ltd.branddesign/commerce

Est-ce que ltd.branddesign/commerce est sûr ?

Au dernier audit MCP Hub, le serveur MCP « ltd.branddesign/commerce » est classé « Non encore testé ». Référencé dans l'annuaire. Seul le pentest comportemental fait foi, et il n'a pas encore été exécuté sur ce serveur. Le verdict est réévalué en continu ; consultez la fiche pour l'état à jour.

Méthode : MCP Hub analyse la description de chaque outil (couche 1) et, pour le verdict fort, exécute le serveur dans une micro-VM isolée avec leurres et réseau bloqué (couche 2). On publie des noms et des compteurs, jamais le contenu brut renvoyé par un outil.

Les 10 outils

• accept_offer≈ 927 tokens

  Accept the offer on behalf of the buyer. Needs credentials. This locks the billing identity, the offer version and the hash of the terms as they stand at this moment. A later change to the website cannot pass for what was agreed. Errors: OFFER_CHANGED (409) if the offer or the terms changed since you read them; read order_status and use the new values. OFFER_EXPIRED (409) 30 days after the order. MANUAL_OFFER_REQUIRED (409) while a person has not priced the service yet.

  Paramètres, retour & exemple (8)

  Paramètres

  • order · string · requis
    The order id returned by create_order.
  • secret · string · optionnel
    Required unless you authenticate with the Authorization header (Bearer <clientId>:<secret>, or an OAuth access token issued for this server). The secret returned by register_agent.
  • billing · object · requis
    The buyer as it will appear on the invoice and the contract. For type company, company, registration and representative are also required. For type person, leave out company, registration, vat and representative. No other keys are accepted.
  • clientId · string · optionnel
    Required unless you authenticate with the Authorization header (Bearer <clientId>:<secret>, or an OAuth access token issued for this server). The clientId returned by register_agent.
  • termsHash · string · requis
    SHA-256 of the terms page in the language of the order: offer.terms.<language>.hash from the order, copied exactly. Sending it confirms that the buyer accepts those terms.
  • accessToken · string · requis
    The accessToken returned by create_order.
  • offerVersion · string · requis
    offer.version from the order, copied exactly.
  • immediateStart · boolean · optionnel
    Natural persons only: true when the buyer expressly asks the work to start within the 14-day withdrawal period and acknowledges losing the right of withdrawal once the service is fully performed.

  Exemple d'appel

  {"name": "accept_offer", "arguments": {"order": "texte", "billing": {}, "termsHash": "texte", "accessToken": "texte", "offerVersion": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• catalog≈ 93 tokens

  Read the service catalogue: names, prices, currency and terms. No credentials needed. All amounts are integers in the minor unit; 100000 means 1000.00 EUR.

  Paramètres, retour & exemple (0)

  Exemple d'appel

  {"name": "catalog", "arguments": {}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• create_order≈ 868 tokens

  Place an order for a service. Needs credentials. Returns the order id, the offer and an accessToken you must keep for the following calls. The offer is pinned to the hash of the service page; accept_offer needs offer.version and offer.terms.<language>.hash from it. Services without a catalogue price return an offer with no total and wait for a person to price it. Errors: MISSING_<field> when a required brief field is absent, UNEXPECTED_FIELD when the brief has a key the service does not declare.

  Paramètres, retour & exemple (8)

  Paramètres

  • brief · object · requis
    Required MCP argument: send an object, including {} when the selected service has no required brief fields. Direct REST may omit brief and treats that as {}; required catalog fields remain mandatory. One string per field the catalogue lists under this service in catalog.services.<service>.fields. Use each field id as the key. Fields with required: true must be present; the max value is the length limit. No other keys are accepted.
  • lines · array · optionnel
    Only for services that have catalog.services.<service>.configurator. One entry per item: item is an id from configurator.items; qty is the number of designs, or the number of pages when the item has per "page", within item.qty min and max; options maps every option id of the item to one of its value ids; note is free text, required when the item has noteRequired. The price is computed by the seller from the catalogue; never send a price. If any chosen item has price null, the order waits for a person to price it.
  • secret · string · optionnel
    Required unless you authenticate with the Authorization header (Bearer <clientId>:<secret>, or an OAuth access token issued for this server). The secret returned by register_agent.
  • service · string · requis
    Service id: one of the keys of catalog.services, as returned by the catalog tool.
  • clientId · string · optionnel
    Required unless you authenticate with the Authorization header (Bearer <clientId>:<secret>, or an OAuth access token issued for this server). The clientId returned by register_agent.
  • language · string · optionnel · bg | en
    Language of the offer, the terms and the documents. This MCP adapter defaults to en; direct REST requires payload.language explicitly.
  • printQuote · boolean · optionnel
    Only with lines: the buyer would like a print quote once the design work has started. Printing is not part of this order.
  • idempotencyKey · string · optionnel
    Your own stable key, 16-100 characters, so a repeated call does not create a second order. If omitted this MCP adapter generates a new key for each invocation; provide and reuse a key for retries. Direct REST always requires idempotencyKey.

  Exemple d'appel

  {"name": "create_order", "arguments": {"brief": {}, "service": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• kya_challenge≈ 361 tokens

  Issue a fresh DNS TXT challenge for your currently authenticated agent identity. Needs commerce.order for OAuth. Supply an HTTPS contact URL on a domain you control, especially on the first OAuth connection. Omitting contact reuses the current contact. This replaces the previous challenge and clears its verification. Publish the returned txtValue at dnsName, then call kya_verify. Domain control does not establish buyer identity or grant spending authority. Do not publish secrets in DNS.

  Paramètres, retour & exemple (3)

  Paramètres

  • secret · string · optionnel
    Required unless you authenticate with the Authorization header (Bearer <clientId>:<secret>, or an OAuth access token issued for this server). The secret returned by register_agent.
  • contact · string · optionnel
    HTTPS URL on your own public domain. No IP address, credentials, custom port or URL fragment.
  • clientId · string · optionnel
    Required unless you authenticate with the Authorization header (Bearer <clientId>:<secret>, or an OAuth access token issued for this server). The clientId returned by register_agent.

  Exemple d'appel

  {"name": "kya_challenge", "arguments": {"secret": "texte", "contact": "texte", "clientId": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• kya_status≈ 238 tokens

  Read DNS domain-control verification for your currently authenticated agent. Needs commerce.read for OAuth. Returns verification status and, when present, DNS instructions and validity timestamps. This does not change the contact, challenge or verification.

  Paramètres, retour & exemple (2)

  Paramètres

  • secret · string · optionnel
    Required unless you authenticate with the Authorization header (Bearer <clientId>:<secret>, or an OAuth access token issued for this server). The secret returned by register_agent.
  • clientId · string · optionnel
    Required unless you authenticate with the Authorization header (Bearer <clientId>:<secret>, or an OAuth access token issued for this server). The clientId returned by register_agent.

  Exemple d'appel

  {"name": "kya_status", "arguments": {"secret": "texte", "clientId": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• kya_verify≈ 269 tokens

  Check the DNS TXT challenge for your currently authenticated agent and record domain-control verification. Needs commerce.order for OAuth. First call kya_challenge and publish its exact DNS TXT record. The response gives verifiedAt and validUntil; verification is currently valid for 24 hours. This does not authorize a purchase or a payment.

  Paramètres, retour & exemple (2)

  Paramètres

  • secret · string · optionnel
    Required unless you authenticate with the Authorization header (Bearer <clientId>:<secret>, or an OAuth access token issued for this server). The secret returned by register_agent.
  • clientId · string · optionnel
    Required unless you authenticate with the Authorization header (Bearer <clientId>:<secret>, or an OAuth access token issued for this server). The clientId returned by register_agent.

  Exemple d'appel

  {"name": "kya_verify", "arguments": {"secret": "texte", "clientId": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• manifest≈ 88 tokens

  Read the commerce manifest: protocol, endpoints, authentication scheme, payment instrument and limits. No credentials needed.

  Paramètres, retour & exemple (0)

  Exemple d'appel

  {"name": "manifest", "arguments": {}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• order_status≈ 259 tokens

  Read the current state of the order, its offer and its payments, including the invoice number once one has been issued. Needs credentials.

  Paramètres, retour & exemple (4)

  Paramètres

  • order · string · requis
    The order id returned by create_order.
  • secret · string · optionnel
    Required unless you authenticate with the Authorization header (Bearer <clientId>:<secret>, or an OAuth access token issued for this server). The secret returned by register_agent.
  • clientId · string · optionnel
    Required unless you authenticate with the Authorization header (Bearer <clientId>:<secret>, or an OAuth access token issued for this server). The clientId returned by register_agent.
  • accessToken · string · requis
    The accessToken returned by create_order.

  Exemple d'appel

  {"name": "order_status", "arguments": {"order": "texte", "accessToken": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• register_agent≈ 188 tokens

  Register yourself and receive a client identifier and a secret. No approval and no prior arrangement. The secret is returned once and cannot be recovered. Put them in the Authorization header as "Bearer <clientId>:<secret>" for the other tools.

  Paramètres, retour & exemple (2)

  Paramètres

  • name · string · requis
    Your name, 2 to 80 characters.
  • contact · string · requis
    A https:// or mailto: URL at which a human can reach whoever runs you.

  Exemple d'appel

  {"name": "register_agent", "arguments": {"name": "texte", "contact": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• start_payment≈ 588 tokens

  Start payment for a stage. Needs credentials. Without sharedPaymentToken you receive a hosted payment session, which you may complete yourself with a payment instrument issued to you, or hand to the person you act for. With a delegated shared payment token the payment settles directly. A self-registered agent must first have current DNS domain-control KYA for its HTTPS contact domain: call kya_challenge with a domain you control, publish its DNS TXT record and call kya_verify; kya_status reads the current verification. KYA does not grant buyer payment authority. On-chain payment is not accepted. Errors: OFFER_EXPIRED (409) for an advance after 30 days, FINAL_NOT_RELEASED (409) when the final payment is not open yet, PAYMENTS_DISABLED (503).

  Paramètres, retour & exemple (6)

  Paramètres

  • order · string · requis
    The order id returned by create_order.
  • stage · string · optionnel · advance | final
    advance: the first payment, open after accept_offer. It is 50% of the total, or the whole total when the service is paid at once (paymentPlan single in the catalogue). final: the remaining 50%, open only after the advance is paid and the seller has released the work for final payment. Defaults to advance.
  • secret · string · optionnel
    Required unless you authenticate with the Authorization header (Bearer <clientId>:<secret>, or an OAuth access token issued for this server). The secret returned by register_agent.
  • clientId · string · optionnel
    Required unless you authenticate with the Authorization header (Bearer <clientId>:<secret>, or an OAuth access token issued for this server). The clientId returned by register_agent.
  • accessToken · string · requis
    The accessToken returned by create_order.
  • sharedPaymentToken · string · optionnel
    Only for delegated payment without a hosted page: a Stripe shared payment token granted to the seller profile in manifest.payment.networkBusinessProfile. Leave it out to receive a hosted payment session instead.

  Exemple d'appel

  {"name": "start_payment", "arguments": {"order": "texte", "accessToken": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

C'est votre serveur ?

Revendiquez-le sur l'espace créateur (preuve GitHub, domaine ou npm) pour afficher le badge « propriétaire vérifié » et lancer un pentest comportemental à la demande afin d'obtenir le badge « Vérifié ».

Créer un compte / revendiquer →

Source

https://branddesign.ltd/mcp