within · luxury boutiques
REMOTE · SHOPWITHIN.CO
Live stock at independent luxury boutiques: pieces, sizes, prices and the page to buy each one.
Available components
Last scanned (17 hours ago)
Scores higher than 66% of remote servers
Reachable. Last reached 24 Oct 2026.
Category E-commerce
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security80
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- No authorisation is required to call this server. Every tool declares its destructiveHint and none is destructive, so open access doesn't expose one. See how to fix → View diagnostics → Partial
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- The HSTS (Strict-Transport-Security) header is present. View diagnostics → Pass
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability75
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 2717 tokens (~226/item across 12 items; 9 tools + 3 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management7
- Stability observed for 2 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage98
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 92% of tool parameters carry a description.Partial
- Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 9 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 11 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
- Supports UI / widget rendering.Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 24 Oct 26 0
- Tool “trending_now” rewrote its description, which is the text the model reads security
- “trending_now” reworded the description of “limit” cosmetic
- 23 Oct 26 +1
- Stability: unverified → 0.03 ▲ functional
- 22 Oct 26 73
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 24 Oct 2026 · Probed https://shopwithin.co/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=shopwithin.co | CN=YR2,O=Let's Encrypt,C=US | 23 Sept 2026 | 22 Dec 2026 | RSA 2048 | SHA256-RSA | 513b525242c38e2381de013b2af0544297e |
| SANs: shopwithin.co | ||||||
| CN=YR2,O=Let's Encrypt,C=US (CA) | CN=Root YR,O=ISRG,C=US | 3 Sept 2025 | 2 Sept 2028 | RSA 2048 | SHA256-RSA | 4ebd24947e24d394802d84a52fd5b319 |
| CN=Root YR,O=ISRG,C=US (CA) | CN=ISRG Root X1,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | RSA 4096 | SHA256-RSA | f24b6d17f9d9ad7cb1c9fea78782699f |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of shopwithin.co. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| co. | present | 7786 | 8 | Verified |
| shopwithin.co. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
| Header | Value |
|---|---|
| strict-transport-security | max-age=63072000 |
| content-security-policy | default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'self'; script-src 'self' 'unsafe-inline' https://web.squarecdn.com https://sandbox.web.squarecdn.com https://js.stripe.com https://www.googletagmanager.com https://us-assets.i.posthog.com https://eu-assets.i.posthog.com https://us.i.posthog.com https://eu.i.posthog.com https://accounts.google.com https://appleid.cdn-apple.com https://va.vercel-scripts.com; frame-src 'self' https://web.squarecdn.com https://sandbox.web.squarecdn.com https://connect.squareup.com https://connect.squareupsandbox.com https://pci-connect.squareup.com https://pci-connect.squareupsandbox.com https://*.squareup.com https://*.squareupsandbox.com https://*.squarecdn.com https://js.stripe.com https://hooks.stripe.com https://m.stripe.network https://accounts.google.com https://appleid.apple.com; connect-src 'self' https://pci-connect.squareup.com https://pci-connect.squareupsandbox.com https://connect.squareup.com https://connect.squareupsandbox.com https://web.squa |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://shopwithin.co/mcp | Verified | 200 | |
| http (plaintext) | http://shopwithin.co/mcp | HTTPS enforced | 308 | https://shopwithin.co/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
boutique_shelf One boutique's shelf ~141
One boutique's shelf right now, newest first, with sizes and prices; a query searches inside that shop only. Use this when a shopper names a specific boutique ('what does WDLT117 have', 'show me Utopia's sneakers') or wants to browse a shop they read about. boutique_domain is the domain shown on any boutique or piece.
| Name | Type | Req | Description |
|---|---|---|---|
| boutique_domain | string | yes | The boutique's domain, as shown on boutiques and pieces (e.g. 'utopia-kicks.myshopify.com'). |
| limit | integer | – | Default 12. |
| offset | integer | – | – |
| query | string | – | Search inside this boutique only. |
| Name | Type | Req | Description |
|---|---|---|---|
| boutique | – | yes | – |
| next_offset | – | yes | – |
| pieces | array | yes | – |
| view_url | string | yes | – |
No examples provided.
convert_size Convert a size ~304
Turn a size in one system into every other system: rings, shoes, clothing, suits, belts and hats, or one designer's own chart (pass designer as its slug, e.g. 'nike'). Answers only from the size tables on shopwithin.co/sizes, where every row comes from a named source with the day it was read, and returns the page that shows the answer. Use this when a shopper asks what their size is in another country's system, which size to take in a designer, or how a designer's sizes run. Call it without from and size to list the systems and tables a kind or a designer has.
| Name | Type | Req | Description |
|---|---|---|---|
| department | string | – | Optional: only women's or men's tables. |
| designer | string | – | A designer's slug, as in shopwithin.co/designers/<slug>, to read that designer's own charts instead of a kind. |
| from | string | – | The system the size is written in, as a key this tool lists, e.g. 'us', 'uk', 'eu'. |
| kind | string | – | What is being sized: rings, shoes, clothing, suits, belts or hats. |
| size | string | – | The size as printed, e.g. '7', 'N 1/2', '42', 'M'. |
| table | string | – | Optional: one table or chart id this tool lists. |
| to | string | – | Optional: one system key to lead the answer with. |
| Name | Type | Req | Description |
|---|---|---|---|
| designers | array | yes | – |
| kinds | array | yes | – |
| matches | array | yes | – |
| note | – | yes | – |
| page_url | string | yes | – |
| scope | – | yes | – |
| size_page_url | – | – | – |
| sources | array | yes | – |
| status | string | yes | – |
| systems | array | yes | – |
| tables | array | yes | – |
No examples provided.
estimate_duty Estimate import duty ~582
Work out what a piece of clothing, a pair of shoes, a bag, jewellery, a watch or an accessory costs at the door when it is shipped to the US, Canada, the UK or Australia: the duty, any extra tariff on the country it was made in, the tax, the government and carrier fees, and the total. Every line names its official source and the day it was read, and the answer links the page on shopwithin.co/duty-calculator that shows it. Use this when a shopper asks about customs, duty, tariffs or import tax on a cross-border order. It is an estimate; the carrier's bill is the final word.
| Name | Type | Req | Description |
|---|---|---|---|
| currency | string | yes | The currency of the price. |
| department | string | – | Women's or men's; some duty rates differ. |
| kind | string | yes | What the piece is, one of: coat-wool, coat-cotton, coat-polyester, puffer-down, jacket-wool, jacket-cotton, jacket-polyester, jacket-leather, blazer-wool, blazer-cotton, blazer-polyester, trousers-wo… |
| made_in | string | yes | Two letter country code of where it was made, e.g. IT, FR, CA, US, JP. |
| price | number | yes | The price, without shipping. |
| region | string | – | Canada only: the province code, e.g. ON, QC, BC. |
| ship_by | string | – | us: fedex, courier or post. canada: fedex, courier or post. uk: royalmail, parcelforce or courier. australia: courier or post. |
| shipping | number | – | Optional shipping cost, in the price's currency. |
| ships_from | string | yes | Two letter country code of where it ships from. |
| to | string | yes | Where the piece is shipped to. |
| usmca | boolean | – | US only: true if a piece made in Canada or Mexico qualifies under USMCA. |
| weight_kg | number | – | Optional weight; a few US lines add a charge per kilogram. |
| Name | Type | Req | Description |
|---|---|---|---|
| currency | string | – | – |
| estimate_note | string | – | – |
| exchange_rate_date | – | – | – |
| found | boolean | – | – |
| lines | array | – | – |
| note | – | – | – |
| notes | – | – | – |
| owed_before_delivery | – | – | – |
| page | string | – | – |
| status | string | – | – |
| tax_at_checkout | – | – | – |
| to | string | – | – |
| total | – | – | – |
| value | number | – | – |
| what_changes_it | – | – | – |
No examples provided.
get_piece Read one piece ~170
One piece in full: description, every size or variant with live stock, photographs, price and any markdown, whether it is collected in the shop or delivered, the boutique, the page to buy it, and a few pieces in the same vein. Use this when a shopper asks about a specific piece from a result, pastes a shopwithin.co link, or wants to know whether a size is in stock before buying. Identify the piece by url, or by boutique_domain and id from a previous result.
| Name | Type | Req | Description |
|---|---|---|---|
| boutique_domain | string | – | The piece's boutique_domain from a previous result. |
| id | string | – | The piece's id from a previous result. |
| url | string | – | A shopwithin.co piece link, e.g. https://shopwithin.co/product/<boutique>/<id>. |
| Name | Type | Req | Description |
|---|---|---|---|
| found | boolean | yes | – |
| piece | – | yes | – |
| similar | array | yes | – |
No examples provided.
list_boutiques The boutiques on within ~100
The independent luxury boutiques listed on within, with neighbourhood, city, how many pieces each has live, opening hours, and whether a shopper collects in the shop or can have pieces delivered. Use this when someone asks which shops are on within, what is in a city or neighbourhood, or where to visit in person. The returned domain identifies a boutique everywhere else.
| Name | Type | Req | Description |
|---|---|---|---|
| city | string | – | Only boutiques in this city, e.g. 'Toronto'. |
| Name | Type | Req | Description |
|---|---|---|---|
| boutiques | array | yes | – |
| cities | array | yes | – |
No examples provided.
search_pieces Search the boutiques' shelves ~481
Search pieces (clothing, shoes, bags, jewellery, watches, objects) in stock right now at independent luxury boutiques, with live sizes, price in the boutique's currency, the shop that holds each piece, and the shopwithin.co page to buy it. Use this when someone wants to find or compare a kind of piece, a designer's pieces at boutiques, a gift, or what is in stock in a city. A plain sentence works as the query (prices like 'under $400' and 'cheapest' are understood); brands, categories, sizes, boutiques, or city narrow it. With no arguments it returns the current front shelf; lens browses new arrivals, most saved, or marked down. Do not use for general style advice or for mass market retailers.
| Name | Type | Req | Description |
|---|---|---|---|
| boutiques | array | – | Boutique domains to restrict to, as shown on boutiques and pieces (e.g. 'wdlt117.myshopify.com'). |
| brands | array | – | Designer or house names to restrict to, exactly as they appear in results. |
| categories | array | – | Product types to restrict to, e.g. 'Sneakers', 'Bags'; take values from a previous result's facets. |
| city | string | – | Only boutiques in this city, e.g. 'Toronto'. If within has no boutiques there yet, the answer says so and names the live cities. |
| lens | string | – | Browse a shelf instead of searching: 'new' = just arrived, 'trending' = what people are saving, 'sale' = marked down. Ignored when a query or filters are given. |
| limit | integer | – | Pieces per page, default 12. |
| offset | integer | – | Pieces to skip; use next_offset from the previous page. |
| price_max | number | – | Highest price to include, in the boutique's currency. |
| price_min | number | – | Lowest price to include, in the boutique's currency. |
| query | string | – | What the shopper wants, in plain words: 'black leather loafers', 'Lemaire', 'a birthday gift for my dad under $300'. |
| sizes | array | – | Sizes that must be in stock, as labelled on the shelf: 'M', '42', 'US 9', 'IT 38'. |
| sort | string | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| facets | – | yes | – |
| next_offset | – | yes | – |
| note | – | yes | – |
| pieces | array | yes | – |
| related_searches | array | yes | – |
| total | – | yes | – |
| total_is_floor | boolean | yes | – |
| view_url | string | yes | – |
No examples provided.
similar_pieces Pieces in the same vein ~103
Pieces in the same vein as one piece: same spirit, same department, across every boutique, in stock now. Use this when a shopper likes a piece but wants alternatives, another price, or another shop. Identify the anchor piece by url, or by boutique_domain and id.
| Name | Type | Req | Description |
|---|---|---|---|
| boutique_domain | string | – | – |
| id | string | – | – |
| limit | integer | – | Default 8. |
| url | string | – | A shopwithin.co piece link. |
| Name | Type | Req | Description |
|---|---|---|---|
| anchor | – | yes | – |
| pieces | array | yes | – |
No examples provided.
trending_now What is trending this week ~233
within's chart of the designer pieces trending at independent boutiques this week, updated daily: the top ten in order, each with its reason (Google searches, Pinterest searches, what boutiques worldwide are stocking, what people look at on within), its place last week and its weeks on the list, plus the designers of the week. Use this when someone asks what is trending in designer or luxury fashion right now, which designers or pieces are hot this week, or what is trending in a kind of piece (sneakers, bags, jackets, boots, jewelry…). dept narrows to women or men; kind to one kind of piece. Each piece has a url to buy it. Do not use for mass market retailers or for last year's trends.
| Name | Type | Req | Description |
|---|---|---|---|
| dept | string | – | The women's or the men's chart; leave out for everyone's. |
| kind | string | – | One kind of piece, e.g. 'sneakers', 'bags', 'jackets', 'boots', 'jewelry', 'dresses'. |
| limit | integer | – | How many places to return, up to ten, default 10. |
| Name | Type | Req | Description |
|---|---|---|---|
| as_of | – | yes | – |
| designers | array | yes | – |
| items | array | yes | – |
| json | string | yes | – |
| kinds | array | yes | – |
| past_weeks | array | yes | – |
| title | string | yes | – |
| url | string | yes | – |
| week | – | yes | – |
No examples provided.
visual_search Find it from a photograph ~252
Pieces on the boutiques' shelves that resemble a photograph: a screenshot, a street style shot, a product photo, or a TikTok or Pinterest link. Answers in two tiers: pieces close enough to be the same or a near twin, and pieces in the same spirit. Use this when a shopper shares an image of something they want to find or 'something like this'. Pass image_url for a direct image, image_base64 with media_type for an uploaded file, or post_url for a TikTok or Pinterest link. Photographs are matched in memory and never stored. Do not use for Instagram links; they cannot be read, so ask for a screenshot instead.
| Name | Type | Req | Description |
|---|---|---|---|
| image_base64 | string | – | The image bytes, base64 encoded (under 1.5 MB decoded). |
| image_file | object | – | A photograph the shopper uploaded in the chat; the host passes the file here. |
| image_url | string | – | A direct, publicly reachable JPEG, PNG or WebP URL (under 1.5 MB). |
| media_type | string | – | Required with image_base64. |
| post_url | string | – | A TikTok or Pinterest post link; the photograph is read from the post. |
| Name | Type | Req | Description |
|---|---|---|---|
| close | array | yes | – |
| in_spirit | array | yes | – |
| note | – | yes | – |
No examples provided.
How do I install the within · luxury boutiques MCP server?
within · luxury boutiques is a hosted endpoint at https://shopwithin.co/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · shopwithin.co
claude mcp add --transport http co-shopwithin-within 'https://shopwithin.co/mcp'
What is the within · luxury boutiques MCP server?
within · luxury boutiques is an MCP server listed in the public MCP registry as co.shopwithin/within. Live stock at independent luxury boutiques: pieces, sizes, prices and the page to buy each one. This page covers its hosted endpoint (https://shopwithin.co/mcp).
Is the within · luxury boutiques MCP server safe to use?
within · luxury boutiques scores 74 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the within · luxury boutiques MCP server expose?
within · luxury boutiques exposes 9 tools: search_pieces, get_piece, trending_now, similar_pieces, list_boutiques, and 4 more. Their descriptions and schemas cost roughly 2,366 tokens of context every time the server is loaded.
Does the within · luxury boutiques MCP server require authentication?
No. We connected to within · luxury boutiques without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.
Is the within · luxury boutiques MCP server still maintained?
within · luxury boutiques is still listed as active in the MCP registry. We last reached this channel on 24 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.