Kifly — Agentic Commerce & Payments
REMOTE · KIFLY.AI · SCANNED SEP 20
Multi-seller shopping for AI agents. Settle via Stripe MPP or x402 USDC on Base. Hosted.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security94
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation is enforced on tool calls, advertised via RFC 9728 protected-resource metadata. Discovery is public, which costs nothing: no tool can be invoked without a token. View diagnostics → Pass
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- The HSTS (Strict-Transport-Security) header is present. View diagnostics → Pass
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
- The authorisation server offers only Dynamic Client Registration (RFC 7591), which MCP 2026-07-28 deprecated in favour of Client ID Metadata Documents. View diagnostics → Partial
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability81
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 5845 tokens (~194/item across 30 items; 21 tools + 9 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
- No destabilizing schema changes in the last 30 days.Pass
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 22 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
- Supports UI / widget rendering.Pass
How do I install the Kifly — Agentic Commerce & Payments MCP server?
Kifly — Agentic Commerce & Payments is a hosted endpoint at https://kifly.ai/api/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · kifly.ai
claude mcp add --transport http ai-kifly-mcp 'https://kifly.ai/api/mcp'
{
"mcpServers": {
"ai-kifly-mcp": {
"url": "https://kifly.ai/api/mcp"
}
}
} {
"servers": {
"ai-kifly-mcp": {
"type": "http",
"url": "https://kifly.ai/api/mcp"
}
}
} [mcp_servers.ai-kifly-mcp] url = "https://kifly.ai/api/mcp"
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"ai-kifly-mcp": {
"type": "remote",
"url": "https://kifly.ai/api/mcp",
"enabled": true
}
}
} openclaw mcp add ai-kifly-mcp --url 'https://kifly.ai/api/mcp' --transport streamable-http
mcp_servers:
ai-kifly-mcp:
url: "https://kifly.ai/api/mcp" {
"McpServers": {
"ai-kifly-mcp": {
"Transport": "http",
"Url": "https://kifly.ai/api/mcp"
}
}
} assistant mcp add ai-kifly-mcp -t streamable-http -u 'https://kifly.ai/api/mcp'
{
"mcpServers": {
"ai-kifly-mcp": {
"type": "http",
"url": "https://kifly.ai/api/mcp"
}
}
} The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 19 Sept 26 0
- Tool “checkout” rewrote its description, which is the text the model reads security
- Tool “get_buyer_profile” rewrote its description, which is the text the model reads security
- Tool “get_help” rewrote its description, which is the text the model reads security
- Tool “get_seller” rewrote its description, which is the text the model reads security
- Tool “quick_buy” rewrote its description, which is the text the model reads security
- Tool “search_products” rewrote its description, which is the text the model reads security
- Tool “set_shipping_address” rewrote its description, which is the text the model reads security
- Tool “submit_feedback” rewrote its description, which is the text the model reads security
- Schema quality: 286 → 194 ▲ functional
- New resource “docs_buyer_identity” functional
- New resource “docs_checkout_response” functional
- New resource “docs_delivery” functional
- New resource “docs_errors” functional
- New resource “docs_mcp” functional
- New resource “docs_rest” functional
- New resource “docs_search_response” functional
- “add_to_cart” added an optional parameter “idempotency_key” cosmetic
- “checkout” added an optional parameter “idempotency_key” cosmetic
- “create_cart” added an optional parameter “idempotency_key” cosmetic
- “get_platform_limits” added an optional parameter “meta” cosmetic
- “quick_buy” added an optional parameter “idempotency_key” cosmetic
- “set_shipping_address” added an optional parameter “idempotency_key” cosmetic
- “submit_feedback” added an optional parameter “meta” cosmetic
- “update_cart_item” added an optional parameter “idempotency_key” cosmetic
- “add_to_cart” reworded the description of “meta” cosmetic
- “create_cart” reworded the description of “meta” cosmetic
- “get_cart” reworded the description of “meta” cosmetic
- “get_help” reworded the description of “meta” cosmetic
- “get_seller” reworded the description of “meta” cosmetic
- “list_sellers” reworded the description of “meta” cosmetic
- “quick_buy” reworded the description of “meta” cosmetic
- “search_products” reworded the description of “meta” cosmetic
- “set_shipping_address” reworded the description of “meta” cosmetic
- “update_cart_item” reworded the description of “meta” cosmetic
- 18 Sept 26 0
- “add_to_cart” added an optional parameter “meta” cosmetic
- “create_cart” added an optional parameter “meta” cosmetic
- “get_cart” added an optional parameter “meta” cosmetic
- “get_help” added an optional parameter “meta” cosmetic
- “get_seller” added an optional parameter “meta” cosmetic
- “list_sellers” added an optional parameter “meta” cosmetic
- “quick_buy” added an optional parameter “meta” cosmetic
- “search_products” added an optional parameter “meta” cosmetic
- “set_shipping_address” added an optional parameter “meta” cosmetic
- “update_cart_item” added an optional parameter “meta” cosmetic
10 cosmetic changes on this day. Switch on “Show cosmetic changes” to see them.
- 26 Aug 26 +1
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 25 Aug 26 0
- Stability: 0.97 → pass security
- 24 Aug 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.
- 22 Aug 26 92
- Tool “search_products” rewrote its description, which is the text the model reads security
- 14 Aug 26 0
- First check of Capabilities: pass functional
- New resource “search_results_view” functional
- 11 Aug 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Probed https://kifly.ai/api/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=*.kifly.ai | CN=YR2,O=Let's Encrypt,C=US | 6 Aug 2026 | 4 Nov 2026 | RSA 2048 | SHA256-RSA | 5b8d24bc7f9d649c7c9408584691624533b |
| SANs: *.kifly.ai, kifly.ai | ||||||
| CN=YR2,O=Let's Encrypt,C=US (CA) | CN=Root YR,O=ISRG,C=US | 3 Sept 2025 | 2 Sept 2028 | RSA 2048 | SHA256-RSA | 4ebd24947e24d394802d84a52fd5b319 |
| CN=Root YR,O=ISRG,C=US (CA) | CN=ISRG Root X1,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | RSA 4096 | SHA256-RSA | f24b6d17f9d9ad7cb1c9fea78782699f |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of kifly.ai. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| ai. | present | 3799 | 8 | Verified |
| kifly.ai. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication Enforced and verified
The endpoint asked for a token and published valid RFC 9728 metadata describing how to get one.
| Result | Enforced and verified |
|---|---|
| Enforced | On tool calls |
| HTTP status | 200 |
WWW-Authenticate challenge Bearer realm="kifly", resource_metadata="https://kifly.ai/.well-known/oauth-protected-resource"
Bearer realm="kifly", resource_metadata="https://kifly.ai/.well-known/oauth-protected-resource" | Header | Value |
|---|---|
| strict-transport-security | max-age=63072000; includeSubDomains; preload |
| x-content-type-options | nosniff |
| x-frame-options | DENY |
| referrer-policy | strict-origin-when-cross-origin |
| permissions-policy | camera=(), microphone=(), geolocation=() |
Protected resource metadata
| Document | https://kifly.ai/.well-known/oauth-protected-resource |
|---|---|
| Retrieved | Yes |
| Resource | https://kifly.ai/api/mcp |
| Authorisation server | https://kifly.ai |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://kifly.ai/api/mcp | Verified | 200 | |
| http (plaintext) | http://kifly.ai/api/mcp | HTTPS enforced | 308 | https://kifly.ai/api/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
add_to_cart ~252
Requires `checkout:write` scope. Add a product variant to an existing cart. Use the variant_id from search_products results. Returns full cart state including item_ids you can use with update_cart_item. **Max quantity per item and max cart total are enforced — call `get_platform_limits` to check the current limits before building a large cart.** Exceeding the per-item limit returns 400 `QUANTITY_EXCEEDS_LIMIT`; exceeding the cart total returns 400 `CART_TOTAL_EXCEEDS_LIMIT` at checkout. `cart.kifly_purchasable` (and `cart.fulfillment`) carries the same non-transactable signal as create_cart's `seller` field — check it before telling the buyer this is a real purchase.
| Name | Type | Req | Description |
|---|---|---|---|
| cart_id | string | yes | Cart ID from create_cart |
| idempotency_key | string | – | Your own retry key (16-64 chars). Resend the SAME key to retry safely. |
| meta | object | – | Who is calling (canonical UCP `meta`). See kifly://docs/mcp. |
| quantity | integer | – | Quantity to add |
| variant_id | string | yes | Product variant ID from search_products results |
No output schema declared.
No examples provided.
checkout ~433
Requires `checkout:write` **or** the narrower `checkout:link` scope — and **no API key at all** works too: send `meta.ucp-agent.profile` and you get the same payment link (a tokenless caller holds `checkout:link`). **Checkout is always human-in-the-loop: it returns a link the buyer opens and confirms — it never charges a card or completes an order on its own.** **Requires `set_shipping_address` to have been called first.** Cart total must not exceed the platform cap (`kifly://platform/limits`). **To pre-fill the buyer's email on the payment page, pass `email` — ask the buyer for it in plain language ('what email should the receipt go to?'). Never ask the buyer to paste a token.** Read `payment_rail` on the response BEFORE telling the buyer anything: `'stripe-checkout'` is a real Kifly purchase, `'directory-handoff'` is a referral to the seller's own site with no payment link at all, and `'shopify-native'` sends the buyer to the seller's own checkout. **Full response field reference, including every refusal code: read the `kifly://docs/checkout-response` resource.**
| Name | Type | Req | Description |
|---|---|---|---|
| buyer_token | string | – | INTERNAL token (kfb_live_...) minted by register_buyer / verify_buyer — resolves the buyer's saved profile and pre-fills their email on the payment link. NEVER ask the buyer to paste this. Omit it un… |
| cart_id | string | yes | Cart ID from create_cart |
| string | – | Buyer's email, collected conversationally. Pre-fills the Stripe Checkout email field so the buyer doesn't retype it. This is ALL you need to pre-fill email — ask the buyer for their email, never for… | |
| idempotency_key | string | – | Your own retry key (16-64 chars). Resend the SAME key to retry safely. |
No output schema declared.
No examples provided.
create_cart ~294
Create a new shopping cart on Kifly. **For network (cross-seller) tokens you MUST pass `seller_handle`** — each cart is bound to exactly one seller. Get the handle from search_products results (every item's `kifly:seller` IS the handle in network results) or get_seller. Seller-scoped tokens may omit the handle — their own seller is implicit. Returns a cart_id to use with add_to_cart and checkout. The response's `seller.kifly_purchasable` (and `seller.fulfillment`) tells you upfront whether this seller can complete a real Kifly checkout — `false`/`"external"` means directory-tier: checkout will hand off to the seller's own site instead of charging, so present the flow as a referral, not a purchase. Cart-building still works either way (needed to generate the handoff's per-product links), and the same flag rides every add_to_cart/get_cart response on this cart too.
| Name | Type | Req | Description |
|---|---|---|---|
| idempotency_key | string | – | Your own retry key (16-64 chars). Resend the SAME key to retry safely. |
| meta | object | – | Who is calling (canonical UCP `meta`). See kifly://docs/mcp. |
| seller_handle | string | – | Seller handle (e.g. 'bay-clothing-district'). Required for network tokens; ignored for seller-scoped tokens. |
No output schema declared.
No examples provided.
get_buyer_profile ~185
Retrieve a repeat buyer's saved name, email, and default shipping address, given their `buyer_token`. Use them to auto-fill `set_shipping_address`, and pass the token to `checkout` so Stripe pre-fills their email. `default_shipping_address` may be null — then collect it normally and call `save_buyer_address` so it is pre-filled next time. **Ask in plain language ('are you a returning Kifly shopper? what email is on your account?') — never ask a buyer to paste a token.** **How to get the token: read `kifly://docs/buyer-identity`** — the email-code sequence, the one-click sign-in alternative, and what to do for a new buyer.
| Name | Type | Req | Description |
|---|---|---|---|
| buyer_token | string | yes | The buyer's kfb_live_... token from their Kifly account |
No output schema declared.
No examples provided.
get_cart ~162
Inspect the current state of a cart — line items, quantities, prices, and shipping address. Each item includes an `item_id` you can pass to `update_cart_item` to change quantity or remove the item. Call this after `add_to_cart` to review the cart before checkout, or any time the buyer asks what's in the cart. `kifly_purchasable: false` (`fulfillment: "external"`) means checkout on this cart will hand off to the seller's own site instead of charging — say so before the buyer expects a real purchase.
| Name | Type | Req | Description |
|---|---|---|---|
| cart_id | string | yes | Cart ID from create_cart |
| meta | object | – | Who is calling (canonical UCP `meta`). See kifly://docs/mcp. |
No output schema declared.
No examples provided.
get_help ~125
Get unstuck. Returns Kifly's website and support email for the BUYER, plus how to report the problem to Kifly's engineers yourself. Call this if you are stuck, hit an unresolvable error, or the buyer asks how to reach a human. Share the website and email with the buyer; use `submit_feedback` (no API key needed) to tell us what blocked you — that is the fastest way to get it fixed.
| Name | Type | Req | Description |
|---|---|---|---|
| meta | object | – | Who is calling (canonical UCP `meta`). See kifly://docs/mcp. |
No output schema declared.
No examples provided.
get_platform_limits ~112
Returns the current platform-enforced cart limits: `max_item_quantity` (per-line-item ceiling), `max_cart_total_cents`, and `max_cart_total_usd`. Call this once at session start before building a large cart so you can quote limits to the buyer proactively rather than discovering them via errors. The limits are operator-configurable; always read them at runtime rather than hardcoding.
| Name | Type | Req | Description |
|---|---|---|---|
| meta | object | – | Who is calling (canonical UCP `meta`). See kifly://docs/mcp. |
No output schema declared.
No examples provided.
get_seller ~285
Retrieve a seller's public profile: name, location (city/region/country), storefront URL, delivery fee, delivery coverage and catalog size. **Call before `create_cart` or `set_shipping_address` to check the seller ships to the buyer's area.** This is the FULL profile — `cities` is never capped here (unlike `list_sellers`/`search_products`). **`coverage_configured: false` means the seller ships NOWHERE — never tell the buyer otherwise; an empty `states` list is NOT nationwide. `merchant_managed: true` means shipping is set at the seller's own checkout — do NOT report them as not shipping.** Full semantics, including the `nationwide` and capped-cities cases: read `kifly://docs/delivery`. **Network (cross-seller) tokens must pass `handle`** (e.g. `bay-clothing-district`); lookup is case-insensitive. Seller-scoped tokens may omit it — their own seller is implicit.
| Name | Type | Req | Description |
|---|---|---|---|
| handle | string | – | Seller handle (case-insensitive, e.g. 'bay-clothing-district' or 'BayClothingDistrict'). Required for network tokens; ignored for seller-scoped tokens. |
| meta | object | – | Who is calling (canonical UCP `meta`). See kifly://docs/mcp. |
No output schema declared.
No examples provided.
list_orders ~282
List a returning buyer's recent orders and their current fulfillment status — use this in a NEW session to answer 'did my order ship?' / 'where's my package?' when you don't have the original `session_id` from `checkout`. Requires the buyer's `buyer_token` (recover it via `request_buyer_code` + `verify_buyer` if you don't have one). Returns `{ orders, count }`, newest first; each order has `status` (`paid` | `shipped` | `delivered`), `items`, `amount_cents`, `placed_at`, and — once shipped — `tracking_number`, `carrier`, and a public `tracking_url`. **Pass `since` (an ISO-8601 timestamp from a previous check) to get only orders that changed since then** — surface those proactively ('your last order just shipped'). `order_id` identifies the order; `session_id` cross-references `order_status` for a single live checkout.
| Name | Type | Req | Description |
|---|---|---|---|
| buyer_token | string | yes | The buyer's kfb_live_... token from their Kifly account |
| limit | integer | – | Max orders to return (default 20, max 50). |
| since | string | – | ISO-8601 timestamp. Only return orders updated after this — pass the time of your last check to get the delta. |
No output schema declared.
No examples provided.
list_sellers ~250
List all active sellers on the Kifly network. **Requires a network token (kfn_live_…).** Returns each seller's handle, name, city, region, delivery coverage (`nationwide:true` or a `states` list), delivery fee, and catalog size. `delivery_coverage.cities` may be capped to a handful of entries — compare `cities.length` against `city_count`; if fewer, call `get_seller` for that seller's full city list. Use this to discover which sellers are available and which ship to a buyer's location before calling `get_seller` or `search_products`. **Pagination:** when `kifly:hasMore` is true, pass `kifly:nextCursor` as `cursor` to fetch the next page. Default page size is 20, max 50.
| Name | Type | Req | Description |
|---|---|---|---|
| cursor | string | – | Pagination cursor from kifly:nextCursor in a previous response. Omit on the first call. |
| limit | integer | – | Max sellers per page (default 20, max 50). |
| meta | object | – | Who is calling (canonical UCP `meta`). See kifly://docs/mcp. |
No output schema declared.
No examples provided.
order_status ~116
Check the status of a Stripe checkout session. Poll every 5 seconds after checkout until status is 'paid', 'shipped', or 'failed'. Returns order details (order_id, amount, items) when paid. When the seller marks the order as shipped, status becomes 'shipped' and tracking_number, carrier, and shipped_at are included — share these with the buyer. Call get_help if the buyer needs Kifly's support contact.
| Name | Type | Req | Description |
|---|---|---|---|
| session_id | string | yes | Stripe checkout session ID from the checkout tool response |
No output schema declared.
No examples provided.
quick_buy ~464
Requires `cart:write` scope. Create a cart, add items, and set the shipping address in ONE call — the fast path when you already know the seller, the exact variant(s), and the buyer's address (e.g. a reorder, or a buyer who has decided). Prefer this over the create_cart → add_to_cart → set_shipping_address sequence to save round trips; those granular tools stay available for exploratory, multi-step carts. **You must call `search_products` first** so Kifly knows each variant's seller (quick_buy returns 422 `VARIANT_SNAPSHOT_MISSING` otherwise). One cart = one seller: every item must belong to the same seller (409 `CART_SELLER_MISMATCH` otherwise) — for a network token, pass that seller's `seller_handle`. Returns `{ cart_id, items_added, seller, delivery }`. `delivery` is exactly what `set_shipping_address` returns — **quote `cart_total_with_delivery_cents` before sending the buyer to pay**; on `delivery_eligible: false` no address is saved, so you can call again with a covered address. Field detail and the three coverage cases: `kifly://docs/delivery`. **quick_buy never charges — it stops at the cart. The buyer still pays via `checkout`**, which returns the payment link they open themselves. On a 5xx/'temporarily unavailable' error, retry once with the same arguments.
| Name | Type | Req | Description |
|---|---|---|---|
| external_customer_ref | string | – | Embedded-commerce pass-through: the seller's own opaque customer id for a cart from their embed widget. Omit unless you are the embed flow. |
| idempotency_key | string | – | Your own retry key (16-64 chars). Resend the SAME key to retry safely. |
| items | array | yes | Line items to add — all must belong to the same seller |
| meta | object | – | Who is calling (canonical UCP `meta`). See kifly://docs/mcp. |
| seller_handle | string | – | Seller handle from search_products. REQUIRED for network tokens; omit for seller-scoped tokens (their own seller is implicit). |
| shipping_address | object | yes | Structured shipping address collected conversationally from the buyer |
No output schema declared.
No examples provided.
register_buyer ~198
Start registering a buyer so they can be recognized across future purchases without re-entering their details. Takes the buyer's email and name and always emails a 6-digit verification code — the response is `{ verification_required: true, buyer_profile_id }` whether the email is brand new or already has an account (so this call alone never reveals which). Ask the buyer to read you the code from their inbox, then call `verify_buyer` with the same email + code to get a `buyer_token` (`kfb_live_...`). **Store that token and pass it to `checkout` on every future order** — it pre-fills the buyer's email on the secure Stripe payment link. Safe to call for a buyer you believe is new; if they already have an account, verify_buyer still recovers it.
| Name | Type | Req | Description |
|---|---|---|---|
| string | yes | Buyer's email address | |
| name | string | yes | Buyer's full name |
No output schema declared.
No examples provided.
request_buyer_code ~210
Send a 6-digit verification code to a **returning** buyer's email so they can prove the account is theirs and recover their saved name + shipping address on this connection — without pasting any token or re-entering their name. Call this when the buyer says they've shopped with Kifly before and gives you their email; then ask them to read you the code from their inbox and call `verify_buyer`. Always returns `{ sent: true }` — for the buyer's privacy the response is identical whether or not the email has a Kifly account (so it can't be used to probe who shops here), and a code is only actually emailed if an account exists. If the buyer never receives a code, they likely don't have an account yet: call `register_buyer` instead, which creates one and emails a code either way. Requires the `buyer:write` capability (marketplace/network keys).
| Name | Type | Req | Description |
|---|---|---|---|
| string | yes | The returning buyer's email address |
No output schema declared.
No examples provided.
request_feature ~468
Submit the buyer's **product/feature request** to the Kifly team. Use this when the buyer wishes Kifly *itself* did something it doesn't — a missing capability, a rough flow, an idea to improve the platform. **This is NOT `submit_feedback`** (that's for reporting a broken/confusing API response you hit). Requires the buyer's `kfb_live_` token — only registered buyers can file requests. Help the buyer articulate a real problem: ask OPEN, non-leading questions ('what were you trying to do? what got in the way? how do you handle it today?') — never 'would feature X help?'. Pre-fill the fields from the conversation and ask only for the gaps; keep it short. Separate the `problem` (the pain) from any `proposed_solution` (the fix). Name and email are taken from the buyer profile automatically — do not ask for them. Returns 202: it's logged for review. **Do NOT promise the user anything will be built** — just confirm it was recorded.
| Name | Type | Req | Description |
|---|---|---|---|
| buyer_token | string | yes | The buyer's kfb_live_ token. Required — feature requests must come from a registered buyer. |
| category | string | yes | Closest match for the area of the request. Don't invent new categories. |
| contact_phone | string | – | Optional phone number IF the buyer offers one for follow-up. Name + email come from their profile — never ask for those. |
| context | object | – | Optional signal about the conversation: { goal, seller, last_tool }. Auto-fill from what you were doing. |
| current_workaround | string | – | Optional. What the buyer does today instead. Leave blank if there's no workaround. |
| impact | string | yes | Why it matters: who it affects, how often, what it costs them today. |
| problem | string | yes | The pain in the buyer's own terms — what's broken or missing for them. NOT the proposed fix. |
| proposed_solution | string | – | Optional. The buyer's idea for a fix, kept separate from the problem. Leave blank if they only described the pain. |
| severity | string | yes | blocker = can't accomplish the goal at all. friction = works but painful. nice_to_have = improvement idea. |
No output schema declared.
No examples provided.
save_buyer_address ~127
Save a shipping address to the buyer's Kifly profile so it auto-fills on future purchases. **Call this after a successful checkout if `get_buyer_profile` returned `default_shipping_address: null`.** The address is persisted server-side against the buyer token — the buyer never needs to re-enter it. Use the same address that was passed to `set_shipping_address` for this order.
| Name | Type | Req | Description |
|---|---|---|---|
| address | object | yes | The shipping address to save — same structure as set_shipping_address |
| buyer_token | string | yes | The buyer's kfb_live_... token |
No output schema declared.
No examples provided.
search_products ~616
Search or browse Kifly's product catalog across every seller on the network. Multilingual semantic search (100+ languages); omit `q` to browse recent listings. Pass `q` as an array (up to 5) to try several phrasings in ONE call instead of N searches. Filter with `seller_handle` or free-text `category`; page with `cursor` when `kifly:hasMore` is true. Returns a JSON-LD ItemList. **Rules that matter before you read the response:** - `kifly:purchasable: false` means the seller is discovery-only — present it as a referral, never route to checkout. `availability` is about STOCK, not buyability: read `kifly:purchasable` to decide whether a buyer can actually pay. - On `availability:OutOfStock`, still show it if asked, say it is sold out, and never cart it (`add_to_cart` returns 409). - When a product has several size/style variants, ask the buyer ONE option axis at a time (`kifly:productOptions` gives the axes in the seller's order). Never recite the combination matrix. - You can read the delivery fee and check coverage from these results — no need to call `set_shipping_address` just to learn the cost. Do call it before checkout. - On an empty result, read `kifly:emptyReason`: say nothing matched rather than guessing, then offer `kifly:suggestions` (related, NOT matches). **Full response field reference: read the `kifly://docs/search-response` resource.** It documents the seller map, the three delivery-coverage cases, variant/option alignment, the capped fields and every `kifly:` extension — fetch it once if you need field-level detail.
| Name | Type | Req | Description |
|---|---|---|---|
| category | string | – | Case-insensitive category filter (e.g. 'fashion', 'Electronics'). Matches the seller-assigned category value. |
| cursor | string | – | Pagination cursor from kifly:nextCursor in a previous browse response. Omit on the first call. |
| in_stock_only | boolean | – | Only return products with available inventory |
| limit | integer | – | Max results per page (default 10). |
| max_price_cents | integer | – | Maximum price filter in cents |
| meta | object | – | Who is calling (canonical UCP `meta`). See kifly://docs/mcp. |
| min_price_cents | integer | – | Minimum price filter in cents |
| q | – | – | Natural-language query, or an array of up to 5 queries to explore in ONE call (results are unioned by best relevance). Omit to browse recent listings. |
| seller_handle | string | – | Scope results to one seller's catalog (e.g. 'bay-clothing-district'). For network tokens only; ignored for seller-scoped tokens. |
| sort_by | string | – | Sort order (default: relevance) |
No output schema declared.
No examples provided.
set_shipping_address ~194
Requires `checkout:write` scope. Persist a shipping address on the cart and confirm the seller can deliver to it. **Call BEFORE `checkout`.** Returns `delivery_eligible`. When true it also returns `cart_total_with_delivery_cents` — quote that full price before sending the buyer to pay. When false, no address is saved and `delivery_coverage` says where the seller does cover, so you can retry with a covered address. Coverage semantics: `kifly://docs/delivery`.
| Name | Type | Req | Description |
|---|---|---|---|
| cart_id | string | yes | Cart ID from create_cart |
| idempotency_key | string | – | Your own retry key (16-64 chars). Resend the SAME key to retry safely. |
| meta | object | – | Who is calling (canonical UCP `meta`). See kifly://docs/mcp. |
| shipping_address | object | yes | Structured shipping address collected conversationally from the buyer |
No output schema declared.
No examples provided.
submit_feedback ~338
Send structured feedback to the Kifly team. **No API key required** — send `meta.ucp-agent.profile` and this works with no credential at all. **Call after a confusing response, a dead-end, or a successful workaround you had to invent** — it's how we improve the agent surface, and a report from the moment you were stuck is worth more to us than a working purchase. Fire-and-forget: returns 202 immediately, no blocking, safe to skip if it would add latency to a user-facing flow. `category` and `severity` are required enums (don't free-form them). Include `context` with what you were doing (tool called, query used, response shape, what you expected). Add `suggested_fix` only if you have a concrete idea. Rate-limited to 10/min per caller; a human reads everything before it influences anything.
| Name | Type | Req | Description |
|---|---|---|---|
| category | string | yes | What kind of issue. Pick the closest match — don't invent new categories. |
| context | object | – | Reproducible signal: { tool, query, response_snippet, expected }. Auto-fill from what you just did. |
| message | string | yes | Plain-language description. Be specific about what happened and why it's a problem. |
| meta | object | – | Who is calling (canonical UCP `meta`). See kifly://docs/mcp. |
| severity | string | yes | blocker = can't complete the task. friction = degraded UX. nice_to_have = improvement idea. |
| suggested_fix | string | – | Optional. Only include if you have a concrete idea. Leave blank if you only have a complaint. |
No output schema declared.
No examples provided.
update_cart_item ~213
Requires `checkout:write` scope. Change the quantity of a line item in an open cart, or remove it entirely. Set `quantity` to 0 to remove the item. Get the `item_id` from `get_cart` or the `cart` field in the `add_to_cart` response. Returns the updated cart state. **The per-item quantity ceiling applies here too — call `get_platform_limits` to check the current limit.** Exceeding it returns 400 `QUANTITY_EXCEEDS_LIMIT`.
| Name | Type | Req | Description |
|---|---|---|---|
| cart_id | string | yes | Cart ID from create_cart |
| idempotency_key | string | – | Your own retry key (16-64 chars). Resend the SAME key to retry safely. |
| item_id | string | yes | Item ID from get_cart or add_to_cart response |
| meta | object | – | Who is calling (canonical UCP `meta`). See kifly://docs/mcp. |
| quantity | integer | yes | New quantity (0 removes the item) |
No output schema declared.
No examples provided.
verify_buyer ~159
Verify the 6-digit code a returning buyer received by email (from `request_buyer_code`). On success returns `{ buyer_token, buyer_profile_id }` — pass the `buyer_token` to `get_buyer_profile` to auto-fill their saved name + shipping address, and to `checkout` to pre-fill their email on the payment link. Fails with `invalid_otp` if the code is wrong or expired (ask them to re-check, or call `request_buyer_code` again). Requires the `buyer:write` capability.
| Name | Type | Req | Description |
|---|---|---|---|
| code | string | yes | The 6-digit code the buyer received by email |
| string | yes | The buyer's email address (same one used for request_buyer_code) |
No output schema declared.
No examples provided.
What is the Kifly — Agentic Commerce & Payments MCP server?
Kifly — Agentic Commerce & Payments is an MCP server listed in the public MCP registry as ai.kifly/mcp. Multi-seller shopping for AI agents. Settle via Stripe MPP or x402 USDC on Base. Hosted. This page covers its hosted endpoint (https://kifly.ai/api/mcp).
Is the Kifly — Agentic Commerce & Payments MCP server safe to use?
Kifly — Agentic Commerce & Payments scores 94 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Kifly — Agentic Commerce & Payments MCP server expose?
Kifly — Agentic Commerce & Payments exposes 21 tools: search_products, create_cart, add_to_cart, get_cart, update_cart_item, and 16 more. Their descriptions and schemas cost roughly 5,483 tokens of context every time the server is loaded.
Does the Kifly — Agentic Commerce & Payments MCP server require authentication?
Yes. Kifly — Agentic Commerce & Payments asked us for credentials when we connected, so you will need to authorise it in your MCP client before it can do anything.
Is the Kifly — Agentic Commerce & Payments MCP server still maintained?
Kifly — Agentic Commerce & Payments is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.