Binary & Thread MCP server — buy a piece from inside your AI agent. 10 deterministic, read-mostly tools over the shared Store API client; the card never enters the chat and the agent can never self-complete a purchase.
Inferred from the transports this listing declares (stdio). A client not listed here hasn’t been ruled out — it just isn’t something Forge can confirm.
Verification confirms publisher identity (repo ownership), not code safety. The security scan covers known CVEs and suspicious install scripts.
Read out of the source npm actually ships, at scan time. The package was never executed. Tools registered dynamically at runtime, or hidden inside bundled or minified code, can be missed — so this is a floor on the tool surface, not a complete census of it.
list_productsList the pieces in stock (text-only — no images, to keep the agent's context lean). Returns each product's handle, price (VAT included where applicable), and stage. Use get_product for one item's image. Prices are in the region's currency — pass `region` (an ISO-2 country) to price for a specific m…List the pieces in stock (text-only — no images, to keep the agent's context lean). Returns each product's handle, price (VAT included where applicable), and stage. Use get_product for one item's image. Prices are in the region's currency — pass `region` (an ISO-2 country) to price for a specific m…
No input schema was published for this tool.
add_to_cartAdd a piece to a cart. Pass cart_id to reuse an existing cart (the durable handle), or omit it to start a fresh one. Call get_product first to get valid sizes/colours (or an exact variant_id); for a design sold in two fits (regular / oversize, priced apart) you MUST pass `fit`. qty is capped at 20.…Add a piece to a cart. Pass cart_id to reuse an existing cart (the durable handle), or omit it to start a fresh one. Call get_product first to get valid sizes/colours (or an exact variant_id); for a design sold in two fits (regular / oversize, priced apart) you MUST pass `fit`. qty is capped at 20.…
No input schema was published for this tool.
get_cartShow a cart's current contents and total (VAT included where applicable), straight from the server.Show a cart's current contents and total (VAT included where applicable), straight from the server.
No input schema was published for this tool.
checkoutMint a checkout hand-off for a cart. Returns a checkout_url + a session_id INSTANTLY — it does NOT poll and does NOT complete the purchase. The human must open the link in their own browser to enter their payment + ship-to details on the storefront (those details never enter this chat). After they…Mint a checkout hand-off for a cart. Returns a checkout_url + a session_id INSTANTLY — it does NOT poll and does NOT complete the purchase. The human must open the link in their own browser to enter their payment + ship-to details on the storefront (those details never enter this chat). After they…
No input schema was published for this tool.
check_paymentCheck a checkout's payment status ONCE (call again later to re-check — this never blocks/loops). Returns the status and, once placed, the order_id.Check a checkout's payment status ONCE (call again later to re-check — this never blocks/loops). Returns the status and, once placed, the order_id.
No input schema was published for this tool.
get_order_statusLook up an order's status by its display id + the EXACT email on the order. Returns status only (no shipping address). A wrong id/email returns not-found (no enumeration).Look up an order's status by its display id + the EXACT email on the order. Returns status only (no shipping address). A wrong id/email returns not-found (no enumeration).
No input schema was published for this tool.
report_issueFile a bug report or feedback to the maintainers. Pass a short message (and optional structured context like versions/ids). Returns a reference id. It sends no payment details and cannot change any order — it just files the report. Tokens/emails are redacted server-side.File a bug report or feedback to the maintainers. Pass a short message (and optional structured context like versions/ids). Returns a reference id. It sends no payment details and cannot change any order — it just files the report. Tokens/emails are redacted server-side.
No input schema was published for this tool.
teapotReturns 418. Always. It's a teapot. (RFC 2324)Returns 418. Always. It's a teapot. (RFC 2324)
No input schema was published for this tool.
fortuneA coding fortune — a real dev aphorism. Optional seed for a specific one.A coding fortune — a real dev aphorism. Optional seed for a specific one.
No input schema was published for this tool.
9 of 9 tools published a description.
Tool names and descriptions are written by the publisher and shown verbatim as inert text. They are the strings an MCP client passes to a model, so Forge scans them for prompt-injection patterns — any finding appears with the security scan above. “Privileged” is a keyword match on the tool name, not an audit of what the tool does: a benign-sounding name can still do anything.
Binary & Thread MCP server — buy a piece from inside your AI agent. 10 deterministic, read-mostly tools over the shared Store API client; the card never enters the chat and the agent can never self-complete a purchase.
Linked names open Forge’s index of every entry observed exposing that tool. Browse all indexed tools.
The crawl stopped at the depth-4 limit. Anything below that level was never resolved.
The crawl stopped at the 60-package limit. The rest of the tree was never resolved.
36 more resolved packages are not drawn here (display cap: 24). Every dependency carrying an advisory is drawn regardless of the cap. Full inventory (CycloneDX SBOM)
54 declared dependencies never landed in the tree. They are missing from Forge's resolution, not from the package.
+42 more not listed. The counts by reason above cover all of them.
Not followed: peerDependencies. This tree covers runtime dependencies only, so anything those pull in was never resolved.