# @decionis/commerce

MCP server that lets an AI agent check a price change, inventory update, order, fulfillment step, promotion, refund or return against your margin, stock and refund policy before it acts, authorize Dynamics 365 transactions within an agent budget, and read

- **Type:** MCP server
- **Trust:** 85/100 (A), scored on the package rubric
- **Verification:** verified (build provenance)
- **Version:** 0.1.3
- **Author:** Decionis
- **License:** Apache-2.0
- **npm:** @decionis/commerce
- **Source:** https://github.com/decionis/agent-safe-pipeline
- **Compatible clients:** claude-code, cursor, copilot, gemini (basis: transport)

## Trust

85/100 (A), scored on the package rubric
- Publisher verified: no
- Build provenance: verified attestation
- npm trusted publishing (OIDC): yes
- Install scripts: nothing suspicious found
- Prompt-injection scan: not run
- Obfuscation scan: not run
- Evidence age: 1 day

## Security scan

- **Status:** clean
- **Scanned:** 2026-09-14T18:35:35.820Z
- **Version scanned:** 0.1.3
- **CVEs:** none found by OSV at scan time

## Tools

Tool surface: no readable artifact — tool surface unknown.

## Install

**Verdict: install** — No blocking findings and no open coverage gaps — safe to install as configured.
**Config** (claude-code):
```json
"{\n  \"mcpServers\": {\n    \"commerce\": {\n      \"command\": \"npx\",\n      \"args\": [\n        \"-y\",\n        \"@decionis/commerce\"\n      ],\n      \"env\": {\n        \"DECIONIS_API_KEY\": \"<YOUR_DECIONIS_API_KEY>\"\n      }\n    }\n  }\n}"
```
**Credentials it will ask for** (names only — Forge never holds a value):
- `DECIONIS_API_KEY` — Decionis API Key (optional)
Placeholders only. Forge never holds, brokers, or transmits a credential value — replace each <YOUR_NAME> in your own config file. Do not send a value back to Forge; no Forge endpoint accepts one.
- This entry needs 1 credential (0 required). The generated config carries placeholders, so it will fail in the editor rather than at runtime if they are left unset.

## Blast radius

Moderate blast radius — holds an api key; runs on your machine.
- Floor 18, ceiling 18 (tier: moderate)
- This is impact, not likelihood. A high radius is not a defect: a filesystem server is supposed to write files. It is never part of the trust score.

## Machine-readable views of this entry

- Signed JSON: https://forgeregistry.com/api/v1/packages/%40decionis%2Fcommerce
- Install plan: https://forgeregistry.com/api/v1/packages/%40decionis%2Fcommerce/install-plan
- Alternatives: https://forgeregistry.com/api/v1/alternatives/%40decionis%2Fcommerce
- HTML page: https://forgeregistry.com/registry/%40decionis%2Fcommerce
- MCP: POST https://forgeregistry.com/api/mcp → `forge_get_package` / `forge_install_plan`

## About this document

Generated by Forge (https://forgeregistry.com) — a compact rendering of the same record served, signed, at the JSON URL above. Trust and scan facts are the registry's own measurements; anything Forge did not measure is named as unmeasured rather than omitted.