io.github.gokhancvs/market-fiyati-mcp
NPM · MARKET-FIYATI-MCP
Unofficial stdio MCP for Turkish grocery prices, branch offers and basket comparisons.
Available components
Last scanned (3 hours ago)
Scores higher than 62% of npm servers
Category E-commerce
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security81
- No malware found by supply-chain analysis.Pass
- CVE check failed: a known high-severity CVE affects zod 4.6.5, a direct dependency. A fixed version is available. View diagnostics → Fail
- No install/post-install scripts declared.Pass
- 30 of 93 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency100
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Cryptographically verified build provenance (signed, bound to gokhancvs/market-fiyati-mcp). View diagnostics → Pass
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 16 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability74
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 2474 tokens (~137/item across 18 items; 15 tools + 3 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management33
- Stability observed for 10 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage89
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 61% of tool parameters carry a description.Partial
- Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 15 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 17 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 24 Oct 26 −5
- CVE-2023-54404 affects this package: high ▼ security
- Known CVEs: pass → fail ▼ security
- 22 Oct 26 +4
- Stability: unverified → 0.27 ▲ functional
- 14 Oct 26 +31
- Injection markers: unverified → pass ▲ security
- First check of Judged manipulation: pass security
- Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window). security
- Tool coverage: unverified → 100 ▲ functional
- Schema quality: unverified → 100 ▲ functional
- MCP protocol: unverified → pass ▲ functional
- First check of Schema quality: fail functional
- First check of Destructive annotations: pass functional
- First check of Schema quality: fail functional
- First check of Tool coverage: 61 functional
- First check of Schema quality: good functional
- First check of Tool coverage: 100 functional
- 8 Oct 26 49
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 24 Oct 2026 · Analysed npm/market-fiyati-mcp@2.0.1
Provenance Verified
A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.
| Result | Verified |
|---|---|
| Ecosystem | npm |
| Reason | Verified |
| Discovered via | Registry attestation endpoint |
| Source repo | gokhancvs/market-fiyati-mcp |
| Certificate issuer | https://token.actions.githubusercontent.com |
| Certificate SAN | https://github.com/gokhancvs/market-fiyati-mcp/.github/workflows/release.yml@refs/tags/v2.0.1 |
| Rekor log index | 3129942789 |
| Predicate type | SLSA build provenance https://slsa.dev/provenance/v1 |
| Subject digest | sha512:dd7a409c38ce6025ef59f3e6e393db03ba8710d19895adf4647253c8d85a8fec925abde990a99170c6c8c0c64cb45617ee8d1ea32c81344371e7bb99c |
Background: How many MCP packages publish verified provenance →
Vulnerabilities 1 finding
| ID | CVE | Severity | Vector | Fix available |
|---|---|---|---|---|
| GHSA-mrhx-c7xc-m3w5 | CVE-2023-54404 | high | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | yes |
Background: What a vulnerability scan can and cannot prove →
Dependencies 93 packages
| Packages resolved | 93 |
|---|---|
| Stale | 30 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
market_compare_basket ~588
Compare exact product IDs and pack quantities with one product lookup per item. This description is the single source for basket rules. Budget: read market_status limits.basketItems and limits.basketRequestBudget first; the budget counts every possible HTTP retry and over-budget calls are rejected before any lookup. Never split the list into several calls or switch to sync or other tools to bypass it. Ask the user to narrow the comparison, or explain search offers already returned with their original retrieval time; never present a shortened basket as complete. For a brand-agnostic list, exact IDs fix one product per item: say which products the basket covers, and label any sum of search offers as an estimate with each offer depot and retrievedAt, not a basket total. Reuse sufficient search offers instead of redundant lookups. Results: quantities are packs of the selected product; alternatives are never substituted; a missing item makes total null, never zero. groupBy=market may span branches; groupBy=depot means one physical shop. Check selected offer depot IDs and requiresMultipleDepots before claiming one physical shop; a chain name alone is insufficient. A complete basket covers the selected IDs, not proof that they meet every user requirement; equal prices do not prove equivalent products. Presentation: present complete groups first, using total rather than an incomplete subtotal, and lead with the cheapest complete group the answer contains; splitBasket stays separate. Show all groups tied at the lowest total, naming each market or depot; the first sorted group is not the sole winner. For long lists, summarize branches by chain and disclose the shortened display and omitted group count. Explain any preference among tied options with evidence or stated user preferences; depot-ID ordering does not mean nearest or best, and branch distance is not a walking route or the total shopping journey. splitBasket: a theoretical multi-shop minimum without travel, delivery…
| Name | Type | Req | Description |
|---|---|---|---|
| depots | array | yes | Selected branch IDs from nearest; required and never auto-expanded. |
| distance | number | yes | Required search radius in km. 50 is a local safety limit. |
| groupBy | string | – | – |
| items | array | yes | – |
| latitude | number | yes | Explicit user-selected latitude. |
| longitude | number | yes | Explicit longitude. |
| Name | Type | Req | Description |
|---|---|---|---|
| data | – | yes | – |
| error | object | – | – |
| meta | object | yes | – |
| warnings | array | yes | – |
No examples provided.
market_compare_product_offers ~132
Fetch one product and compare returned branch prices. Use when a detail lookup or refresh is needed; existing search offers can already answer price questions. Reports cheapest branches, price spread and promotional fields. Zero prices are unavailable. Follow market://guide for the discount flag and percentage field.
| Name | Type | Req | Description |
|---|---|---|---|
| depots | array | yes | Selected branch IDs from nearest; required and never auto-expanded. |
| distance | number | yes | Required search radius in km. 50 is a local safety limit. |
| identity | string | yes | – |
| latitude | number | yes | Explicit user-selected latitude. |
| longitude | number | yes | Explicit longitude. |
| Name | Type | Req | Description |
|---|---|---|---|
| data | – | yes | – |
| error | object | – | – |
| meta | object | yes | – |
| warnings | array | yes | – |
No examples provided.
market_find_alternatives ~145
Find substitutes at one market chain. Experimental. marketName must match each supplied depot ID prefix; provide original id and product title as keywords.
| Name | Type | Req | Description |
|---|---|---|---|
| depots | array | yes | Selected branch IDs from nearest; required and never auto-expanded. |
| distance | number | yes | Required search radius in km. 50 is a local safety limit. |
| id | string | yes | – |
| keywords | string | yes | – |
| latitude | number | yes | Explicit user-selected latitude. |
| longitude | number | yes | Explicit longitude. |
| marketName | string | yes | – |
| pages | integer | – | Zero-based API page. |
| size | integer | – | Page size, local maximum 100. |
| Name | Type | Req | Description |
|---|---|---|---|
| data | – | yes | – |
| error | object | – | – |
| meta | object | yes | – |
| warnings | array | yes | – |
No examples provided.
market_find_nearby_depots ~145
Find nearby physical branches using call coordinates/radius or configured env location. All three values must be supplied by one of these sources. Experimental. Response distance is meters from the API; its measurement method is undocumented and it is not a walking or driving route. The returned list is not proven exhaustive; one live session (2026-10-07) returned at most 5 branches per chain, which is not guaranteed. Choose returned depot IDs for product queries.
| Name | Type | Req | Description |
|---|---|---|---|
| distance | number | yes | Required search radius in km. 50 is a local safety limit. |
| latitude | number | yes | Explicit user-selected latitude. |
| longitude | number | yes | Explicit longitude. |
| Name | Type | Req | Description |
|---|---|---|---|
| data | – | yes | – |
| error | object | – | – |
| meta | object | yes | – |
| warnings | array | yes | – |
No examples provided.
market_find_similar_products ~135
Find related products using exact product id and its title as keywords. Similarity is not equivalence: inspect title and package size.
| Name | Type | Req | Description |
|---|---|---|---|
| depots | array | yes | Selected branch IDs from nearest; required and never auto-expanded. |
| distance | number | yes | Required search radius in km. 50 is a local safety limit. |
| id | string | yes | – |
| keywords | string | yes | – |
| latitude | number | yes | Explicit user-selected latitude. |
| longitude | number | yes | Explicit longitude. |
| pages | integer | – | Zero-based API page. |
| size | integer | – | Page size, local maximum 100. |
| Name | Type | Req | Description |
|---|---|---|---|
| data | – | yes | – |
| error | object | – | – |
| meta | object | yes | – |
| warnings | array | yes | – |
No examples provided.
market_geocode_address ~48
Find address suggestions. Experimental map API. Returns display_name and explicit latitude/longitude parsed from API tuple positions.
| Name | Type | Req | Description |
|---|---|---|---|
| words | string | yes | Address/place text; encoded as a query parameter. |
| Name | Type | Req | Description |
|---|---|---|---|
| data | – | yes | – |
| error | object | – | – |
| meta | object | yes | – |
| warnings | array | yes | – |
No examples provided.
market_get_categories ~53
Get hierarchical categories. query, parentId and flat are local filters. Use returned Turkish names for category searches.
| Name | Type | Req | Description |
|---|---|---|---|
| flat | boolean | – | – |
| parentId | integer | – | – |
| query | string | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| data | – | yes | – |
| error | object | – | – |
| meta | object | yes | – |
| warnings | array | yes | – |
No examples provided.
market_get_price_history ~145
Get market price series for one product: uniqueId is the product id from search or product results. Prefer the depot IDs returned for that product. Optional from/to (YYYY-MM-DD) filter locally; returns chronological series and change statistics.
| Name | Type | Req | Description |
|---|---|---|---|
| depots | array | yes | Selected branch IDs from nearest; required and never auto-expanded. |
| distance | number | yes | Required search radius in km. 50 is a local safety limit. |
| from | string | – | – |
| latitude | number | yes | Explicit user-selected latitude. |
| longitude | number | yes | Explicit longitude. |
| to | string | – | – |
| uniqueId | string | yes | Product id from search or product results. |
| Name | Type | Req | Description |
|---|---|---|---|
| data | – | yes | – |
| error | object | – | – |
| meta | object | yes | – |
| warnings | array | yes | – |
No examples provided.
market_get_product ~102
Get one product by its opaque product id. Returns location-specific branch offers, promotional fields and indexTime. Barcode lookup is not supported.
| Name | Type | Req | Description |
|---|---|---|---|
| depots | array | yes | Selected branch IDs from nearest; required and never auto-expanded. |
| distance | number | yes | Required search radius in km. 50 is a local safety limit. |
| identity | string | yes | – |
| latitude | number | yes | Explicit user-selected latitude. |
| longitude | number | yes | Explicit longitude. |
| Name | Type | Req | Description |
|---|---|---|---|
| data | – | yes | – |
| error | object | – | – |
| meta | object | yes | – |
| warnings | array | yes | – |
No examples provided.
market_list_markets ~63
List market chains via /api/v1/categories. Experimental. Optional, never a prerequisite for search or comparison. If it returns HTTP 500, do not retry; report the chains' active status as unknown and continue with other tools. Not the product category tree.
Input schema present but exposes no named parameters.
| Name | Type | Req | Description |
|---|---|---|---|
| data | – | yes | – |
| error | object | – | – |
| meta | object | yes | – |
| warnings | array | yes | – |
No examples provided.
market_reverse_geocode ~65
Resolve coordinates into address fields and display_name, the nearest address estimate for that point, not a verified address. Experimental map API. Uses capitalized Lat and Lon query parameters.
| Name | Type | Req | Description |
|---|---|---|---|
| latitude | number | yes | Explicit user-selected latitude. |
| longitude | number | yes | Explicit longitude. |
| Name | Type | Req | Description |
|---|---|---|---|
| data | – | yes | – |
| error | object | – | – |
| meta | object | yes | – |
| warnings | array | yes | – |
No examples provided.
market_search_by_category ~246
Search using menu_category, main_category or sub_category Turkish names from the category tree. At least one nonempty category filter and call or configured location and explicit depots required.
| Name | Type | Req | Description |
|---|---|---|---|
| brand | array | – | – |
| depots | array | yes | Selected branch IDs from nearest; required and never auto-expanded. |
| distance | number | yes | Required search radius in km. 50 is a local safety limit. |
| latitude | number | yes | Explicit user-selected latitude. |
| longitude | number | yes | Explicit longitude. |
| main_category | array | – | – |
| market_names | array | – | – |
| menu_category | array | – | – |
| offer_discount | array | – | API discount filter ["true"]; matching does not override each offer's discount flag or confirm campaign eligibility. Preserve false or absent flags and separate reference-price fields. Omit to includ… |
| offer_price | array | – | – |
| order | object | – | – |
| pages | integer | – | Zero-based API page. |
| refined_quantity_unit | array | – | – |
| refined_volume_weight | array | – | – |
| size | integer | – | Page size, local maximum 100. |
| sub_category | array | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| data | – | yes | – |
| error | object | – | – |
| meta | object | yes | – |
| warnings | array | yes | – |
No examples provided.
market_search_products ~282
Search products and facets, one zero-based page. Combine keywords with known API filters such as refined_volume_weight and order in one request. Location/radius come from the call or configured env; nonempty depots are required per call. Follow market://guide to preserve alternatives and exact requirements; fuzzy search still needs result validation.
| Name | Type | Req | Description |
|---|---|---|---|
| brand | array | – | – |
| depots | array | yes | Selected branch IDs from nearest; required and never auto-expanded. |
| distance | number | yes | Required search radius in km. 50 is a local safety limit. |
| keywords | string | yes | – |
| latitude | number | yes | Explicit user-selected latitude. |
| longitude | number | yes | Explicit longitude. |
| main_category | array | – | – |
| market_names | array | – | – |
| menu_category | array | – | – |
| offer_discount | array | – | API discount filter ["true"]; matching does not override each offer's discount flag or confirm campaign eligibility. Preserve false or absent flags and separate reference-price fields. Omit to includ… |
| offer_price | array | – | – |
| order | object | – | – |
| pages | integer | – | Zero-based API page. |
| refined_quantity_unit | array | – | – |
| refined_volume_weight | array | – | – |
| size | integer | – | Page size, local maximum 100. |
| sub_category | array | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| data | – | yes | – |
| error | object | – | – |
| meta | object | yes | – |
| warnings | array | yes | – |
No examples provided.
market_status ~43
Report mode, live and experimental access, whether env location is configured, local limits, request policy and endpoint counts. market://endpoints lists the routes. No network access.
Input schema present but exposes no named parameters.
| Name | Type | Req | Description |
|---|---|---|---|
| data | – | yes | – |
| error | object | – | – |
| meta | object | yes | – |
| warnings | array | yes | – |
No examples provided.
market_sync_products ~121
Fetch up to 100 product identities in one call for an explicitly requested refresh. Experimental. Never switch to this tool to bypass a basket budget or run large live tests. identities are product ids. No purchase or persistent basket mutation.
| Name | Type | Req | Description |
|---|---|---|---|
| depots | array | yes | Selected branch IDs from nearest; required and never auto-expanded. |
| distance | number | yes | Required search radius in km. 50 is a local safety limit. |
| identities | array | yes | – |
| latitude | number | yes | Explicit user-selected latitude. |
| longitude | number | yes | Explicit longitude. |
| Name | Type | Req | Description |
|---|---|---|---|
| data | – | yes | – |
| error | object | – | – |
| meta | object | yes | – |
| warnings | array | yes | – |
No examples provided.
How do I install the io.github.gokhancvs/market-fiyati-mcp server?
io.github.gokhancvs/market-fiyati-mcp runs locally as an npm package, launched with npx -y market-fiyati-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · market-fiyati-mcp
claude mcp add gokhancvs-market-fiyati-mcp -- npx -y market-fiyati-mcp
What is the io.github.gokhancvs/market-fiyati-mcp server?
io.github.gokhancvs/market-fiyati-mcp is listed in the public MCP registry as io.github.gokhancvs/market-fiyati-mcp. Unofficial stdio MCP for Turkish grocery prices, branch offers and basket comparisons. This page covers its npm package (market-fiyati-mcp).
Is the io.github.gokhancvs/market-fiyati-mcp server safe to use?
io.github.gokhancvs/market-fiyati-mcp scores 79 out of 100 on VerifyMCP. We recorded 1 known advisory against it as of 24 October 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.gokhancvs/market-fiyati-mcp server expose?
io.github.gokhancvs/market-fiyati-mcp exposes 15 tools: market_status, market_get_categories, market_list_markets, market_find_nearby_depots, market_search_products, and 10 more. Their descriptions and schemas cost roughly 2,313 tokens of context every time the server is loaded.
Is the io.github.gokhancvs/market-fiyati-mcp server still maintained?
io.github.gokhancvs/market-fiyati-mcp is still listed as active in the MCP registry. We last reached this channel on 24 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the io.github.gokhancvs/market-fiyati-mcp server under?
io.github.gokhancvs/market-fiyati-mcp declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.