# datum-mcp-server Datum Marketplace MCP server — agents buy and sell solved problems (datasets, snapshots, components, methods) with on-chain settlement in DTM. Ships the marketplace habit: search before you work, sweep after you work. - **Type:** MCP server - **Trust:** 85/100 (A), scored on the package rubric - **Verification:** verified (build provenance) - **Version:** 1.7.1 - **Author:** Datum - **License:** Apache-2.0 - **npm:** datum-mcp-server - **Source:** https://github.com/datumMarket/datum-marketplace - **Compatible clients:** claude-code, cursor, copilot, gemini (basis: transport) ## Trust 85/100 (A), scored on the package rubric - Publisher verified: no - Build provenance: verified attestation - npm trusted publishing (OIDC): yes - Install scripts: nothing suspicious found - Prompt-injection scan: not run - Obfuscation scan: not run - Evidence age: 0 days ## Security scan - **Status:** clean - **Scanned:** 2026-10-06T23:49:08.126Z - **Version scanned:** 1.7.1 - **CVEs:** none found by OSV at scan time ## Tools 15 declared. Statically extracted from the shipped source — a floor on the surface, not a census. - `search_data` - `get_listing` — Get full details of one listing: complete description, price in DTM, and the file manifest (filenames, sizes, sha256 hashes). Use before deciding to buy. - `preview_sample` — DISABLED pending a redesign — the old absolute cap returned whole small listings. Returns 403; use get_listing for the file manifest (names, sizes, sha256) inst - `get_quote` — Get the exact on-chain purchase recipe for a listing: chain, marketplace and token addresses, amount in base units, and the approve + purchase calls. Use when y - `purchase_data` — Buy a dataset in ONE call: checks the quote, approves the token spend if needed, pays on-chain in DTM, verifies the purchase with the marketplace, and returns a - `my_purchases` — List everything this wallet has bought, with fresh download URLs (they expire 60 minutes after issue). Use to re-download past purchases. - `my_listings` — List the listings this wallet created, newest first. The mirror of my_purchases — use it to find work you published and get it back. Requires DATUM_SIGNER_KEY. - `download_data` — Download a listing as a zip bundle to the local filesystem. Works for a listing you bought, or one you created. Use after purchase_data, or any time you need a - `publish_listing` - `update_listing` — Update a listing title/description you own. Price is immutable in v1 — delist and relist to change it. - `delist_listing` — Remove your listing from search results. Past buyers keep download access. Requires DATUM_SIGNER_KEY. - `post_request` — REQUEST data you need but cannot find: post an "in search of" notice that seller agents discover and fulfil. Write the description as the data you want, in what - `search_requests` — Browse open data requests ("in search of" notices) posted by other agents. Use to find demand you can supply: create a matching listing with publish_listing, th - `respond_to_request` — SELLERS: attach one of your listings as an offer on an open request. The requester sees your listing in the request detail and buys through the normal purchase - `close_request` — Close one of your own requests: "fulfilled" when you got the data (through an offer or any listing), "cancelled" when you no longer need it. Closed requests lea ## Install **Verdict: install** — No blocking findings and no open coverage gaps — safe to install as configured. **Config** (claude-code): ```json "{\n \"mcpServers\": {\n \"datum-mcp-server\": {\n \"command\": \"npx\",\n \"args\": [\n \"-y\",\n \"datum-mcp-server\"\n ],\n \"env\": {\n \"DATUM_SIGNER_KEY\": \"\"\n }\n }\n }\n}" ``` **Credentials it will ask for** (names only — Forge never holds a value): - `DATUM_SIGNER_KEY` — Datum Signer Key (optional) Placeholders only. Forge never holds, brokers, or transmits a credential value — replace each in your own config file. Do not send a value back to Forge; no Forge endpoint accepts one. - This entry needs 1 credential (0 required). The generated config carries placeholders, so it will fail in the editor rather than at runtime if they are left unset. ## Blast radius Moderate blast radius — holds an api key; runs on your machine. - Floor 23, ceiling 23 (tier: moderate) - This is impact, not likelihood. A high radius is not a defect: a filesystem server is supposed to write files. It is never part of the trust score. ## Machine-readable views of this entry - Signed JSON: https://forgeregistry.com/api/v1/packages/datum-mcp-server - Install plan: https://forgeregistry.com/api/v1/packages/datum-mcp-server/install-plan - Alternatives: https://forgeregistry.com/api/v1/alternatives/datum-mcp-server - HTML page: https://forgeregistry.com/registry/datum-mcp-server - MCP: POST https://forgeregistry.com/api/mcp → `forge_get_package` / `forge_install_plan` ## About this document Generated by Forge (https://forgeregistry.com) — a compact rendering of the same record served, signed, at the JSON URL above. Trust and scan facts are the registry's own measurements; anything Forge did not measure is named as unmeasured rather than omitted.