xyz.trusteed/mcp-gateway

Est-ce que xyz.trusteed/mcp-gateway est sûr ?

Au dernier audit MCP Hub, le serveur MCP « xyz.trusteed/mcp-gateway » est classé « Non encore testé ». Référencé dans l'annuaire. Seul le pentest comportemental fait foi, et il n'a pas encore été exécuté sur ce serveur. Le verdict est réévalué en continu ; consultez la fiche pour l'état à jour.

Méthode : MCP Hub analyse la description de chaque outil (couche 1) et, pour le verdict fort, exécute le serveur dans une micro-VM isolée avec leurres et réseau bloqué (couche 2). On publie des noms et des compteurs, jamais le contenu brut renvoyé par un outil.

Les 27 outils

• apply_discount≈ 555 tokens

  Apply a discount or promo code to the cart. Checkout guide: read the MCP resource trusteed://guides/checkout. CREDENTIAL: this store needs one. Call the `create_sandbox_key` tool first (it is in this tool list and needs no credential), then pass the key you get back as the `agent_key` argument — or as an `Authorization: Bearer` header if your client can set headers. Do not ask a person to log in: there is no human login for this store.

  Paramètres, retour & exemple (6)

  Paramètres

  • source · string · optionnel
    Set to 'ucp_identity' to apply a loyalty discount derived from a UCP identity token instead of a promo code.
  • cart_id · string · requis
    Cart session ID
  • agent_key · string · optionnel
    Sandbox credential from `create_sandbox_key`. Use this when your client cannot set an `Authorization: Bearer` header.
  • discount_code · string · optionnel
    Discount or promo code to apply (required unless source is ucp_identity)
  • identity_token · string · optionnel
    UCP identity bearer token (required when source is ucp_identity).
  • idempotency_key · string · optionnel
    REQUIRED for this write unless sent as the `Idempotency-Key` header or `params._meta["trusteed/idempotency-key"]`. 1-128 chars from [A-Za-z0-9._:/-]. Reuse the same value when retrying the same operation.

  Exemple d'appel

  {"name": "apply_discount", "arguments": {"cart_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"cart_id": "texte", "currency": "texte", "discount_code": "texte", "discount_cents": 1, "new_total_cents": 1}}

• browse_categories≈ 90 tokens

  List all product categories in Demo Store with product counts.

  Paramètres, retour & exemple (0)

  Exemple d'appel

  {"name": "browse_categories", "arguments": {}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• compare_products≈ 143 tokens

  Compare 2 to 5 products side-by-side with normalized attribute table and best-value recommendation.

  Paramètres, retour & exemple (1)

  Paramètres

  • product_ids · array · requis
    Array of product IDs to compare (2-5)

  Exemple d'appel

  {"name": "compare_products", "arguments": {"product_ids": []}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• complete_checkout≈ 2524 tokens

  Complete the purchase. Provide buyer.name and buyer.email from the conversation before opening approval; ask in chat if either is missing. The approval page only reviews these details. PREFER THE CART CARD: if there is an interactive card for this cart, let the buyer confirm and (when the store offers a choice) pick the payment method there — including retrying after a declined payment or switching method — instead of calling this tool yourself. Each call you make here opens a new card in the transcript instead of updating the one already open. Only call it yourself when there is no interactive card or the buyer explicitly asks you to complete it in chat. Idempotent — replay is keyed on checkout_session_id: any retry against a session that already has an order returns that same order (COMPLETED or PENDING_EXTERNAL_CONFIRMATION) without re-charging. The provided idempotency_key is recorded on the session for audit and short-circuits a repeated call with the same key. If the response has status PENDING_EXTERNAL_CONFIRMATION, no purchase has completed yet: read `order_placed` and `next_action` — a person has to approve or pay at its `url`; `next_action` says whether calling again with the same checkout_session_id and idempotency_key can read the outcome. KYAPAY (payment_method=KYAPAY or a kyapay_token): charging with KYApay is not available. KYApay is identity verification here, not a payment rail, so the call is rejected with PAYMENT_METHOD_NOT_CONFIGURED before anything is charged or written; use another payment method. The Skyfire KYA token serves identity on the REST API, not payment in this tool. On demo-store the approval step records a confirmation but does not verify that a human gave it. PAYMENT MANDATE: this tool also requires one, issued by the platform, not written by you. Call `preview_checkout` for this cart, open the `approval_url` it returns, poll `approval_status_url` with your agent credential, and send the mandate you receive as the `payment_mandate` argument or an `X-Payment-Mandate` header. The approval is bound to your agent credential and the cart; it does not verify that a person was present. Checkout guide: read the MCP resource trusteed://guides/checkout. CREDENTIAL: this store needs one. Call the `create_sandbox_key` tool first (it is in this tool list and needs no credential), then pass the key you get back as the `agent_key` argument — or as an `Authorization: Bearer` header if your client can set headers. Do not ask a person to log in: there is no human login for this store.

  Paramètres, retour & exemple (12)

  Paramètres

  • buyer · object · optionnel
    Optional buyer contact information
  • agent_key · string · optionnel
    Sandbox credential from `create_sandbox_key`. Use this when your client cannot set an `Authorization: Bearer` header.
  • cel_context · object · optionnel
    Optional. Send only evidence you can substantiate; it can only make a check stricter, never looser. Unknown keys or out-of-range values are rejected with INVALID_ARGUMENT. Keys: key_age_hours, requested_scopes, product_categories, price_delta_bps, discount_codes_tried, discount_bps, lowest_stock, return_policy_mismatch, is_subscription, autorenew_consent, is_b2b, purchase_order_hash, shipping_po_box, shipping_freight_forwarder, provider_confidence, stored_value_cents, cross_merchant_abuse, refund_ratio, dispute_count, completed_orders_24h, merchant_orders_1h, digital_good_types, agent_provider_id.
  • kyapay_token · string · optionnel
    Not available for payment: charging with KYApay is switched off, because KYApay is identity verification here, not a payment rail. A call that passes this token is rejected with PAYMENT_METHOD_NOT_CONFIGURED before anything is charged or written. The Skyfire KYA token is used for identity on the REST API, not in this tool.
  • payment_method · string · optionnel · ACP | KYAPAY | PAYPAL | MOCK | X402
    Payment method to use. PAYPAL creates a PayPal order and presents approval URL. KYAPAY is not available for payment: KYApay is identity verification here, so a request with KYAPAY is rejected without charging anything. ACP (Stripe-native settlement) returns a 'not enabled' response unless this deployment enables native settlement; when enabled it charges the Stripe Shared Payment Token passed as shared_payment_token. X402 is available through the configured x402 protocol flow, not this checkout tool. MOCK moves no money: it completes the order without charging. Whether a store accepts it depends on the store's configuration (it is the default on demo-store). Defaults to MOCK if not specified.
  • payment_option · string · optionnel · demo_card | demo_wallet | own_wallet | merchant_card | paypal
    Payment method THE PERSON chose, when preview_checkout returned payment_options. Ask the person; never choose for them. Card numbers and wallet keys are never sent here: the person approves (and, with own_wallet, signs) on the approval page.
  • idempotency_key · string · requis
    REQUIRED as an argument in this tool: the `Idempotency-Key` header or `_meta` alone is not enough. 1-128 chars from [A-Za-z0-9._:/-]. Reuse the same value when retrying the same operation.
  • payment_mandate · ? · optionnel
    Payment mandate issued by the platform for this cart: the compact JWS you receive after the approval opened by `preview_checkout` is granted (its `exp` is Unix seconds and `aud` is this store's slug). Forward it as received; a mandate you write yourself is not accepted here. The approval is bound to your agent credential and does not verify that a person was present. Use this when your client cannot set an `X-Payment-Mandate` header.
  • checkout_session_id · string · requis
    Checkout session ID from preview_checkout — the same value as create_cart's cart_id (must be a valid UUID)
  • save_payment_method · boolean · optionnel
    Only with PayPal at a store that charges into its own PayPal account, for a signed-in buyer (not guest access), and only when the person asked for it: true asks PayPal to save this PayPal account during this purchase, so later purchases at this store can be charged without a new approval, within per-charge and daily limits. Never set it on your own initiative. In any other case it is ignored and the response says so in details; it never causes an error.
  • shared_payment_token · string · optionnel
    Stripe Shared Payment Token (spt_…) granted by the buyer's agent wallet for payment_method=ACP. Issued by Stripe, scoped to this merchant, amount and currency, and consumed when used: it can be charged once. Only honoured when this deployment enables native ACP settlement.
  • reconfirmed_state_hash · string · optionnel
    SHA-256 of the authoritative merchant state, as returned in details.reconfirm_state_hash by a previous STATE_RECONFIRMATION_REQUIRED error. Required to proceed when the merchant state moved after the approved preview. Passing a stale hash is refused: it means the state moved again and must be reconfirmed anew.

  Exemple d'appel

  {"name": "complete_checkout", "arguments": {"idempotency_key": "texte", "checkout_session_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"status": "COMPLETED", "details": {}, "currency": "texte", "order_id": "texte", "idempotent": true, "store_name": "texte", "test_funds": true, "money_moves": true, "next_action": {}, "payment_url": "texte", "total_cents": 1, "approval_url": "texte"}}

• create_cart≈ 1157 tokens

  Create a shopping cart in Demo Store. Returns a cart_id. Pass it as cart_id to get_shipping_rates, select_shipping_option, apply_discount and preview_checkout; complete_checkout and get_trust_receipt take the same value as checkout_session_id. KYA IDENTITY: a Skyfire kya token has no effect on this tool (it grants no trust boost here); KYA identity applies to the REST agent API (`Authorization: Bearer`), not to the MCP tools. Checkout guide: read the MCP resource trusteed://guides/checkout. CREDENTIAL: this store needs one. Call the `create_sandbox_key` tool first (it is in this tool list and needs no credential), then pass the key you get back as the `agent_key` argument — or as an `Authorization: Bearer` header if your client can set headers. Do not ask a person to log in: there is no human login for this store.

  Paramètres, retour & exemple (6)

  Paramètres

  • items · array · requis
    Items to add to cart
  • agent_key · string · optionnel
    Sandbox credential from `create_sandbox_key`. Use this when your client cannot set an `Authorization: Bearer` header.
  • agent_token · string · optionnel
    JWS compact (EdDSA/Ed25519) signed by the agent. Required for Shopify enforcement rules R001/R002/R004. A malformed token fails with AGENT_TOKEN_INVALID on any platform. On Shopify stores Trusteed also verifies the signature on receipt against a registered key that must belong to the calling agent (otherwise AGENT_TOKEN_INVALID and no cart is created), and the checkout Function verifies it again offline at payment. On other platforms Trusteed checks its structure only and forwards it to the store.
  • display_context · string · optionnel · webview | headless
    Agent display capability: webview (browser) or headless
  • idempotency_key · string · optionnel
    REQUIRED for this write unless sent as the `Idempotency-Key` header or `params._meta["trusteed/idempotency-key"]`. 1-128 chars from [A-Za-z0-9._:/-]. Reuse the same value when retrying the same operation.
  • agent_session_id · string · optionnel
    Opaque agent session identifier for cart resume across sessions

  Exemple d'appel

  {"name": "create_cart", "arguments": {"items": []}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"items": [], "status": "texte", "cart_id": "texte", "currency": "texte", "next_step": "texte", "expires_at": "texte", "store_name": "texte", "session_state": "new", "subtotal_cents": 1, "display_context": "webview", "agent_session_id": "texte", "expires_in_seconds": 1}}

• create_sandbox_key≈ 133 tokens

  Get a temporary sandbox credential for this demo store, valid 24h. Present it as an `Authorization: Bearer` header, or — when your client cannot set headers — as the `agent_key` argument of the checkout tools. Payments here are simulated: this credential settles nothing and works only on the demo store. No human login is involved at any point.

  Paramètres, retour & exemple (0)

  Exemple d'appel

  {"name": "create_sandbox_key", "arguments": {}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_checkout_state≈ 249 tokens

  Read the current state of a cart created with create_cart: status, lines, totals, selected shipping, when it was previewed, its order if one exists and a pointer to get_trust_receipt. Read-only: it changes nothing and does not open any approval. Use it to resume a purchase; for UCP checkouts use ucp_get_checkout. Checkout guide: read the MCP resource trusteed://guides/checkout.

  Paramètres, retour & exemple (2)

  Paramètres

  • cart_id · string · requis
    The cart id returned by create_cart (the checkout session id, a valid UUID).
  • agent_key · string · optionnel
    Sandbox credential from `create_sandbox_key`. Use this when your client cannot set an `Authorization: Bearer` header.

  Exemple d'appel

  {"name": "get_checkout_state", "arguments": {"cart_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_merchant_profile≈ 2602 tokens

  Get the complete profile — trust score, policies, compliance, and protocol support — of the merchant this MCP endpoint belongs to. Takes NO parameters: the merchant is fixed by which store's /:storeSlug/mcp endpoint you connected to, not by an argument. To read a different merchant's profile, call this same tool on that merchant's own endpoint instead.

  Paramètres, retour & exemple (0)

  Exemple d'appel

  {"name": "get_merchant_profile", "arguments": {}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"store": {}, "trust": {}, "identity": {}, "policies": {}, "discovery": {}, "protocols": {}, "acpFeedUrl": "texte", "compliance": {}, "manifest_jws": "texte", "manifest_hash": "texte", "protocolScopeNote": "texte", "agentPolicySummary": {}}}

• get_page_content≈ 238 tokens

  Get a SUMMARY of a specific page on Trusteed: its title, description, keywords, related tools and the link to the full page. It returns a summary, not the full page text: read the linked URL when the whole page is needed. `content_scope` says what came back. Pass the page slug (e.g. 'for-agents', 'pricing', 'blog') or a blog post slug (returns its excerpt). Use get_site_map first to discover available slugs. Pass page='blog' to list all blog posts.

  Paramètres, retour & exemple (1)

  Paramètres

  • page · string · requis
    Page slug (e.g. 'for-agents', 'pricing', 'trust') or blog post slug. Use 'blog' to list all blog posts.

  Exemple d'appel

  {"name": "get_page_content", "arguments": {"page": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_product_details≈ 597 tokens

  Get detailed information about a specific product in Demo Store, including all variants, sizes, colors, and availability.

  Paramètres, retour & exemple (1)

  Paramètres

  • product_id · string · requis
    Product ID — use the `id` field returned by search_products or nlweb_ask (e.g. 'prod-001'). Do not invent IDs.

  Exemple d'appel

  {"name": "get_product_details", "arguments": {"product_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"id": "texte", "url": "texte", "tags": [], "error": "texte", "price": 1, "title": "texte", "jsonLd": {}, "vendor": "texte", "message": "texte", "currency": "texte", "variants": [], "image_url": "texte"}}

• get_shipping_rates≈ 885 tokens

  Get available shipping rates for the cart. Requires shipping_address — pass it in the call. If the buyer requests the cheapest option, use cheapest_shipping_handle when non-null; it is null when rates cannot be compared in the cart currency. Rates marked authoritative=false are estimates, not the final charge. PREFER THE CART CARD: if create_cart returned an interactive card (the buyer can see and click it), let them enter the address and pick shipping there instead of calling this tool yourself — each top-level call you make here opens a new card in the transcript instead of updating the one already open. Only call it yourself when there is no interactive card (text-only client) or the buyer explicitly asks you to handle it in chat. Checkout guide: read the MCP resource trusteed://guides/checkout. CREDENTIAL: this store needs one. Call the `create_sandbox_key` tool first (it is in this tool list and needs no credential), then pass the key you get back as the `agent_key` argument — or as an `Authorization: Bearer` header if your client can set headers. Do not ask a person to log in: there is no human login for this store.

  Paramètres, retour & exemple (3)

  Paramètres

  • cart_id · string · requis
    Cart session ID returned by create_cart
  • agent_key · string · optionnel
    Sandbox credential from `create_sandbox_key`. Use this when your client cannot set an `Authorization: Bearer` header.
  • shipping_address · object · optionnel
    Destination address. Required: this tool does not prompt for it.

  Exemple d'appel

  {"name": "get_shipping_rates", "arguments": {"cart_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"rates": [], "cart_id": "texte", "address_city": "texte", "address_country": "texte", "cheapest_shipping_handle": "texte"}}

• get_site_map≈ 182 tokens

  Returns the complete site map of Trusteed: all public pages organized by category. Use this to discover what sections are available (docs, blog, integrations, legal, marketing) and find the right path before calling get_page_content.

  Paramètres, retour & exemple (1)

  Paramètres

  • category · string · optionnel · commerce | docs | legal | blog | marketing | integrations
    Filter pages by category: commerce, docs, legal, blog, marketing, integrations

  Exemple d'appel

  {"name": "get_site_map", "arguments": {"category": "commerce"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_store_trust≈ 785 tokens

  Get Demo Store's signed trust score (v4.1, 0-100) with per-signal data quality, confidence level, and a detached JWS for offline verification. Don't trust the number — verify it: download the JWKS at jwks_snapshot_uri, validate jws_compact with signing_kid, and recompute payload_hash_sha256.

  Paramètres, retour & exemple (0)

  Exemple d'appel

  {"name": "get_store_trust", "arguments": {}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"score": 1, "available": true, "breakdown": "texte", "issued_at": "texte", "signature": "texte", "store_slug": "texte", "scoring_version": "texte", "confidence_level": "texte", "recommended_action": "texte", "confidence_interval": "texte"}}

• get_trust_receipt≈ 1048 tokens

  Retrieve the signed trust receipt for a checkout. A receipt records the complete_checkout call; read `order_placed` before telling anyone a purchase happened. Returns the receipt id, the JWS signature and how to verify it. Issuance is asynchronous: right after complete_checkout this may answer `status: "pending"` with a retry delay. `pending` with code `receipt_pending` means the purchase completed and the receipt is on its way; `checkout_in_progress` means the complete_checkout call is still running. Only the credential that made the purchase can read its receipt. A receipt attests that the call happened, not that money moved: read `settlement` (it is `not_attested` unless the payment rail confirmed it). PREFER THE CART CARD: if the purchase was completed on an interactive card, it already fetches and shows this receipt itself right after the order — calling this tool yourself right after is usually redundant and opens a new card in the transcript. Call it yourself only when there is no interactive card, or the buyer asks for the receipt later in a new turn. Checkout guide: read the MCP resource trusteed://guides/checkout.

  Paramètres, retour & exemple (2)

  Paramètres

  • agent_key · string · optionnel
    Sandbox credential from `create_sandbox_key`. Use this when your client cannot set an `Authorization: Bearer` header.
  • checkout_session_id · string · requis
    The checkout session id returned by create_cart and echoed by complete_checkout.

  Exemple d'appel

  {"name": "get_trust_receipt", "arguments": {"checkout_session_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"jws": "texte", "code": "texte", "docs": "texte", "status": "issued", "call_id": "texte", "message": "texte", "order_id": "texte", "issued_at": "texte", "dimensions": {}, "receipt_id": "texte", "verify_url": "texte", "verify_with": "texte"}}

• preview_checkout≈ 1122 tokens

  Preview the complete order summary before payment. Advances the session to ready-for-payment state. If you only need the price, call quote_checkout instead: it computes the same total without advancing the session or opening an approval. PREFER THE CART CARD: if there is an interactive card for this cart, let it compute and show the summary instead of calling this tool yourself — it keeps the flow in one card. Checkout guide: read the MCP resource trusteed://guides/checkout. CREDENTIAL: this store needs one. Call the `create_sandbox_key` tool first (it is in this tool list and needs no credential), then pass the key you get back as the `agent_key` argument — or as an `Authorization: Bearer` header if your client can set headers. Do not ask a person to log in: there is no human login for this store.

  Paramètres, retour & exemple (3)

  Paramètres

  • cart_id · string · requis
    Cart session ID returned by create_cart
  • agent_key · string · optionnel
    Sandbox credential from `create_sandbox_key`. Use this when your client cannot set an `Authorization: Bearer` header.
  • payment_mandate · ? · optionnel
    Payment mandate issued by the platform for this cart: the compact JWS you receive after the approval opened by `preview_checkout` is granted (its `exp` is Unix seconds and `aud` is this store's slug). Forward it as received; a mandate you write yourself is not accepted here. The approval is bound to your agent credential and does not verify that a person was present. Use this when your client cannot set an `X-Payment-Mandate` header.

  Exemple d'appel

  {"name": "preview_checkout", "arguments": {"cart_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"items": [], "status": "READY_FOR_PAYMENT", "currency": "texte", "next_step": "texte", "tax_cents": 1, "expires_at": "texte", "store_name": "texte", "tax_status": "included", "total_note": "texte", "approval_id": "texte", "total_cents": 1, "approval_url": "texte"}}

• quote_checkout≈ 294 tokens

  Read-only price quote. Does not advance the session, open approvals or enable payment. To pay, call preview_checkout. Computes the same totals as preview_checkout for this cart (subtotal, shipping, discount, tax status, total_is_final), with status QUOTE_ONLY, but not the same checks: it does not check your payment mandate's spending cap; preview_checkout does. Read-only on Trusteed's side: where the store prices orders on its own platform (WooCommerce), the store builds a temporary cart to compute the quote and discards it. Checkout guide: read the MCP resource trusteed://guides/checkout.

  Paramètres, retour & exemple (2)

  Paramètres

  • cart_id · string · requis
    Cart session ID returned by create_cart
  • agent_key · string · optionnel
    Sandbox credential from `create_sandbox_key`. Use this when your client cannot set an `Authorization: Bearer` header.

  Exemple d'appel

  {"name": "quote_checkout", "arguments": {"cart_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• search_docs≈ 292 tokens

  Full-text search across all Trusteed public documentation: pages, blog posts, FAQ entries, error codes, the agent checkout guide, and the tools of this endpoint. Returns ranked results by relevance. Use this to find answers about protocols, pricing, integration guides, trust scores, and more.

  Paramètres, retour & exemple (3)

  Paramètres

  • type · string · optionnel · page | blog | faq | error | guide | tool
    Filter results by type: page, blog, faq, error (error codes), guide (checkout guide sections) or tool (tools served by this endpoint). Omit to search all types.
  • limit · integer · optionnel
    Maximum number of results (1-20, default 10)
  • query · string · requis
    Search query, e.g. 'trust score threshold', 'shopify integration', 'rate limits'

  Exemple d'appel

  {"name": "search_docs", "arguments": {"query": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• search_products≈ 1070 tokens

  Search products in Demo Store. Returns matching products with prices, images, availability, and direct links. Results include data for generating a visual product carousel artifact with category filtering.

  Paramètres, retour & exemple (9)

  Paramètres

  • limit · integer · optionnel
    Number of results (1-50)
  • query · string · optionnel
    Search query (e.g. 'red sneakers', 'winter jacket'). Omit to list all products.
  • cursor · string · optionnel
    Opaque pagination cursor from next_cursor of a previous response. Only valid for the SAME query, category, price range and sort_by — a cursor replayed against different filters is rejected, not silently applied.
  • compact · boolean · optionnel
    When true, the same products are described only once instead of twice. `structuredContent.products` stays the full typed record — every field, every product, untouched — but the text reply becomes a short id/title/price/currency/availability line per product instead of a markdown re-narration of that same data (images, links, ratings inline). Nothing that asserts trust is affected: `merchant_trust`, `rating_provenance` and `sort_provenance_warning` are never trimmed by this flag. Ignored when `field_mask` is also set — a field mask already replaces the narration with a compact listing, so there is nothing left for `compact` to cut.
  • sort_by · string · optionnel · relevance | price_asc | price_desc | newest | rating
    Sort order for results
  • category · string · optionnel
    Filter by category slug
  • max_price · number · optionnel
    Maximum price filter
  • min_price · number · optionnel
    Minimum price filter
  • field_mask · array · optionnel
    Return only these product fields, to spend less of your context on a large catalogue. `id` is always included. Supplying a mask also drops the carousel/UI payloads, which are the bulk of a full response.

  Exemple d'appel

  {"name": "search_products", "arguments": {"limit": 1, "query": "texte", "cursor": "texte", "compact": true, "sort_by": "relevance", "category": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"query": "texte", "total": 1, "has_more": true, "products": [], "next_cursor": "texte", "store_environment": "texte", "sort_provenance_warning": "texte"}}

• search_products_enriched≈ 894 tokens

  Search products with enriched data including structured attributes, variants, GTIN, and images. Ideal for comparison and detailed product discovery. Matching is keyword/substring-based (title, description, tags, vendor) with rating-then-review ordering — the rating and review count it orders by are asserted by the merchant and are not verified by Trusteed. Use this when you have concrete keywords, a category, or a price range.

  Paramètres, retour & exemple (5)

  Paramètres

  • limit · integer · optionnel
    Max results (1-20)
  • query · string · requis
    Search query
  • category · string · optionnel
    Filter by category
  • max_price · number · optionnel
    Maximum price
  • min_price · number · optionnel
    Minimum price

  Exemple d'appel

  {"name": "search_products_enriched", "arguments": {"query": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"query": "texte", "total": 1, "products": [], "sort_provenance_warning": "texte"}}

• select_shipping_option≈ 627 tokens

  Select a shipping method for the cart. Must call get_shipping_rates first and provide idempotency_key. Reuse the same key for retries of the same cart and option; use a new key if either changes. PREFER THE CART CARD: if there is an interactive card for this cart, let the buyer pick shipping there instead of calling this tool yourself — it keeps the flow in one card instead of opening a new one per step. Checkout guide: read the MCP resource trusteed://guides/checkout. CREDENTIAL: this store needs one. Call the `create_sandbox_key` tool first (it is in this tool list and needs no credential), then pass the key you get back as the `agent_key` argument — or as an `Authorization: Bearer` header if your client can set headers. Do not ask a person to log in: there is no human login for this store.

  Paramètres, retour & exemple (4)

  Paramètres

  • cart_id · string · requis
    Cart session ID
  • agent_key · string · optionnel
    Sandbox credential from `create_sandbox_key`. Use this when your client cannot set an `Authorization: Bearer` header.
  • idempotency_key · string · optionnel
    REQUIRED for this write unless sent as the `Idempotency-Key` header or `params._meta["trusteed/idempotency-key"]`. 1-128 chars from [A-Za-z0-9._:/-]. Reuse the same value when retrying the same operation.
  • shipping_handle · string · requis
    Shipping method handle from get_shipping_rates

  Exemple d'appel

  {"name": "select_shipping_option", "arguments": {"cart_id": "texte", "shipping_handle": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"cart_id": "texte", "currency": "texte", "total_cents": 1, "selected_title": "texte", "shipping_cents": 1, "subtotal_cents": 1, "selected_handle": "texte", "shipping_source": "platform", "shipping_authoritative": true}}

• ucp_cancel_checkout≈ 338 tokens

  Cancel a UCP checkout session. Transitions to 'canceled' status. Cannot cancel already completed checkouts. Use ONLY for a checkout session created with ucp_create_checkout (Universal Commerce Protocol); for the standard flow (create_cart, preview_checkout, complete_checkout) do not call this tool. Checkout guide: read the MCP resource trusteed://guides/checkout.

  Paramètres, retour & exemple (4)

  Paramètres

  • reason · string · optionnel
    Optional cancellation reason
  • agent_key · string · optionnel
    Sandbox credential from `create_sandbox_key`. Use this when your client cannot set an `Authorization: Bearer` header.
  • checkout_id · string · requis
    UCP checkout session ID (valid UUID)
  • idempotency_key · string · optionnel
    REQUIRED for this write unless sent as the `Idempotency-Key` header or `params._meta["trusteed/idempotency-key"]`. 1-128 chars from [A-Za-z0-9._:/-]. Reuse the same value when retrying the same operation.

  Exemple d'appel

  {"name": "ucp_cancel_checkout", "arguments": {"checkout_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• ucp_complete_checkout≈ 1203 tokens

  Complete a UCP checkout session. Transitions to 'completed' status. Idempotent — safe to retry with the same idempotency_key. Use ONLY for a checkout session created with ucp_create_checkout (Universal Commerce Protocol); for the standard flow (create_cart, preview_checkout, complete_checkout) do not call this tool. For a cart built with create_cart use complete_checkout. PAYMENT MANDATE: this tool also requires one, issued by the platform, not written by you. Call `preview_checkout` for this cart, open the `approval_url` it returns, poll `approval_status_url` with your agent credential, and send the mandate you receive as the `payment_mandate` argument or an `X-Payment-Mandate` header. The approval is bound to your agent credential and the cart; it does not verify that a person was present. Checkout guide: read the MCP resource trusteed://guides/checkout.

  Paramètres, retour & exemple (12)

  Paramètres

  • ap2 · object · optionnel
    AP2 mandates extension. Required when the checkout carries ap2.merchant_authorization.
  • meta · ? · optionnel
    UCP request metadata. meta['ucp-agent'].profile = URL of the platform profile; it must be an https URL without credentials (at most 2048 characters).
  • buyer · object · optionnel
    Buyer name and email, needed to request the approval link.
  • payment · object · optionnel
    UCP payment. With AP2, the Payment Mandate goes in instruments[].credential.token.
  • agent_key · string · optionnel
    Sandbox credential from `create_sandbox_key`. Use this when your client cannot set an `Authorization: Bearer` header.
  • checkout_id · string · requis
    UCP checkout session ID (valid UUID)
  • x402_payload · ? · optionnel
    x402: signed payment for the server offer (omit to get it).
  • payment_option · string · optionnel · demo_card | demo_wallet | own_wallet | merchant_card | paypal
    Payment method THE PERSON chose, when preview_checkout returned payment_options. Ask the person; never choose for them. Card numbers and wallet keys are never sent here: the person approves (and, with own_wallet, signs) on the approval page.
  • idempotency_key · string · requis
    REQUIRED as an argument in this tool: the `Idempotency-Key` header or `_meta` alone is not enough. 1-128 chars from [A-Za-z0-9._:/-]. Reuse the same value when retrying the same operation.
  • payment_handler · string · optionnel · stripe | x402
    Payment handler the store profile publishes. Omit for default.
  • payment_mandate · ? · optionnel
    Payment mandate issued by the platform for this cart: the compact JWS you receive after the approval opened by `preview_checkout` is granted (its `exp` is Unix seconds and `aud` is this store's slug). Forward it as received; a mandate you write yourself is not accepted here. The approval is bound to your agent credential and does not verify that a person was present. Use this when your client cannot set an `X-Payment-Mandate` header.
  • shared_payment_token · string · optionnel
    Stripe Shared Payment Token (spt_…) granted by the buyer's agent wallet for payment_method=ACP. Issued by Stripe, scoped to this merchant, amount and currency, and consumed when used: it can be charged once. Only honoured when this deployment enables native ACP settlement.

  Exemple d'appel

  {"name": "ucp_complete_checkout", "arguments": {"checkout_id": "texte", "idempotency_key": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• ucp_create_checkout≈ 784 tokens

  Create a UCP (Universal Commerce Protocol) checkout session from line items. Returns a UCP checkout object with status 'incomplete'. Starts the UCP flow (ucp_* tools); for the standard flow use create_cart instead. Do not mix the two flows on the same purchase. Checkout guide: read the MCP resource trusteed://guides/checkout.

  Paramètres, retour & exemple (7)

  Paramètres

  • meta · ? · optionnel
    UCP request metadata. meta['ucp-agent'].profile = URL of the platform profile; it must be an https URL without credentials (at most 2048 characters).
  • label · string · optionnel
    Optional label for additional identifiers (e.g. external order ref, multi-PSP reference)
  • intent · object · optionnel
    Intent context for relevance and personalization
  • currency · string · requis
    ISO 4217 currency code (e.g. USD)
  • agent_key · string · optionnel
    Sandbox credential from `create_sandbox_key`. Use this when your client cannot set an `Authorization: Bearer` header.
  • line_items · array · requis
    Line items for the checkout
  • idempotency_key · string · optionnel
    REQUIRED for this write unless sent as the `Idempotency-Key` header or `params._meta["trusteed/idempotency-key"]`. 1-128 chars from [A-Za-z0-9._:/-]. Reuse the same value when retrying the same operation.

  Exemple d'appel

  {"name": "ucp_create_checkout", "arguments": {"currency": "texte", "line_items": []}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• ucp_get_checkout≈ 275 tokens

  Retrieve a UCP checkout session by ID. Returns the current state of the checkout. Use ONLY for a checkout session created with ucp_create_checkout (Universal Commerce Protocol); for the standard flow (create_cart, preview_checkout, complete_checkout) do not call this tool. Checkout guide: read the MCP resource trusteed://guides/checkout.

  Paramètres, retour & exemple (3)

  Paramètres

  • meta · ? · optionnel
    UCP request metadata. meta['ucp-agent'].profile = URL of the platform profile; it must be an https URL without credentials (at most 2048 characters).
  • agent_key · string · optionnel
    Sandbox credential from `create_sandbox_key`. Use this when your client cannot set an `Authorization: Bearer` header.
  • checkout_id · string · requis
    UCP checkout session ID (valid UUID)

  Exemple d'appel

  {"name": "ucp_get_checkout", "arguments": {"checkout_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• ucp_preview_checkout≈ 394 tokens

  Preview a UCP checkout and move it to ready-for-payment. Call after destination and shipping are set, before ucp_complete_checkout. Use ONLY for a checkout created with ucp_create_checkout. Checkout guide: read the MCP resource trusteed://guides/checkout.

  Paramètres, retour & exemple (4)

  Paramètres

  • meta · ? · optionnel
    UCP request metadata. meta['ucp-agent'].profile = URL of the platform profile; it must be an https URL without credentials (at most 2048 characters).
  • agent_key · string · optionnel
    Sandbox credential from `create_sandbox_key`. Use this when your client cannot set an `Authorization: Bearer` header.
  • checkout_id · string · requis
    UCP checkout session ID (valid UUID)
  • payment_mandate · ? · optionnel
    Payment mandate issued by the platform for this cart: the compact JWS you receive after the approval opened by `preview_checkout` is granted (its `exp` is Unix seconds and `aud` is this store's slug). Forward it as received; a mandate you write yourself is not accepted here. The approval is bound to your agent credential and does not verify that a person was present. Use this when your client cannot set an `X-Payment-Mandate` header.

  Exemple d'appel

  {"name": "ucp_preview_checkout", "arguments": {"checkout_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• ucp_update_checkout≈ 984 tokens

  Update a UCP checkout session. Send line_items to replace all lines (each line may name a variant_id), and/or fulfillment to set the delivery address (fulfillment.destination, which returns the shipping options) and choose one (fulfillment.selected_option_id, which adds shipping to the totals). Only allowed when status is 'incomplete'. Use ONLY for sessions created with ucp_create_checkout; for the standard flow use create_cart and select_shipping_option. Checkout guide: read the MCP resource trusteed://guides/checkout.

  Paramètres, retour & exemple (7)

  Paramètres

  • meta · ? · optionnel
    UCP request metadata. meta['ucp-agent'].profile = URL of the platform profile; it must be an https URL without credentials (at most 2048 characters).
  • currency · string · optionnel
    ISO 4217 currency code (e.g. USD). Optional: defaults to the checkout's currency.
  • agent_key · string · optionnel
    Sandbox credential from `create_sandbox_key`. Use this when your client cannot set an `Authorization: Bearer` header.
  • line_items · array · optionnel
    Replacement line items (replaces all lines). Omit to leave the lines as they are.
  • checkout_id · string · requis
    UCP checkout session ID (valid UUID)
  • fulfillment · object · optionnel
    Delivery. Send destination first, then selected_option_id (or both in one call).
  • idempotency_key · string · optionnel
    REQUIRED for this write unless sent as the `Idempotency-Key` header or `params._meta["trusteed/idempotency-key"]`. 1-128 chars from [A-Za-z0-9._:/-]. Reuse the same value when retrying the same operation.

  Exemple d'appel

  {"name": "ucp_update_checkout", "arguments": {"checkout_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• verify_trust_receipt≈ 290 tokens

  Check a trust receipt's signature, revocation and chain coverage from inside this session (v1.0 receipts only; other profiles answer `unsupported_profile`, not invalid). LIMIT: the issuer verifies its own receipt (`verified_by: issuer`, `independent: false`), so this is a consistency check, not proof to a third party; `independent_verification` tells you how to verify it yourself against the public JWKS. Pass the `jws` from get_trust_receipt. Checkout guide: read the MCP resource trusteed://guides/checkout.

  Paramètres, retour & exemple (2)

  Paramètres

  • jws · string · requis
    The compact JWS of the receipt (the `jws` field returned by get_trust_receipt).
  • agent_key · string · optionnel
    Sandbox credential from `create_sandbox_key`. Use this when your client cannot set an `Authorization: Bearer` header.

  Exemple d'appel

  {"name": "verify_trust_receipt", "arguments": {"jws": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

C'est votre serveur ?

Revendiquez-le sur l'espace créateur (preuve GitHub, domaine ou npm) pour afficher le badge « propriétaire vérifié » et lancer un pentest comportemental à la demande afin d'obtenir le badge « Vérifié ».

Créer un compte / revendiquer →

Source

https://trusteed.xyz/demo-store/mcp