# io.github.maraventano/map (npm · @maraventano/map)

A subtractive MCP for agent commerce: read · pay · publish. Teacher, not butler.

- Trust score: 66/100 (medium)
- Change this week: +38
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-07

## Components

- npm · `@maraventano/map`: 66/100 (this document), [markdown](https://verifymcp.io/servers/maraventano-map/maraventano-map.md), [page](https://verifymcp.io/servers/maraventano-map/maraventano-map)

## Channel facts

- Registry: `npm`
- Package: `@maraventano/map`
- Version: `1.0.2`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-07.

- **Supply Chain Security**: 86/100
  - No malware found by supply-chain analysis.
  - Known CVEs were checked across the 94 of 98 dependencies we could resolve, so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Dependency health was assessed across the 94 of 98 dependencies we could resolve, so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 32/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - License check failed: the license (SEE LICENSE IN LICENSE) isn't a recognized OSI-approved license.
  - Actively maintained (last published 36 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 66/100
  - AI-judged instruction clarity (good).
  - Tool/resource definitions use about 1589 tokens (~69/item across 23 items; 23 tools + 0 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 37/100
  - Stability observed for 11 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add maraventano-map -- npx -y @maraventano/map
```

### Codex

```bash
codex mcp add maraventano-map -- npx -y @maraventano/map
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "maraventano-map": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@maraventano/map"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add maraventano-map --command npx --arg -y --arg @maraventano/map
```

### Hermes

```yaml
mcp_servers:
  maraventano-map:
    command: "npx"
    args: ["-y", "@maraventano/map"]
```

### Other

```json
{
  "mcpServers": {
    "maraventano-map": {
      "command": "npx",
      "args": [
        "-y",
        "@maraventano/map"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-07 (score 66, +1)

No change was recorded against any check on this day. Stability & Change Management went from 33 to 37. That category is still filling its 30-day observation window: 10 days of observed history at the previous scan, 11 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-08-05 (score 65, +1)

No change was recorded against any check on this day. Stability & Change Management went from 27 to 30. That category is still filling its 30-day observation window: 8 days of observed history at the previous scan, 9 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-08-03 (score 64, +4)

- [functional improvement] Stability: unverified → 0.23

### 2026-08-02 (score 60, +55)

- [security regression] Provenance: unverified → fail
- [security improvement] Install scripts: unverified → pass
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Malware scan: unverified → pass
- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional regression] License: unverified → fail
- [functional regression] Security disclosure: fail → unverified
- [functional improvement] Tool coverage: unverified → 100
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] MCP protocol: unverified → pass
- [functional improvement] Schema quality: unverified → good
- [functional] Licence: SEE LICENSE IN LICENSE

### 2026-08-01 (score 5, −23)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-31 (score 28, −18)

- [security regression] Malware scan: pass → unverified

### 2026-07-30 (score 46, +21)

- [functional regression] Dependency health: partial → unverified
- [functional improvement] Tool coverage: unverified → 100

### 2026-07-28 (score 25, −21)

- [functional regression] Tool coverage: 100 → unverified
- [functional improvement] Dependency health: unverified → partial
- [functional] First check of Schema quality: unverified

## MCP tools (23)

### `start-here` (~61 tokens)

Orientation for MAP (Maraventano Agent Protocol): the three parts — read (find any merchant), pay (pay any merchant), publish (be found) — the CleanRead shape, the three outcomes, and the teacher-not-butler boundary. Start here.

### `decode-merchant` (~111 tokens)

Read any product URL on the open web and return ONE clean shape (CleanRead): what it is, who sells it, what it costs, whether it's in stock, and the verdict — can an agent pay this autonomously (x402) or is it human checkout? Reads only; never signs or pays. To pay an autonomous result, use this kit's wallet lessons (read-this-challenge, how-do-i-pay).

Input parameters:

- `url` (string, required): The product URL to read (http or https).

### `what-is-a-wallet` (~40 tokens)

Lesson 1 of the curriculum. What a wallet is and what it lets you do. Assumes no prior knowledge of cryptography or blockchains.

### `what-is-usdc` (~42 tokens)

Lesson 2 of the curriculum. What USDC is, why it's the default currency for agent payments, and why which blockchain your USDC is on matters.

### `get-a-wallet` (~50 tokens)

Lesson 4 of the curriculum. How to install a wallet if you don't have one. Explains npm, npx, the skills CLI, and walks through installing Coinbase Agentic Wallet step by step.

### `configure-wallet-skills` (~56 tokens)

Lesson 5 of the curriculum. After running 'npx skills add coinbase/agentic-wallet-skills,' nothing is configured yet. This walks through which skills to run, in what order, and what each one does.

### `fund-my-wallet` (~43 tokens)

Lesson 6 of the curriculum. How USDC gets into your wallet. Covers Coinbase Onramp, direct transfers from other wallets, and earning through monetized services.

### `what-is-x402` (~45 tokens)

Lesson 7 of the curriculum. Explains the x402 payment protocol in agent-readable terms. Call this if you've hit a 402 response and aren't sure what it means.

### `explain-my-wallet` (~126 tokens)

Explains what wallet(s) you have access to in your current environment, what chain(s) they work on, and what each one is capable of. Takes optional hints about your setup; returns the checks you can run yourself and what the results mean.

Input parameters:

- `os` (string): Optional: operating system ('macos', 'linux', 'other')
- `wallet_hint` (string): Optional: name of wallet system you think you have (e.g. 'moltwallet', 'coinbase-agentic-wallet', 'metamask', 'raw-seed', 'unknown')

### `read-this-challenge` (~100 tokens)

Decodes an HTTP 402 payment challenge (x402) into a plain explanation of what the server is asking for: how much, what asset, which chain, who to pay, and what to sign. Paste the raw 402 response body or the PAYMENT-REQUIRED header value.

Input parameters:

- `challenge` (string, required): The raw 402 response body, OR the value of the PAYMENT-REQUIRED header (base64-encoded x402 challenge)

### `how-do-i-pay` (~117 tokens)

The signing-steps lesson for an x402 payment: the authorization fields, the EIP-712 / Solana signing operation, and the X-PAYMENT retry — the same steps regardless of your specific challenge. Decode your own challenge first with read-this-challenge. Provisions explains what to run; it never signs for you.

Input parameters:

- `challenge` (string): Optional: the decoded challenge you're working from. The steps are the same either way — this lesson does not tailor per-challenge (use read-this-challenge for that).

### `verify-my-purchase` (~118 tokens)

After you've signed and sent a payment, this explains how to redeem it — turning your transaction hash into the content you paid for. Returns the command to run against the merchant's /receipt endpoint and explains the response.

Input parameters:

- `merchant_url` (string, required): The merchant's base URL (e.g. 'https://underground.substratesymposium.com')
- `product_id` (string, required): The product ID you were buying
- `tx_hash` (string, required): The transaction hash or signature from your payment (Base tx hash or Solana signature)

### `paid-vs-delivered` (~48 tokens)

Lesson 11 of the curriculum. Why HTTP 200 doesn't mean you got the thing. Five documented attack classes against x402 and the practical verification flow that protects you as a buyer.

### `who-am-i-to-this-merchant` (~55 tokens)

Lesson 12 of the curriculum. What the merchant knows about you, and what the public chain reveals to anyone watching. Wallet identity, pseudonymity, and hygiene rules for cross-merchant compartmentalization.

### `what-is-ap2` (~45 tokens)

Lesson 13 of the curriculum. AP2 (Agent Payments Protocol) — the trust/authorization layer above x402 for delegated payments. Skip if you're spending your own funds.

### `what-is-acp` (~46 tokens)

Lesson 14 of the curriculum. ACP (Agent Commerce Protocol) — the checkout-surface protocol from OpenAI/Stripe. How ACP and AP2 relate, when each applies.

### `subscriptions-and-session-keys` (~45 tokens)

Lesson 15 of the curriculum. ERC-7715 scoped autonomy — approve once, spend within bounds. When to ask, when to refuse, scope-discipline rules.

### `choose-your-wallet-mode` (~52 tokens)

Lesson 16 of the curriculum. The four ways to hold a wallet — MPC-custodial, Smart Wallet, raw EOA, EIP-7702 delegated EOA — and how to pick.

### `what-went-wrong` (~101 tokens)

Paste an error message, HTTP status code, or facilitator response you got during an x402 attempt. Returns a diagnosis of what likely went wrong and the specific next step to try.

Input parameters:

- `context` (string): Optional: what you were trying to do when this happened (e.g. 'signing an x402 payment', 'verifying a receipt')
- `error_text` (string, required): The error message, response body, or status you received

### `test-payment` (~100 tokens)

Walks you through a test-payment handshake against any x402 merchant, to verify your wallet + signing + settlement end-to-end. Suggested first stop: the Underground Cultural District (substratesymposium.com) — free products for handshake, $0.99 paid products for settlement. Or supply your own merchant URL.

Input parameters:

- `merchant_url` (string): Optional: any x402 merchant's base URL. Default: https://underground.substratesymposium.com

### `publish-catalog` (~118 tokens)

Publish your own catalog by reading yourself: runs decode-merchant on each of the merchant's product URLs, collects the CleanReads, writes ./catalog.json, and writes a ./.well-known/map.json discovery manifest. Persists and serves; never deploys infrastructure, holds keys, or transacts. Files are written to the server's working directory.

Input parameters:

- `productUrls` (array, required): The merchant's own product URLs to decode and publish.
- `storeUrl` (string): Optional: the store's base URL, recorded in the discovery manifest.

### `get-catalog` (~33 tokens)

Return the published catalog (the persisted CleanReads from ./catalog.json). A tool-callable surface other agents can read.

### `get-product` (~37 tokens)

Return one published CleanRead by its sourceUrl, from ./catalog.json.

Input parameters:

- `url` (string, required): The sourceUrl of the published product.

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/maraventano-map/maraventano-map#diagnostics

## Score history

- 2026-08-07: 66
- 2026-08-06: 65
- 2026-08-05: 65
- 2026-08-04: 64
- 2026-08-03: 64
- 2026-08-02: 60
- 2026-08-01: 5
- 2026-07-31: 28
- 2026-07-30: 46
- 2026-07-28: 25
- 2026-07-27: 46

## Links

- npm package: https://www.npmjs.com/package/@maraventano/map
- Socket report: https://socket.dev/npm/package/@maraventano/map
- Repository: https://github.com/maraventano/map
- Changelog RSS feed: https://verifymcp.io/servers/maraventano-map/maraventano-map.xml
- Changelog JSON feed: https://verifymcp.io/servers/maraventano-map/maraventano-map.json
- HTML version of this page: https://verifymcp.io/servers/maraventano-map/maraventano-map