# io.github.gokhancvs/market-fiyati-mcp (npm · market-fiyati-mcp)

Unofficial stdio MCP for Turkish grocery prices, branch offers and basket comparisons.

- Trust score: 79/100 (medium)
- Change this week: −1
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-10-24

## Components

- npm · `market-fiyati-mcp`: 79/100 (this document), [markdown](https://verifymcp.io/servers/gokhancvs-market-fiyati-mcp/market-fiyati-mcp.md), [page](https://verifymcp.io/servers/gokhancvs-market-fiyati-mcp/market-fiyati-mcp)

## Channel facts

- Registry: `npm`
- Package: `market-fiyati-mcp`
- Version: `2.0.1`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-10-24.

- **Supply Chain Security**: 81/100
  - No malware found by supply-chain analysis.
  - CVE check failed: a known high-severity CVE affects zod 4.6.5, a direct dependency. A fixed version is available.
  - No install/post-install scripts declared.
  - 30 of 93 dependencies flagged as unhealthy.
- **Provenance & Transparency**: 100/100
  - Source repository is publicly reachable at the declared URL.
  - Cryptographically verified build provenance (signed, bound to gokhancvs/market-fiyati-mcp).
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 16 days ago).
  - Publishes a security disclosure policy (SECURITY.md).
- **Schema Quality & AI Usability**: 74/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (good).
  - Context-footprint check failed: tool/resource definitions use about 2474 tokens (~137/item across 18 items; 15 tools + 3 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 33/100
  - Stability observed for 10 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 89/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 61% of tool parameters carry a description.
  - Structured output schemas are declared (100% of tools); any adoption earns full credit.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - We read all 15 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 17 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### How do I install the io.github.gokhancvs/market-fiyati-mcp server?

io.github.gokhancvs/market-fiyati-mcp runs locally as an npm package, launched with npx -y market-fiyati-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add gokhancvs-market-fiyati-mcp -- npx -y market-fiyati-mcp
```

### Cursor

```json
{
  "mcpServers": {
    "gokhancvs-market-fiyati-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "market-fiyati-mcp"
      ]
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "gokhancvs-market-fiyati-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "market-fiyati-mcp"
      ]
    }
  }
}
```

### Codex

```bash
codex mcp add gokhancvs-market-fiyati-mcp -- npx -y market-fiyati-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "gokhancvs-market-fiyati-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "market-fiyati-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add gokhancvs-market-fiyati-mcp --command npx --arg -y --arg market-fiyati-mcp
```

### Hermes

```yaml
mcp_servers:
  gokhancvs-market-fiyati-mcp:
    command: "npx"
    args: ["-y", "market-fiyati-mcp"]
```

### Netclaw

```json
{
  "McpServers": {
    "gokhancvs-market-fiyati-mcp": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "market-fiyati-mcp"
      ]
    }
  }
}
```

### Vellum

```bash
assistant mcp add gokhancvs-market-fiyati-mcp -t stdio -c npx -a -y market-fiyati-mcp
```

### Other

```json
{
  "mcpServers": {
    "gokhancvs-market-fiyati-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "market-fiyati-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-10-24 (score 79, −5)

- [security regression] CVE-2023-54404 affects this package: high
- [security regression] Known CVEs: pass → fail

### 2026-10-22 (score 84, +4)

- [functional improvement] Stability: unverified → 0.27

### 2026-10-14 (score 80, +31)

- [security improvement] Injection markers: unverified → pass
- [security] First check of Judged manipulation: pass
- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional improvement] Tool coverage: unverified → 100
- [functional improvement] Schema quality: unverified → 100
- [functional improvement] MCP protocol: unverified → pass
- [functional] First check of Schema quality: fail
- [functional] First check of Destructive annotations: pass
- [functional] First check of Schema quality: fail
- [functional] First check of Tool coverage: 61
- [functional] First check of Schema quality: good
- [functional] First check of Tool coverage: 100

### 2026-10-08 (score 49)

First indexed and scored.

## MCP tools (15)

### `market_status` (~43 tokens)

Report mode, live and experimental access, whether env location is configured, local limits, request policy and endpoint counts. market://endpoints lists the routes. No network access.

Output parameters:

- `data`
- `error` (object)
- `meta` (object)
- `warnings` (array)

### `market_get_categories` (~53 tokens)

Get hierarchical categories. query, parentId and flat are local filters. Use returned Turkish names for category searches.

Input parameters:

- `flat` (boolean)
- `parentId` (integer)
- `query` (string)

Output parameters:

- `data`
- `error` (object)
- `meta` (object)
- `warnings` (array)

### `market_list_markets` (~63 tokens)

List market chains via /api/v1/categories. Experimental. Optional, never a prerequisite for search or comparison. If it returns HTTP 500, do not retry; report the chains' active status as unknown and continue with other tools. Not the product category tree.

Output parameters:

- `data`
- `error` (object)
- `meta` (object)
- `warnings` (array)

### `market_find_nearby_depots` (~145 tokens)

Find nearby physical branches using call coordinates/radius or configured env location. All three values must be supplied by one of these sources. Experimental. Response distance is meters from the API; its measurement method is undocumented and it is not a walking or driving route. The returned list is not proven exhaustive; one live session (2026-10-07) returned at most 5 branches per chain, which is not guaranteed. Choose returned depot IDs for product queries.

Input parameters:

- `distance` (number, required): Required search radius in km. 50 is a local safety limit.
- `latitude` (number, required): Explicit user-selected latitude.
- `longitude` (number, required): Explicit longitude.

Output parameters:

- `data`
- `error` (object)
- `meta` (object)
- `warnings` (array)

### `market_search_products` (~282 tokens)

Search products and facets, one zero-based page. Combine keywords with known API filters such as refined_volume_weight and order in one request. Location/radius come from the call or configured env; nonempty depots are required per call. Follow market://guide to preserve alternatives and exact requirements; fuzzy search still needs result validation.

Input parameters:

- `brand` (array)
- `depots` (array, required): Selected branch IDs from nearest; required and never auto-expanded.
- `distance` (number, required): Required search radius in km. 50 is a local safety limit.
- `keywords` (string, required)
- `latitude` (number, required): Explicit user-selected latitude.
- `longitude` (number, required): Explicit longitude.
- `main_category` (array)
- `market_names` (array)
- `menu_category` (array)
- `offer_discount` (array): API discount filter ["true"]; matching does not override each offer's discount flag or confirm campaign eligibility. Preserve false or absent flags and separate reference-price fields. Omit to includ…
- `offer_price` (array)
- `order` (object)
- `pages` (integer): Zero-based API page.
- `refined_quantity_unit` (array)
- `refined_volume_weight` (array)
- `size` (integer): Page size, local maximum 100.
- `sub_category` (array)

Output parameters:

- `data`
- `error` (object)
- `meta` (object)
- `warnings` (array)

### `market_search_by_category` (~246 tokens)

Search using menu_category, main_category or sub_category Turkish names from the category tree. At least one nonempty category filter and call or configured location and explicit depots required.

Input parameters:

- `brand` (array)
- `depots` (array, required): Selected branch IDs from nearest; required and never auto-expanded.
- `distance` (number, required): Required search radius in km. 50 is a local safety limit.
- `latitude` (number, required): Explicit user-selected latitude.
- `longitude` (number, required): Explicit longitude.
- `main_category` (array)
- `market_names` (array)
- `menu_category` (array)
- `offer_discount` (array): API discount filter ["true"]; matching does not override each offer's discount flag or confirm campaign eligibility. Preserve false or absent flags and separate reference-price fields. Omit to includ…
- `offer_price` (array)
- `order` (object)
- `pages` (integer): Zero-based API page.
- `refined_quantity_unit` (array)
- `refined_volume_weight` (array)
- `size` (integer): Page size, local maximum 100.
- `sub_category` (array)

Output parameters:

- `data`
- `error` (object)
- `meta` (object)
- `warnings` (array)

### `market_get_product` (~102 tokens)

Get one product by its opaque product id. Returns location-specific branch offers, promotional fields and indexTime. Barcode lookup is not supported.

Input parameters:

- `depots` (array, required): Selected branch IDs from nearest; required and never auto-expanded.
- `distance` (number, required): Required search radius in km. 50 is a local safety limit.
- `identity` (string, required)
- `latitude` (number, required): Explicit user-selected latitude.
- `longitude` (number, required): Explicit longitude.

Output parameters:

- `data`
- `error` (object)
- `meta` (object)
- `warnings` (array)

### `market_find_similar_products` (~135 tokens)

Find related products using exact product id and its title as keywords. Similarity is not equivalence: inspect title and package size.

Input parameters:

- `depots` (array, required): Selected branch IDs from nearest; required and never auto-expanded.
- `distance` (number, required): Required search radius in km. 50 is a local safety limit.
- `id` (string, required)
- `keywords` (string, required)
- `latitude` (number, required): Explicit user-selected latitude.
- `longitude` (number, required): Explicit longitude.
- `pages` (integer): Zero-based API page.
- `size` (integer): Page size, local maximum 100.

Output parameters:

- `data`
- `error` (object)
- `meta` (object)
- `warnings` (array)

### `market_find_alternatives` (~145 tokens)

Find substitutes at one market chain. Experimental. marketName must match each supplied depot ID prefix; provide original id and product title as keywords.

Input parameters:

- `depots` (array, required): Selected branch IDs from nearest; required and never auto-expanded.
- `distance` (number, required): Required search radius in km. 50 is a local safety limit.
- `id` (string, required)
- `keywords` (string, required)
- `latitude` (number, required): Explicit user-selected latitude.
- `longitude` (number, required): Explicit longitude.
- `marketName` (string, required)
- `pages` (integer): Zero-based API page.
- `size` (integer): Page size, local maximum 100.

Output parameters:

- `data`
- `error` (object)
- `meta` (object)
- `warnings` (array)

### `market_get_price_history` (~145 tokens)

Get market price series for one product: uniqueId is the product id from search or product results. Prefer the depot IDs returned for that product. Optional from/to (YYYY-MM-DD) filter locally; returns chronological series and change statistics.

Input parameters:

- `depots` (array, required): Selected branch IDs from nearest; required and never auto-expanded.
- `distance` (number, required): Required search radius in km. 50 is a local safety limit.
- `from` (string)
- `latitude` (number, required): Explicit user-selected latitude.
- `longitude` (number, required): Explicit longitude.
- `to` (string)
- `uniqueId` (string, required): Product id from search or product results.

Output parameters:

- `data`
- `error` (object)
- `meta` (object)
- `warnings` (array)

### `market_sync_products` (~121 tokens)

Fetch up to 100 product identities in one call for an explicitly requested refresh. Experimental. Never switch to this tool to bypass a basket budget or run large live tests. identities are product ids. No purchase or persistent basket mutation.

Input parameters:

- `depots` (array, required): Selected branch IDs from nearest; required and never auto-expanded.
- `distance` (number, required): Required search radius in km. 50 is a local safety limit.
- `identities` (array, required)
- `latitude` (number, required): Explicit user-selected latitude.
- `longitude` (number, required): Explicit longitude.

Output parameters:

- `data`
- `error` (object)
- `meta` (object)
- `warnings` (array)

### `market_geocode_address` (~48 tokens)

Find address suggestions. Experimental map API. Returns display_name and explicit latitude/longitude parsed from API tuple positions.

Input parameters:

- `words` (string, required): Address/place text; encoded as a query parameter.

Output parameters:

- `data`
- `error` (object)
- `meta` (object)
- `warnings` (array)

### `market_reverse_geocode` (~65 tokens)

Resolve coordinates into address fields and display_name, the nearest address estimate for that point, not a verified address. Experimental map API. Uses capitalized Lat and Lon query parameters.

Input parameters:

- `latitude` (number, required): Explicit user-selected latitude.
- `longitude` (number, required): Explicit longitude.

Output parameters:

- `data`
- `error` (object)
- `meta` (object)
- `warnings` (array)

### `market_compare_product_offers` (~132 tokens)

Fetch one product and compare returned branch prices. Use when a detail lookup or refresh is needed; existing search offers can already answer price questions. Reports cheapest branches, price spread and promotional fields. Zero prices are unavailable. Follow market://guide for the discount flag and percentage field.

Input parameters:

- `depots` (array, required): Selected branch IDs from nearest; required and never auto-expanded.
- `distance` (number, required): Required search radius in km. 50 is a local safety limit.
- `identity` (string, required)
- `latitude` (number, required): Explicit user-selected latitude.
- `longitude` (number, required): Explicit longitude.

Output parameters:

- `data`
- `error` (object)
- `meta` (object)
- `warnings` (array)

### `market_compare_basket` (~588 tokens)

Compare exact product IDs and pack quantities with one product lookup per item. This description is the single source for basket rules. Budget: read market_status limits.basketItems and limits.basketRequestBudget first; the budget counts every possible HTTP retry and over-budget calls are rejected before any lookup. Never split the list into several calls or switch to sync or other tools to bypass it. Ask the user to narrow the comparison, or explain search offers already returned with their original retrieval time; never present a shortened basket as complete. For a brand-agnostic list, exact IDs fix one product per item: say which products the basket covers, and label any sum of search offers as an estimate with each offer depot and retrievedAt, not a basket total. Reuse sufficient search offers instead of redundant lookups. Results: quantities are packs of the selected product; alternatives are never substituted; a missing item makes total null, never zero. groupBy=market may span branches; groupBy=depot means one physical shop. Check selected offer depot IDs and requiresMultipleDepots before claiming one physical shop; a chain name alone is insufficient. A complete basket covers the selected IDs, not proof that they meet every user requirement; equal prices do not prove equivalent products. Presentation: present complete groups first, using total rather than an incomplete subtotal, and lead with the cheapest complete group the answer contains; splitBasket stays separate. Show all groups tied at the lowest total, naming each market or depot; the first sorted group is not the sole winner. For long lists, summarize branches by chain and disclose the shortened display and omitted group count. Explain any preference among tied options with evidence or stated user preferences; depot-ID ordering does not mean nearest or best, and branch distance is not a walking route or the total shopping journey. splitBasket: a theoretical multi-shop minimum without travel, delivery…

Input parameters:

- `depots` (array, required): Selected branch IDs from nearest; required and never auto-expanded.
- `distance` (number, required): Required search radius in km. 50 is a local safety limit.
- `groupBy` (string)
- `items` (array, required)
- `latitude` (number, required): Explicit user-selected latitude.
- `longitude` (number, required): Explicit longitude.

Output parameters:

- `data`
- `error` (object)
- `meta` (object)
- `warnings` (array)

## Diagnostics

Captured diagnostic sections: Provenance, Vulnerabilities, Dependencies. The full working is on the page: https://verifymcp.io/servers/gokhancvs-market-fiyati-mcp/market-fiyati-mcp#diagnostics

## Score history

- 2026-10-24: 79
- 2026-10-23: 84
- 2026-10-22: 84
- 2026-10-21: 80
- 2026-10-20: 80
- 2026-10-19: 80
- 2026-10-18: 80
- 2026-10-17: 80
- 2026-10-16: 80
- 2026-10-15: 80
- 2026-10-14: 80
- 2026-10-13: 49
- 2026-10-12: 49
- 2026-10-08: 49

## Common questions

### What is the io.github.gokhancvs/market-fiyati-mcp server?

io.github.gokhancvs/market-fiyati-mcp is listed in the public MCP registry as io.github.gokhancvs/market-fiyati-mcp. Unofficial stdio MCP for Turkish grocery prices, branch offers and basket comparisons. This page covers its npm package (market-fiyati-mcp).

### Is the io.github.gokhancvs/market-fiyati-mcp server safe to use?

io.github.gokhancvs/market-fiyati-mcp scores 79 out of 100 on VerifyMCP. We recorded 1 known advisory against it as of 24 October 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the io.github.gokhancvs/market-fiyati-mcp server expose?

io.github.gokhancvs/market-fiyati-mcp exposes 15 tools: market_status, market_get_categories, market_list_markets, market_find_nearby_depots, market_search_products, and 10 more. Their descriptions and schemas cost roughly 2,313 tokens of context every time the server is loaded.

### Is the io.github.gokhancvs/market-fiyati-mcp server still maintained?

io.github.gokhancvs/market-fiyati-mcp is still listed as active in the MCP registry. We last reached this channel on 24 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What licence is the io.github.gokhancvs/market-fiyati-mcp server under?

io.github.gokhancvs/market-fiyati-mcp declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.

## Links

- npm package: https://www.npmjs.com/package/market-fiyati-mcp
- Socket report: https://socket.dev/npm/package/market-fiyati-mcp
- Repository: https://github.com/gokhancvs/market-fiyati-mcp
- Changelog RSS feed: https://verifymcp.io/servers/gokhancvs-market-fiyati-mcp/market-fiyati-mcp.xml
- Changelog JSON feed: https://verifymcp.io/servers/gokhancvs-market-fiyati-mcp/market-fiyati-mcp.json
- HTML version of this page: https://verifymcp.io/servers/gokhancvs-market-fiyati-mcp/market-fiyati-mcp