# global.rootz.cars/marketplace AI-native used car marketplace. 145K+ vehicles, 4300+ dealers, 13 US states, 20 MCP tools. - **Type:** MCP server - **Trust:** 60/100 (B), scored on the content rubric - **Verification:** community-indexed — nobody has claimed this listing - **Version:** 1.0.0 - **Author:** global.rootz.cars - **License:** Unknown - **Endpoints:** streamable-http https://cars.rootz.global/mcp - **Source:** https://cars.rootz.global/mcp - **Endpoint health:** reachable (last checked 2026-10-04T15:20:02.195Z, 6 samples) — uptime is not a security property and is not part of the trust score - **Source link:** currently failing its liveness check - **Compatible clients:** claude-code, cursor, copilot, chatgpt, gemini (basis: transport) ## Trust 60/100 (B), scored on the content rubric - Publisher verified: no - Install scripts: nothing suspicious found - Prompt-injection scan: clean - Obfuscation scan: clean - Evidence age: 36 days ## Security scan - **Status:** clean - **Scanned:** 2026-08-30T12:14:16.710Z - **Version scanned:** live - **CVEs:** no coverage — this entry has no package coordinates to query OSV against, so "no known CVEs" is NOT asserted for it. ## Tools 19 declared. Observed from a live `tools/list` probe. - `cars_search` — Search used car inventory across all dealers. Filter by make, model, year, price, mileage, location, body type, fuel type, drivetrain. Returns matching vehicles - `cars_vehicle` — Get full details for a specific vehicle by VIN. Returns specs, price, mileage, photos, recalls, and dealer info. - `cars_dealers` — Search for car dealers by city, state, or ZIP code. - `cars_dealer_inventory` — Get all vehicles at a specific dealer. - `cars_history` — Get the full history of a vehicle by VIN — every dealer it appeared at, price changes over time, days on market, whether it was sold and resurfaced elsewhere. D - `cars_stats` — Get database statistics: total vehicles, dealers, coverage by state, top makes. - `cars_session_create` — Create a personalized car research session for the buyer. Returns a unique URL they can bookmark and return to. As you help the buyer, naturally learn their sit - `cars_session_read` — Read the current state of a shopping session — tracked vehicles, messages, preferences, active offers, and which other AI agents are working on it. Use this to - `cars_session_add_car` — Add a vehicle to the buyer's shopping session. Include a fit score (1-10) and notes explaining why you recommend it. - `cars_session_interest` — Signal buyer interest in a vehicle to the dealer. This sends a professional email to the dealership on the buyer's behalf. Only use when the buyer has explicitl - `cars_session_message` — Post a message to the session. Use for buyer questions, AI analysis notes, or responses. The dealer and other AI agents can see these. - `cars_session_compare` — Get a structured comparison of all vehicles tracked in a session — specs, pricing, market context side by side. Great for helping the buyer decide. - `cars_session_deal` — Get the current deal status — offers received, messages exchanged, unread count. Use to check if the dealer has responded. - `cars_session_reply` — Send a follow-up message to the dealer continuing the conversation. Use this after the dealer has replied and the buyer wants to respond — negotiate price, ask - `cars_session_notify` — Set the buyer's email notification preference for this session. Three levels: "bcc" (buyer gets a private copy of dealer replies — dealer never sees buyer email - `cars_session_tradein` — Set or update the buyer's trade-in vehicle information. Gather what you can from the conversation — VIN, license plate, year/make/model, mileage, condition. You - `cars_session_tradein_read` — Read the buyer's trade-in vehicle profile. Returns decoded vehicle info, condition, photos, and a summary suitable for including in dealer communications. Also - `cars_feedback` — Submit feedback about the Cars Rootz service. We actively read every piece of feedback to improve the service. Tell us what worked, what didn't, what's missing, - `cars_session_visit` — Schedule a dealer visit (test drive, purchase, trade-in appraisal). Generates a visit code and QR code the buyer shows at the dealership. This is how the dealer ## Install **Verdict: review** — Installable, but 2 things to check first: No CVE coverage: this entry has no npm/PyPI coordinates to query OSV against, so "no known vulnerabilities" is not a claim that can be made about it. **Cautions** (coverage gaps and advisories — never blocking) - No CVE coverage: this entry has no npm/PyPI coordinates to query OSV against, so "no known vulnerabilities" is not a claim that can be made about it. - No publisher has proved control of this listing; it is indexed, not vouched for. **Config** (claude-code): ```json "{\n \"mcpServers\": {\n \"marketplace\": {\n \"type\": \"http\",\n \"url\": \"https://cars.rootz.global/mcp\"\n }\n }\n}" ``` ## Blast radius Contained to moderate — no credential declaration found, from the publisher, the upstream registry, or the README. Known so far: runs on someone else's infrastructure; read-only tool surface. - Floor 9, ceiling 27 (tier: unknown) - `unknown` means the floor and ceiling land in different bands — not measured enough to name one. It does not mean low. - This is impact, not likelihood. A high radius is not a defect: a filesystem server is supposed to write files. It is never part of the trust score. ## Machine-readable views of this entry - Signed JSON: https://forgeregistry.com/api/v1/packages/global.rootz.cars%2Fmarketplace - Install plan: https://forgeregistry.com/api/v1/packages/global.rootz.cars%2Fmarketplace/install-plan - Alternatives: https://forgeregistry.com/api/v1/alternatives/global.rootz.cars%2Fmarketplace - HTML page: https://forgeregistry.com/registry/global.rootz.cars%2Fmarketplace - MCP: POST https://forgeregistry.com/api/mcp → `forge_get_package` / `forge_install_plan` ## About this document Generated by Forge (https://forgeregistry.com) — a compact rendering of the same record served, signed, at the JSON URL above. Trust and scan facts are the registry's own measurements; anything Forge did not measure is named as unmeasured rather than omitted.