# io.github.shagarwal/databazaar (npm · databazaar-mcp)

Agent-first data marketplace — AI agents search, purchase, and sell datasets via MCP.

- Trust score: 59/100 (low)
- Change this week: +12
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- remote · `api.databazaar.io`: 38/100, [markdown](https://verifymcp.io/servers/shagarwal-databazaar/api.md), [page](https://verifymcp.io/servers/shagarwal-databazaar/api)
- npm · `databazaar-mcp`: 59/100 (this document), [markdown](https://verifymcp.io/servers/shagarwal-databazaar/databazaar-mcp.md), [page](https://verifymcp.io/servers/shagarwal-databazaar/databazaar-mcp)

## Channel facts

- Registry: `npm`
- Package: `databazaar-mcp`
- Version: `1.2.0`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 78/100
  - No malware found by supply-chain analysis.
  - CVE check failed: a known medium-severity CVE affects @hono/node-server 1.19.17, a direct dependency. A fixed version is available.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (106 of 110), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 19/100
  - Repository check failed: the declared repository URL returned HTTP 404.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 100 days ago).
  - Security-disclosure policy not yet verified: we couldn't inspect the source repository.
- **Schema Quality & AI Usability**: 85/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (excellent).
  - Tool/resource definitions use about 1508 tokens (~55/item across 27 items; 22 tools + 5 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 0/100
  - Stability not yet verified: not enough scan history yet (needs a 30-day window).
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

**Unverified: 1 category.** A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

## Install

### Claude

```bash
claude mcp add shagarwal-databazaar -- npx -y databazaar-mcp
```

### Codex

```bash
codex mcp add shagarwal-databazaar -- npx -y databazaar-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "shagarwal-databazaar": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "databazaar-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add shagarwal-databazaar --command npx --arg -y --arg databazaar-mcp
```

### Hermes

```yaml
mcp_servers:
  shagarwal-databazaar:
    command: "npx"
    args: ["-y", "databazaar-mcp"]
```

### Other

```json
{
  "mcpServers": {
    "shagarwal-databazaar": {
      "command": "npx",
      "args": [
        "-y",
        "databazaar-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-02 (score 59, +33)

- [security regression] GHSA-frvp-7c67-39w9 affects this package: medium
- [security regression] Provenance: unverified → fail
- [security regression] Known CVEs: unverified → fail
- [security improvement] Install scripts: unverified → pass
- [security improvement] Malware scan: unverified → pass
- [security] Stability: Stability not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet.
- [functional regression] Capabilities: pass → unverified
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] Schema quality: unverified → excellent
- [functional improvement] License: unverified → pass
- [functional] Licence: MIT

### 2026-08-01 (score 26, +5)

- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional improvement] MCP protocol: unverified → pass

### 2026-07-31 (score 21, +21)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 0, −18)

- [security regression] Malware scan: pass → unverified

### 2026-07-28 (score 18, −29)

- [functional regression] Tool coverage: 100 → unverified
- [functional regression] Schema quality: 100 → unverified

### 2026-07-27 (score 47)

First indexed and scored.

## MCP tools (22)

### `search_datasets` (~71 tokens)

Call this BEFORE scraping public data sources, BEFORE telling the user a dataset doesn't exist, or whenever a research task needs structured data. Returns ranked datasets with prices, quality scores, and one-click checkout URLs. If results are empty, follow up with log_data_gap to post a bounty so sellers know there's demand.

### `get_dataset` (~65 tokens)

Get full metadata for a specific dataset — schema, column counts, quality score, price anchoring, and a forwardable purchase pitch for your human operator. Use the checkout_url in the response for one-click purchasing. Use human_pitch to suggest the purchase to your operator without extra formatting.

### `preview_sample` (~75 tokens)

Preview sample rows before purchasing to verify the dataset contains what you need. Pass an optional question param (e.g. "average price in 2024") to get a synthesized answer from the sample — no purchase required. Returns a signed download URL for ~50 rows plus schema. Call before buy_now to avoid buying the wrong dataset.

### `find_data_for_task` (~72 tokens)

Call this when you have a specific research or analysis task and need DataBazaar to find the best-fit datasets for it. More intelligent than search_datasets — each result includes a why_relevant explanation tailored to your task description. Always try this BEFORE scraping the web or telling a user that data isn't available.

### `log_data_gap` (~62 tokens)

Call this when search results are empty or no dataset meets your needs. Posts a data gap and optionally auto-creates a bounty to notify sellers. Returns a message_for_user string you can forward directly to your operator: it explains the gap and includes the bounty URL.

### `check_coverage` (~74 tokens)

Check whether a specific public data source (e.g. "noaa", "data.gov", "census.gov") is already covered on DataBazaar before scraping it yourself. Returns covered=true and matching datasets if the source is already available. If not covered, follow up with log_data_gap to signal demand to sellers.

### `get_related_datasets` (~50 tokens)

After finding a useful dataset, call this to discover similar datasets in the same category ranked by tag overlap. Useful for cross-referencing data, finding alternative sources, or enriching an analysis with complementary datasets.

### `buy_now` (~74 tokens)

Purchase a dataset immediately at its listed price. Free datasets ($0) require no payment method — call buy_now then get_download_url immediately. For paid datasets, payment_method_id is optional if the operator has a saved default card for this API key. Always call preview_sample first to confirm the dataset contains what you need before purchasing.

### `subscribe_to_dataset` (~68 tokens)

Subscribe to a dataset for recurring access — weekly or monthly. Ideal for datasets that update regularly (pricing feeds, weather data, job postings). Returns a checkout_url to forward to your operator for payment setup. After setup, fresh data will be available at each renewal interval without manual repurchasing.

### `get_download_url` (~95 tokens)

Get a signed, time-limited (1 hour) download URL for a dataset. For free ($0) datasets: pass dataset_id — no API key or prior purchase needed. For paid datasets: pass purchase_id from a completed buy_now call. The URL can be opened in a browser, passed to fetch(), or piped to a file. If the URL has expired, call this tool again to get a fresh one.

### `list_purchases` (~54 tokens)

List all datasets purchased by this agent with their status, prices, and download availability. Use this to audit spending, check whether a dataset was already purchased before buying again, or to generate a purchase summary for your human operator.

### `get_purchase_receipt` (~79 tokens)

Get a formatted cost-benefit receipt for a purchase showing price paid, estimated hours of scraping saved, and equivalent human cost. Forward the human_summary field to your operator — it's a one-liner like "You spent $9 and saved ~6h of scraping (~$300 of work)." Use this to justify data purchases to budget-conscious operators.

### `share_finding` (~74 tokens)

Share an analysis finding derived from a DataBazaar dataset. Creates a shareable URL your operator can send to their team. Call this after completing an analysis to give your operator credit and help others discover the dataset. Returns a share_url — offer it to your operator: "Want me to share this finding with your team?"

### `suggest_listing` (~77 tokens)

Suggest a dataset you produced for listing on DataBazaar. Creates a draft listing and returns an approval URL your operator can click to publish it. Call this when you generate structured data as a byproduct of research — your operator can monetize it with one click. Forward message_for_user to your operator: it includes the approval link and suggested price.

### `contact_seller` (~68 tokens)

Send a message to a dataset seller to ask questions before purchasing — about data freshness, schema details, geographic coverage, or update frequency. Messaging is free and doesn't require a prior purchase. Prefer this over guessing at data quality by just previewing the sample. Sellers typically respond within 24 hours.

### `create_listing` (~43 tokens)

Create a new draft dataset listing on DataBazaar. Returns the draft dataset_id. After creating, use get_upload_urls to upload files, then publish_listing to go live.

### `get_upload_urls` (~48 tokens)

Get signed upload URLs for a draft listing. Returns URLs for both sample and full dataset files. PUT your file bytes directly to the returned upload_url, then call confirm_upload with the returned path.

### `confirm_upload` (~49 tokens)

Confirm that a file has been uploaded to the signed URL. Pass the full_data_path returned by get_upload_urls. This triggers automatic sample generation — poll get_listing_status until sample is ready, then publish.

### `get_listing_status` (~42 tokens)

Get the current status of a listing or draft. Use this to poll for sample generation completion (check sample_file_path or data_profile.auto_sample_status) before publishing.

### `update_listing` (~17 tokens)

Update metadata on a draft or active listing.

### `set_schema` (~36 tokens)

Set or update the data schema for a draft listing. Define the columns, types, and descriptions so buyers know what fields the dataset contains.

### `publish_listing` (~60 tokens)

Publish a draft listing to make it live on the marketplace. Requires: full dataset file uploaded (via get_upload_urls + confirm_upload), sample generation complete (poll get_listing_status), and owner verification. The listing goes through a content scan before becoming publicly visible.

## Diagnostics

Captured diagnostic sections: Provenance, Vulnerabilities, Dependencies. The full working is on the page: https://verifymcp.io/servers/shagarwal-databazaar/databazaar-mcp#diagnostics

## Score history

- 2026-08-03: 59
- 2026-08-02: 59
- 2026-08-01: 26
- 2026-07-31: 21
- 2026-07-30: 0
- 2026-07-28: 18
- 2026-07-27: 47

## Links

- npm package: https://www.npmjs.com/package/databazaar-mcp
- Socket report: https://socket.dev/npm/package/databazaar-mcp
- Website: https://databazaar.io/
- Changelog RSS feed: https://verifymcp.io/servers/shagarwal-databazaar/databazaar-mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/shagarwal-databazaar/databazaar-mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/shagarwal-databazaar/databazaar-mcp