xyz.trusteed/mcp-gateway
REMOTE · TRUSTEED.XYZ · SCANNED SEP 20
Agentic commerce gateway: discovery, search, checkout across Shopify/Woo/Odoo/PrestaShop.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security63
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation not fully verified: this server exposes a tool marked destructive (ucp_cancel_checkout) and its handshake is open, but we could not confirm whether a tool call is gated, so we do not assert it is callable unauthenticated. View diagnostics → Unverified
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- The HSTS (Strict-Transport-Security) header is present. View diagnostics → Pass
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability70
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 3170 tokens (~158/item across 20 items; 20 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management24
- Stability check failed: schema churn in the 30 days we've observed: 29 tool removals, 15 breaking changes, 0 auth/transport breaks, 1 additions. See how to fix → Fail
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
- Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 20 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 20 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the xyz.trusteed/mcp-gateway server?
xyz.trusteed/mcp-gateway is a hosted endpoint at https://trusteed.xyz/demo-store/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · trusteed.xyz
claude mcp add --transport http xyz-trusteed-mcp-gateway 'https://trusteed.xyz/demo-store/mcp'
{
"mcpServers": {
"xyz-trusteed-mcp-gateway": {
"url": "https://trusteed.xyz/demo-store/mcp"
}
}
} {
"servers": {
"xyz-trusteed-mcp-gateway": {
"type": "http",
"url": "https://trusteed.xyz/demo-store/mcp"
}
}
} [mcp_servers.xyz-trusteed-mcp-gateway] url = "https://trusteed.xyz/demo-store/mcp"
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"xyz-trusteed-mcp-gateway": {
"type": "remote",
"url": "https://trusteed.xyz/demo-store/mcp",
"enabled": true
}
}
} openclaw mcp add xyz-trusteed-mcp-gateway --url 'https://trusteed.xyz/demo-store/mcp' --transport streamable-http
mcp_servers:
xyz-trusteed-mcp-gateway:
url: "https://trusteed.xyz/demo-store/mcp" {
"McpServers": {
"xyz-trusteed-mcp-gateway": {
"Transport": "http",
"Url": "https://trusteed.xyz/demo-store/mcp"
}
}
} assistant mcp add xyz-trusteed-mcp-gateway -t streamable-http -u 'https://trusteed.xyz/demo-store/mcp'
{
"mcpServers": {
"xyz-trusteed-mcp-gateway": {
"type": "http",
"url": "https://trusteed.xyz/demo-store/mcp"
}
}
} The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 19 Sept 26 −1
- Tool “apply_discount” rewrote its description, which is the text the model reads security
- Tool “complete_checkout” rewrote its description, which is the text the model reads security
- Tool “create_cart” rewrote its description, which is the text the model reads security
- Tool “get_shipping_rates” rewrote its description, which is the text the model reads security
- Tool “preview_checkout” rewrote its description, which is the text the model reads security
- Tool “select_shipping_option” rewrote its description, which is the text the model reads security
- Schema quality: 137 → 158 ▼ functional
- New tool “create_sandbox_key” functional
- 18 Sept 26 0
- Tool “search_products_enriched” rewrote its description, which is the text the model reads security
- 16 Sept 26 0
- Tool “get_page_content” rewrote its description, which is the text the model reads security
- Tool “get_site_map” rewrote its description, which is the text the model reads security
- Tool “search_docs” rewrote its description, which is the text the model reads security
- 14 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 20 to 24.
- 13 Sept 26 −1
No change was recorded against any check on this day. Stability & Change Management went from 24 to 20.
- 10 Sept 26 −4
- Authorization: partial → unverified ▼ security
- New tool “ucp_cancel_checkout”, which the server declares destructive security
- Schema quality: 181 → 139 ▲ functional
- New tool “compare_products” functional
- New tool “get_page_content” functional
- New tool “get_site_map” functional
- New tool “search_docs” functional
- New tool “search_products_enriched” functional
- New tool “ucp_create_checkout” functional
- New tool “ucp_get_checkout” functional
- New tool “ucp_update_checkout” functional
- 9 Sept 26 −1
- Tool “apply_discount” rewrote its description, which is the text the model reads security
- Tool “browse_categories” rewrote its description, which is the text the model reads security
- Tool “complete_checkout” rewrote its description, which is the text the model reads security
- Tool “create_cart” rewrote its description, which is the text the model reads security
- Tool “get_merchant_profile” rewrote its description, which is the text the model reads security
- Tool “get_product_details” rewrote its description, which is the text the model reads security
- Tool “get_shipping_rates” rewrote its description, which is the text the model reads security
- Tool “preview_checkout” rewrote its description, which is the text the model reads security
- Tool “search_products” rewrote its description, which is the text the model reads security
- Tool “select_shipping_option” rewrote its description, which is the text the model reads security
- Schema quality: 115 → 181 ▼ functional
- Tool “apply_discount” now declares an output schema ▲ functional
- Tool “browse_categories” now declares an output schema ▲ functional
- Tool “complete_checkout” now declares an output schema ▲ functional
- Tool “create_cart” now declares an output schema ▲ functional
- Tool “get_merchant_profile” now declares an output schema ▲ functional
- Tool “get_product_details” now declares an output schema ▲ functional
- Tool “get_shipping_rates” now declares an output schema ▲ functional
- Tool “preview_checkout” now declares an output schema ▲ functional
- Tool “search_products” now declares an output schema ▲ functional
- Tool “select_shipping_option” now declares an output schema ▲ functional
- First check of Capabilities: pass functional
- First check of Tool coverage: 100 functional
- Schema quality: good → excellent functional
- “search_products” added an optional parameter “compact” cosmetic
- 7 Sept 26 −1
- Schema quality: pass → fail ▼ functional
- Schema quality: excellent → good functional
- “complete_checkout” added an optional parameter “reconfirmed_state_hash” cosmetic
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Probed https://trusteed.xyz/demo-store/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=agenticmcpstores.com | CN=YR2,O=Let's Encrypt,C=US | 14 Sept 2026 | 13 Dec 2026 | RSA 2048 | SHA256-RSA | 6cc60b02869c968eec914d382f85caf8e3b |
| SANs: agenticmcpstores.com, trusteed.xyz, www.agenticmcpstores.com, www.trusteed.xyz | ||||||
| CN=YR2,O=Let's Encrypt,C=US (CA) | CN=Root YR,O=ISRG,C=US | 3 Sept 2025 | 2 Sept 2028 | RSA 2048 | SHA256-RSA | 4ebd24947e24d394802d84a52fd5b319 |
| CN=Root YR,O=ISRG,C=US (CA) | CN=ISRG Root X1,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | RSA 4096 | SHA256-RSA | f24b6d17f9d9ad7cb1c9fea78782699f |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of trusteed.xyz. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| xyz. | present | 3599, 18130 | 8, 8 | Verified |
| trusteed.xyz. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
| Header | Value |
|---|---|
| strict-transport-security | max-age=63072000; includeSubDomains; preload |
| content-security-policy | default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self'; connect-src 'self'; frame-ancestors 'none'; base-uri 'none'; form-action 'self' |
| x-content-type-options | nosniff |
| x-frame-options | DENY |
| referrer-policy | strict-origin-when-cross-origin |
| permissions-policy | camera=(), microphone=(), geolocation=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=() |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://trusteed.xyz/demo-store/mcp | Verified | 200 | |
| http (plaintext) | http://trusteed.xyz/demo-store/mcp | HTTPS enforced | 301 | https://trusteed.xyz/demo-store/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
apply_discount ~220
Apply a discount or promo code to the cart. SKYFIRE TOKEN (optional): Pass a kya or kya-pay token in the skyfire-pay-id header to boost trust score. No token required — request proceeds normally if omitted. CREDENTIAL: this store needs one. Call the `create_sandbox_key` tool first (it is in this tool list and needs no credential), then pass the key you get back as the `agent_key` argument — or as an `Authorization: Bearer` header if your client can set headers. Do not ask a person to log in: there is no human login for this store.
| Name | Type | Req | Description |
|---|---|---|---|
| cart_id | string | yes | Cart session ID |
| discount_code | string | – | Discount or promo code to apply (required unless source is ucp_identity) |
| identity_token | string | – | UCP identity bearer token (required when source is ucp_identity). |
| source | string | – | Set to 'ucp_identity' to apply a loyalty discount derived from a UCP identity token instead of a promo code. |
| Name | Type | Req | Description |
|---|---|---|---|
| cart_id | string | yes | – |
| currency | string | yes | – |
| discount_cents | number | yes | – |
| discount_code | string | yes | – |
| new_total_cents | number | yes | – |
No examples provided.
browse_categories ~19
List all product categories in Demo Store with product counts.
Input schema present but exposes no named parameters.
| Name | Type | Req | Description |
|---|---|---|---|
| categories | array | yes | – |
| store_name | string | yes | – |
| total | number | yes | – |
No examples provided.
compare_products ~45
Compare 2 to 5 products side-by-side with normalized attribute table and best-value recommendation.
| Name | Type | Req | Description |
|---|---|---|---|
| product_ids | array | yes | Array of product IDs to compare (2-5) |
| Name | Type | Req | Description |
|---|---|---|---|
| bestValue | – | yes | – |
| commonFields | array | yes | – |
| comparisonTable | object | yes | – |
| products | array | yes | – |
| recommendation_provenance_warning | string | – | – |
No examples provided.
complete_checkout ~698
Complete the purchase. Collects buyer contact info via elicitation if supported. Idempotent — replay is keyed on checkout_session_id: any retry against a session that already has an order returns that same order (COMPLETED or PENDING_EXTERNAL_CONFIRMATION) without re-charging. The provided idempotency_key is recorded on the session for audit and short-circuits a repeated call with the same key. SKYFIRE TOKEN (payment_method=KYAPAY): Requires a Skyfire pay or kya-pay token. Preferred: pass the JWT in the skyfire-pay-id request header. Alternative: pass as kyapay_token parameter. Claims validated: sub (account ID), jti (replay prevention), amount (USD, matched against cart total), cur (must be USD), sps (pricing scheme). Missing token with KYAPAY method → error. Invalid token → error 'Invalid Skyfire token'. For other payment methods (MOCK, PAYPAL) no Skyfire token is required. CREDENTIAL: this store needs one. Call the `create_sandbox_key` tool first (it is in this tool list and needs no credential), then pass the key you get back as the `agent_key` argument — or as an `Authorization: Bearer` header if your client can set headers. Do not ask a person to log in: there is no human login for this store.
| Name | Type | Req | Description |
|---|---|---|---|
| buyer | object | – | Optional buyer contact information |
| cel_context | object | – | Optional enforcement context for Trusteed native MCP flows (no Shopify/WooCommerce/PrestaShop/Magento plugin). Providing these fields enables full evaluation of rules R004, R006, R008, R012-R013, R01… |
| checkout_session_id | string | yes | Checkout session ID from preview_checkout (must be a valid UUID) |
| idempotency_key | string | yes | Unique key to prevent duplicate charges on retry. Generate once per purchase attempt. Replay is enforced primarily on checkout_session_id (the existing order is returned). The first key seen for a se… |
| kyapay_token | string | – | Skyfire pay or kya-pay JWT for autonomous payment via Skyfire (payment_method=KYAPAY). Alternative to passing the token in the skyfire-pay-id request header — the header takes precedence if both are… |
| payment_method | string | – | Payment method to use. PAYPAL creates a PayPal order and presents approval URL. KYAPAY requires kyapay_token. ACP (Agentic Commerce Protocol / Stripe-native settlement) is NOT enabled by default: unl… |
| reconfirmed_state_hash | string | – | SHA-256 of the authoritative merchant state, as returned in details.reconfirm_state_hash by a previous STATE_RECONFIRMATION_REQUIRED error. Required to proceed when the merchant state moved after the… |
| Name | Type | Req | Description |
|---|---|---|---|
| checkout_session_id | string | yes | – |
| currency | string | yes | – |
| external_order_id | string | – | – |
| idempotent | boolean | yes | – |
| order_id | string | yes | – |
| payment_url | string | – | – |
| status | string | yes | – |
| store_name | string | yes | – |
| total_cents | number | yes | – |
No examples provided.
create_cart ~301
Create a shopping cart in Demo Store. Returns a cart_id for use with get_shipping_rates, preview_checkout, and complete_checkout. SKYFIRE TOKEN (optional): Provide a kya or kya-pay Skyfire token in the skyfire-pay-id request header to boost your agent trust score (up to +0.35), which may unlock better pricing or priority service. No token required — request proceeds with neutral trust score (0.50) if omitted or invalid. CREDENTIAL: this store needs one. Call the `create_sandbox_key` tool first (it is in this tool list and needs no credential), then pass the key you get back as the `agent_key` argument — or as an `Authorization: Bearer` header if your client can set headers. Do not ask a person to log in: there is no human login for this store.
| Name | Type | Req | Description |
|---|---|---|---|
| agent_session_id | string | – | Opaque agent session identifier for cart resume across sessions |
| agent_token | string | – | JWS compact (EdDSA/Ed25519) signed by the agent. Required for Shopify enforcement rules R001/R002/R004. The token is embedded as a server-authoritative cart attribute — Trusteed does NOT verify the s… |
| display_context | string | – | Agent display capability: webview (browser) or headless |
| items | array | yes | Items to add to cart |
| Name | Type | Req | Description |
|---|---|---|---|
| agent_session_id | string | yes | – |
| cart_id | string | yes | – |
| currency | string | yes | – |
| display_context | string | yes | – |
| items | array | yes | – |
| session_state | string | yes | – |
| status | string | yes | – |
| store_name | string | yes | – |
| subtotal_cents | number | yes | – |
No examples provided.
create_sandbox_key ~84
Get a temporary sandbox credential for this demo store, valid 24h. Present it as an `Authorization: Bearer` header, or — when your client cannot set headers — as the `agent_key` argument of the checkout tools. Payments here are simulated: this credential settles nothing and works only on the demo store. No human login is involved at any point.
Input schema present but exposes no named parameters.
| Name | Type | Req | Description |
|---|---|---|---|
| api_key | string | – | – |
| error | string | – | – |
| expires_at | string | – | – |
| presented_as | array | – | – |
| retryable | boolean | – | – |
No examples provided.
get_merchant_profile ~83
Get the complete profile — trust score, policies, compliance, and protocol support — of the merchant this MCP endpoint belongs to. Takes NO parameters: the merchant is fixed by which store's /:storeSlug/mcp endpoint you connected to, not by an argument. To read a different merchant's profile, call this same tool on that merchant's own endpoint instead.
Input schema present but exposes no named parameters.
| Name | Type | Req | Description |
|---|---|---|---|
| acpFeedUrl | string | yes | – |
| agentPolicySummary | object | yes | – |
| compliance | object | yes | – |
| discovery | object | yes | – |
| enrichedCatalogEnabled | boolean | yes | – |
| identity | object | yes | – |
| identityLinkingEnabled | boolean | yes | – |
| identityProviderType | string|null | yes | – |
| manifest_hash | string | yes | – |
| manifest_jws | string|null | yes | – |
| manifest_signed_at | string|null | yes | – |
| policies | object | yes | – |
| protocolScopeNote | string | yes | – |
| protocols | object | yes | – |
| store | object | yes | – |
| supportedProtocols | array | yes | – |
| trust | object | yes | – |
No examples provided.
get_page_content ~105
Read the content of a specific page on Trusteed. Pass the page slug (e.g. 'for-agents', 'pricing', 'blog') or a blog post slug. Use get_site_map first to discover available slugs. Pass page='blog' to list all blog posts.
| Name | Type | Req | Description |
|---|---|---|---|
| page | string | yes | Page slug (e.g. 'for-agents', 'pricing', 'trust') or blog post slug. Use 'blog' to list all blog posts. |
| Name | Type | Req | Description |
|---|---|---|---|
| category | string | – | – |
| datePublished | string | – | – |
| description | string | – | – |
| excerpt | string | – | – |
| found | boolean | – | – |
| keywords | array | – | – |
| path | string | – | – |
| posts | array | – | – |
| readingTime | string | – | – |
| related_tools | array | – | – |
| slug | string | – | – |
| suggestion | string | – | – |
| tags | array | – | – |
| title | string | – | – |
| total | number | – | – |
| type | string | – | – |
No examples provided.
get_product_details ~72
Get detailed information about a specific product in Demo Store, including all variants, sizes, colors, and availability.
| Name | Type | Req | Description |
|---|---|---|---|
| product_id | string | yes | Product ID — use the `id` field returned by search_products or nlweb_ask (e.g. 'prod-snk-001'). Do not invent IDs. |
| Name | Type | Req | Description |
|---|---|---|---|
| attributes | object | – | – |
| average_rating | number|null | – | – |
| categories | array | – | – |
| compare_at_price | number|null | – | – |
| currency | string | – | – |
| error | string | – | – |
| id | string | – | – |
| image_url | string|null | – | – |
| jsonLd | object | – | – |
| message | string | – | – |
| price | number | – | – |
| product_id | string | – | – |
| rating_provenance | – | – | – |
| review_count | number|null | – | – |
| stock_status | string | – | – |
| tags | array | – | – |
| title | string | – | – |
| url | string | – | – |
| variants | array | – | – |
| vendor | string|null | – | – |
No examples provided.
get_shipping_rates ~180
Get available shipping rates for the cart. Collects shipping address via elicitation if supported. SKYFIRE TOKEN (optional): Pass a kya or kya-pay token in the skyfire-pay-id header to boost trust score. No token required — request proceeds normally if omitted. CREDENTIAL: this store needs one. Call the `create_sandbox_key` tool first (it is in this tool list and needs no credential), then pass the key you get back as the `agent_key` argument — or as an `Authorization: Bearer` header if your client can set headers. Do not ask a person to log in: there is no human login for this store.
| Name | Type | Req | Description |
|---|---|---|---|
| cart_id | string | yes | Cart session ID returned by create_cart |
| shipping_address | object | – | Destination address. Omit to collect via elicitation (Claude.ai). |
| Name | Type | Req | Description |
|---|---|---|---|
| address_city | string | – | – |
| address_country | string | – | – |
| cart_id | string | yes | – |
| rates | array | yes | – |
No examples provided.
get_site_map ~78
Returns the complete site map of Trusteed: all public pages organized by category. Use this to discover what sections are available (docs, blog, integrations, legal, marketing) and find the right path before calling get_page_content.
| Name | Type | Req | Description |
|---|---|---|---|
| category | string | – | Filter pages by category: commerce, docs, legal, blog, marketing, integrations |
| Name | Type | Req | Description |
|---|---|---|---|
| blog_count | number | yes | – |
| categories | array | yes | – |
| faq_count | number | yes | – |
| pages | array | yes | – |
| total | number | yes | – |
No examples provided.
preview_checkout ~157
Preview the complete order summary before payment. Advances the session to ready-for-payment state. SKYFIRE TOKEN (optional): Pass a kya or kya-pay token in the skyfire-pay-id header to boost trust score. No token required — request proceeds normally if omitted. CREDENTIAL: this store needs one. Call the `create_sandbox_key` tool first (it is in this tool list and needs no credential), then pass the key you get back as the `agent_key` argument — or as an `Authorization: Bearer` header if your client can set headers. Do not ask a person to log in: there is no human login for this store.
| Name | Type | Req | Description |
|---|---|---|---|
| cart_id | string | yes | Cart session ID returned by create_cart |
| Name | Type | Req | Description |
|---|---|---|---|
| checkout_session_id | string | yes | – |
| currency | string | yes | – |
| discount_cents | number | yes | – |
| items | array | yes | – |
| shipping_cents | number | yes | – |
| shipping_title | string | – | – |
| status | string | yes | – |
| store_name | string | yes | – |
| subtotal_cents | number | yes | – |
| total_cents | number | yes | – |
No examples provided.
search_docs ~122
Full-text search across all Trusteed public documentation: pages, blog posts, and FAQ entries. Returns ranked results by relevance. Use this to find answers about protocols, pricing, integration guides, trust scores, and more.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Maximum number of results (1-20, default 10) |
| query | string | yes | Search query, e.g. 'trust score threshold', 'shopify integration', 'rate limits' |
| type | string | – | Filter results by type: page, blog, or faq. Omit to search all types. |
| Name | Type | Req | Description |
|---|---|---|---|
| query | string | yes | – |
| results | array | yes | – |
| total | number | yes | – |
No examples provided.
search_products ~394
Search products in Demo Store. Returns matching products with prices, images, availability, and direct links. Results include data for generating a visual product carousel artifact with category filtering.
| Name | Type | Req | Description |
|---|---|---|---|
| category | string | – | Filter by category slug |
| compact | boolean | – | When true, the same products are described only once instead of twice. `structuredContent.products` stays the full typed record — every field, every product, untouched — but the text reply becomes a… |
| cursor | string | – | Opaque pagination cursor from next_cursor of a previous response. Only valid for the SAME query, category, price range and sort_by — a cursor replayed against different filters is rejected, not silen… |
| field_mask | array | – | Return only these product fields, to spend less of your context on a large catalogue. `id` is always included. Supplying a mask also drops the carousel/UI payloads, which are the bulk of a full respo… |
| limit | integer | – | Number of results (1-50) |
| max_price | number | – | Maximum price filter |
| min_price | number | – | Minimum price filter |
| query | string | – | Search query (e.g. 'red sneakers', 'winter jacket'). Omit to list all products. |
| sort_by | string | – | Sort order for results |
| Name | Type | Req | Description |
|---|---|---|---|
| _carousel | object | – | – |
| has_more | boolean | – | – |
| next_cursor | string | – | – |
| products | array | yes | – |
| query | string | – | – |
| sort_provenance_warning | string | – | – |
| store_environment | string | – | – |
| total | number | yes | – |
No examples provided.
search_products_enriched ~146
Search products with enriched data including structured attributes, variants, GTIN, and images. Ideal for comparison and detailed product discovery. Matching is keyword/substring-based (title, description, tags, vendor) with rating-then-review ordering — the rating and review count it orders by are asserted by the merchant and are not verified by Trusteed. Use this when you have concrete keywords, a category, or a price range.
| Name | Type | Req | Description |
|---|---|---|---|
| category | string | – | Filter by category |
| limit | integer | – | Max results (1-20) |
| max_price | number | – | Maximum price |
| min_price | number | – | Minimum price |
| query | string | yes | Search query |
| Name | Type | Req | Description |
|---|---|---|---|
| _carousel | object | – | – |
| products | array | yes | – |
| query | string | yes | – |
| sort_provenance_warning | string | yes | – |
| total | number | yes | – |
No examples provided.
select_shipping_option ~167
Select a shipping method for the cart. Must call get_shipping_rates first. SKYFIRE TOKEN (optional): Pass a kya or kya-pay token in the skyfire-pay-id header to boost trust score. No token required — request proceeds normally if omitted. CREDENTIAL: this store needs one. Call the `create_sandbox_key` tool first (it is in this tool list and needs no credential), then pass the key you get back as the `agent_key` argument — or as an `Authorization: Bearer` header if your client can set headers. Do not ask a person to log in: there is no human login for this store.
| Name | Type | Req | Description |
|---|---|---|---|
| cart_id | string | yes | Cart session ID |
| shipping_handle | string | yes | Shipping method handle from get_shipping_rates |
| Name | Type | Req | Description |
|---|---|---|---|
| cart_id | string | yes | – |
| currency | string | yes | – |
| selected_handle | string | yes | – |
| selected_title | string | yes | – |
| shipping_authoritative | boolean | yes | – |
| shipping_cents | number | yes | – |
| shipping_source | string | yes | – |
| subtotal_cents | number | yes | – |
| total_cents | number | yes | – |
No examples provided.
ucp_cancel_checkout ~78
Cancel a UCP checkout session. Transitions to 'canceled' status. Cannot cancel already completed checkouts.
| Name | Type | Req | Description |
|---|---|---|---|
| checkout_id | string | yes | UCP checkout session ID (valid UUID) |
| idempotency_key | string | – | Optional idempotency key to prevent duplicate cancellations. |
| reason | string | – | Optional cancellation reason |
| Name | Type | Req | Description |
|---|---|---|---|
| created_at | string | yes | – |
| currency | string | yes | – |
| extensions | object | – | – |
| id | string | yes | – |
| idempotency_key | string | – | – |
| intent | object | – | – |
| label | string | – | – |
| line_items | array | yes | – |
| status | string | yes | – |
| totals | array | yes | – |
| updated_at | string | yes | – |
No examples provided.
ucp_create_checkout ~101
Create a UCP checkout session from line items. Returns a UCP checkout object with status 'incomplete'.
| Name | Type | Req | Description |
|---|---|---|---|
| currency | string | yes | ISO 4217 currency code (e.g. USD) |
| intent | object | – | Intent context for relevance and personalization |
| label | string | – | Optional label for additional identifiers (e.g. external order ref, multi-PSP reference) |
| line_items | array | yes | Line items for the checkout |
| Name | Type | Req | Description |
|---|---|---|---|
| created_at | string | yes | – |
| currency | string | yes | – |
| extensions | object | – | – |
| id | string | yes | – |
| idempotency_key | string | – | – |
| intent | object | – | – |
| label | string | – | – |
| line_items | array | yes | – |
| status | string | yes | – |
| totals | array | yes | – |
| updated_at | string | yes | – |
No examples provided.
ucp_get_checkout ~43
Retrieve a UCP checkout session by ID. Returns the current state of the checkout.
| Name | Type | Req | Description |
|---|---|---|---|
| checkout_id | string | yes | UCP checkout session ID (valid UUID) |
| Name | Type | Req | Description |
|---|---|---|---|
| created_at | string | yes | – |
| currency | string | yes | – |
| extensions | object | – | – |
| id | string | yes | – |
| idempotency_key | string | – | – |
| intent | object | – | – |
| label | string | – | – |
| line_items | array | yes | – |
| status | string | yes | – |
| totals | array | yes | – |
| updated_at | string | yes | – |
No examples provided.
ucp_update_checkout ~77
Update a UCP checkout session by fully replacing all line items. Only allowed when status is 'incomplete'.
| Name | Type | Req | Description |
|---|---|---|---|
| checkout_id | string | yes | UCP checkout session ID (valid UUID) |
| currency | string | yes | ISO 4217 currency code (e.g. USD) |
| line_items | array | yes | Replacement line items |
| Name | Type | Req | Description |
|---|---|---|---|
| created_at | string | yes | – |
| currency | string | yes | – |
| extensions | object | – | – |
| id | string | yes | – |
| idempotency_key | string | – | – |
| intent | object | – | – |
| label | string | – | – |
| line_items | array | yes | – |
| status | string | yes | – |
| totals | array | yes | – |
| updated_at | string | yes | – |
No examples provided.
What is the xyz.trusteed/mcp-gateway server?
xyz.trusteed/mcp-gateway is listed in the public MCP registry as xyz.trusteed/mcp-gateway. Agentic commerce gateway: discovery, search, checkout across Shopify/Woo/Odoo/PrestaShop. This page covers its hosted endpoint (https://trusteed.xyz/demo-store/mcp).
Is the xyz.trusteed/mcp-gateway server safe to use?
xyz.trusteed/mcp-gateway scores 69 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the xyz.trusteed/mcp-gateway server expose?
xyz.trusteed/mcp-gateway exposes 20 tools: search_products_enriched, search_products, get_product_details, browse_categories, create_cart, and 15 more. Their descriptions and schemas cost roughly 3,170 tokens of context every time the server is loaded.
Does the xyz.trusteed/mcp-gateway server require authentication?
No. We connected to xyz.trusteed/mcp-gateway without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.
Is the xyz.trusteed/mcp-gateway server still maintained?
xyz.trusteed/mcp-gateway is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.