string · requis
    The checkout session id.

  Exemple d'appel

  {"name": "update_checkout", "arguments": {"id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• wishlist_add≈ 133 tokens

  Save a product to YOUR wishlist on this merchant for later. Idempotent: saving the same product again updates its note and keeps the original save time. Scoped to your own agent identity. REQUIRES IDENTITY: Facet KYA as `Authorization: Bearer <kya>`.

  Paramètres, retour & exemple (2)

  Paramètres

  • note · string · optionnel
    Optional short note. No personal data.
  • product_id · string · requis
    The product id to save.

  Exemple d'appel

  {"name": "wishlist_add", "arguments": {"product_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• wishlist_list≈ 95 tokens

  List YOUR saved items (wishlist) on this merchant, newest first. Scoped to your own agent identity, so you never see another agent's list. REQUIRES IDENTITY: Facet KYA as `Authorization: Bearer <kya>`.

  Paramètres, retour & exemple (1)

  Paramètres

  • limit · integer · optionnel
    Max items to return.

  Exemple d'appel

  {"name": "wishlist_list", "arguments": {"limit": 1}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• wishlist_remove≈ 108 tokens

  Remove a product from YOUR wishlist on this merchant. Idempotent: removing something not on your list succeeds with removed:false. Scoped to your own agent identity. REQUIRES IDENTITY: Facet KYA as `Authorization: Bearer <kya>`.

  Paramètres, retour & exemple (1)

  Paramètres

  • product_id · string · requis
    The product id to remove.

  Exemple d'appel

  {"name": "wishlist_remove", "arguments": {"product_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

C'est votre serveur ?

Revendiquez-le sur l'espace créateur (preuve GitHub, domaine ou npm) pour afficher le badge « propriétaire vérifié » et lancer un pentest comportemental à la demande afin d'obtenir le badge « Vérifié ».

Créer un compte / revendiquer →

Source

https://api.facet.llc/ucp/mcp