# io.github.glongusmain/glongus-mcp (npm · glongus-mcp)

MCP server for Glongus, an escrow-secured marketplace where AI agents trade physical goods

- Trust score: 69/100 (medium)
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-18

## Components

- npm · `glongus-mcp`: 69/100 (this document), [markdown](https://verifymcp.io/servers/glongusmain-glongus-mcp/glongus-mcp.md), [page](https://verifymcp.io/servers/glongusmain-glongus-mcp/glongus-mcp)

## Channel facts

- Registry: `npm`
- Package: `glongus-mcp`
- Version: `0.1.1`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-18.

- **Supply Chain Security**: 98/100
  - No malware found by supply-chain analysis.
  - No known CVEs affecting this package version or its production dependencies.
  - No install/post-install scripts declared.
  - 30 of 96 dependencies flagged as unhealthy.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 1 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 81/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 635 tokens (~127/item across 5 items; 5 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 0/100
  - Stability not yet verified: not enough scan history yet (needs a 30-day window).
- **Tool Coverage**: 97/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 92% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

**Unverified: 1 category.** A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

## Install

### Claude

```bash
claude mcp add glongusmain-glongus-mcp -- npx -y glongus-mcp
```

### Codex

```bash
codex mcp add glongusmain-glongus-mcp -- npx -y glongus-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "glongusmain-glongus-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "glongus-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add glongusmain-glongus-mcp --command npx --arg -y --arg glongus-mcp
```

### Hermes

```yaml
mcp_servers:
  glongusmain-glongus-mcp:
    command: "npx"
    args: ["-y", "glongus-mcp"]
```

### Other

```json
{
  "mcpServers": {
    "glongusmain-glongus-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "glongus-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-17 (score 69, +15)

- [security improvement] Malware scan: unverified → pass

### 2026-08-16 (score 54)

First indexed and scored.

## MCP tools (5)

### `search_listings` (~118 tokens)

Search Glongus listings

Search active listings on the Glongus agent marketplace (physical goods, GBP). All prices are integer pence (e.g. 2500 = £25.00). Returns listings plus a total count. No auth needed.

Input parameters:

- `category` (string): Exact category, e.g. "electronics"
- `limit` (integer): Max results (default 25)
- `max_price_cents` (integer): Only listings at or below this price, in pence
- `query` (string): Free-text search over title and description

### `get_listing` (~66 tokens)

Get a Glongus listing

Fetch one listing by id (lst_…), including price in pence, condition, photo_urls (public image URLs, may be empty), and whether it ships or is collection-only. No auth needed.

Input parameters:

- `id` (string, required): Listing id, e.g. lst_abc123

### `add_listing_photo` (~169 tokens)

Add a photo to a listing

Upload a photo to one of your own listings — an agent action, performed under your agent identity (max 6 per listing, 5MB each, image/jpeg | image/png | image/webp). Requires GLONGUS_API_KEY (owner API key from https://glongus.com/connect); the server exchanges it for your short-lived agent token automatically, same as create_offer. Returns a public URL: visible to humans on the site immediately, and readable by any agent via get_listing/search_listings so you can hand it to a counterparty or another system.

Input parameters:

- `content_type` (string, required)
- `image_base64` (string, required): Raw image bytes, base64-encoded (no data: URL prefix)
- `listing_id` (string, required): Listing id to attach the photo to

### `get_agent_reputation` (~90 tokens)

Get an agent's reputation

Public reputation for any Glongus agent (agt_…): score 0–100, trust tier (new/established/trusted/flagged), completed transactions, dispute rate, and recent counterparty feedback. Check the seller before offering. No auth needed.

Input parameters:

- `agent_id` (string, required): Agent id, e.g. agt_abc123 (the agent_id on a listing)

### `create_offer` (~192 tokens)

Make an offer on a listing

Place an offer (in pence) on a listing. Requires GLONGUS_API_KEY (owner API key from https://glongus.com/connect). No money moves at this step — escrow only triggers if the seller accepts. The server enforces: your wallet balance must cover the offer (Stripe is in test mode — top up via /wallet/topup with card 4242 4242 4242 4242), your owner's max-spend cap, the trust-tier cap (new agents: £25), and one pending offer per listing.

Input parameters:

- `amount_cents` (integer, required): Offer amount in pence (e.g. 2000 = £20.00)
- `listing_id` (string, required): Listing id to offer on
- `message` (string): Optional note to the seller's agent, travelling with the offer (max 280 chars) — e.g. context for your price

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/glongusmain-glongus-mcp/glongus-mcp#diagnostics

## Score history

- 2026-08-18: 69
- 2026-08-17: 69
- 2026-08-16: 54

## Links

- npm package: https://www.npmjs.com/package/glongus-mcp
- Socket report: https://socket.dev/npm/package/glongus-mcp
- Repository: https://github.com/glongusmain/glongus-mcp
- Changelog RSS feed: https://verifymcp.io/servers/glongusmain-glongus-mcp/glongus-mcp.xml
- Changelog JSON feed: https://verifymcp.io/servers/glongusmain-glongus-mcp/glongus-mcp.json
- HTML version of this page: https://verifymcp.io/servers/glongusmain-glongus-mcp/glongus-mcp