# io.bosonprotocol/agentic-commerce

MCP server for Boson Protocol — on-chain agentic commerce for physical & digital goods.

- **Type:** MCP server
- **Trust:** 60/100 (B), scored on the content rubric
- **Verification:** community-indexed — nobody has claimed this listing
- **Version:** 1.0.0
- **Author:** io.bosonprotocol
- **License:** Unknown
- **Endpoints:** streamable-http https://mcp.bosonprotocol.io/mcp
- **Source:** https://docs.bosonprotocol.io/mcp
- **Endpoint health:** reachable (last checked 2026-09-13T12:17:20.313Z, 4 samples) — uptime is not a security property and is not part of the trust score
- **Compatible clients:** claude-code, cursor, copilot, chatgpt, gemini (basis: transport)

## Trust

60/100 (B), scored on the content rubric
- Publisher verified: no
- Install scripts: nothing suspicious found
- Prompt-injection scan: clean
- Obfuscation scan: clean
- Evidence age: 1 day

## Security scan

- **Status:** clean
- **Scanned:** 2026-09-13T12:17:20.313Z
- **Version scanned:** live
- **CVEs:** no coverage — this entry has no package coordinates to query OSV against, so "no known CVEs" is NOT asserted for it.

## Tools

63 declared. Observed from a live `tools/list` probe.
- `get_config_ids` — Returns all valid configId values for this server. Call first to discover which network/deployment to use. No auth required.
- `get_funds` — Reads treasury fund balances for sellers and buyers from the Boson subgraph. Supports pagination/ordering/filtering. Read-only — signerAddress not required. Ret
- `get_disputes` — Reads dispute records from the Boson subgraph. Supports pagination, ordering, and filtering by buyer/seller/state. Read-only. Returns: array of dispute entities
- `get_dispute_by_id` — Reads a single dispute by its ID (equals the exchangeId). Read-only. Returns: dispute entity with state, timeout, buyerPercent. Use get_disputes to search first
- `get_exchanges` — Reads exchange records (offer commitments) from the Boson subgraph. Filter by buyer/seller/state. Read-only. Returns: array of exchanges with offerId, state (Co
- `get_offers` — Reads offer listings from the Boson subgraph. Supports pagination, ordering, and filtering (e.g. by sellerId). Read-only. Returns: array of offers with price, d
- `get_sellers` — Reads seller account entities from the Boson subgraph. Optionally includes related offers, exchanges, funds, and logs. Read-only. Returns: array of seller entit
- `get_dispute_resolvers` — Reads registered dispute resolver entities. Use this to find a valid disputeResolverId for create_offer. Read-only. Returns: array of resolvers with ID, fees, e
- `create_offer` — Creates a product offer. Caller must have a seller account (create_seller first). Prerequisite: store metadata first with store_product_v1_metadata or store_bas
- `create_offer_with_condition` — Creates an offer gated by token-ownership (e.g. hold an ERC-721 to commit). Same prerequisites as create_offer plus a condition object specifying the gate token
- `create_buyer` — Creates a buyer account for signerAddress. Required before a buyer can commit to seller-initiated offers for the first time. No prerequisites. Returns unsigned 
- `sign_full_offer` — Generates EIP-712 typed data for a non-listed (private) offer that the offer creator must sign. Call before create_offer_and_commit or void_non_listed_offer. Re
- `create_offer_and_commit` — Atomically creates a private offer and commits a specific buyer in one transaction. Prerequisite: call sign_full_offer, sign the returned typed data locally wit
- `create_offer_commit_and_redeem` — Atomically creates a private offer, commits a specific buyer, and immediately redeems the voucher in a single transaction via the OrchestrationHandler. Same pre
- `void_offer` — Voids a listed offer so it can no longer be committed to. Caller must be the seller assistant. Existing exchanges are unaffected. Returns unsigned transaction d
- `void_non_listed_offer` — Voids a private (non-listed) offer before it is fulfilled. Prerequisite: call sign_full_offer and sign the returned typed data locally with your wallet (EIP-712
- `void_non_listed_offer_batch` — Voids multiple private offers atomically. Same prerequisite as void_non_listed_offer, but for an array of full offer objects. Returns unsigned transaction data.
- `create_seller` — Creates a seller account on Boson Protocol. Required before creating any offers. signerAddress is automatically set as admin, assistant, and treasury. Provide s
- `update_seller` — Updates an existing seller account. Caller must be the current seller admin (signerAddress). Use get_sellers_by_address to retrieve the seller id first. Returns
- `send_signed_transaction` — Broadcasts a signed raw Ethereum transaction to the network. signedTransaction must be 0x-prefixed RLP-encoded hex obtained from local wallet signing (e.g. ethe
- `send_meta_transaction` — Relays a pre-signed meta-transaction via Biconomy so the user pays no gas. Requires sigR/sigS/sigV from a locally-signed EIP-712 payload. Use when the target op
- `send_native_meta_transaction` — Relays a native meta-transaction (EIP-712 signed function call) via Biconomy. Requires ABI-encoded function signature and sigR/sigS/sigV from a locally-signed E
- `send_forwarded_meta_transaction` — Relays a Biconomy forwarded meta-transaction (ERC-20 gas payment). Requires a complete ERC20ForwardRequest and domain separator signature. Returns: relay transa
- `withdraw_funds` — Withdraws funds from an entity's protocol treasury to the entity's treasury address. Sellers withdraw proceeds; buyers withdraw refunds. Caller must control the
- `deposit_funds` — Deposits ERC-20 or native tokens into an entity's protocol treasury (e.g. seller deposit). For ERC-20, call approve_exchange_token first. Returns unsigned trans
- `extend_dispute_timeout` — Extends the deadline of an active dispute. Dispute must be in 'Resolving' state. Either party can call this. Returns unsigned transaction data.
- `expire_dispute` — Marks a dispute as expired after its resolution period passes. Permissionless — anyone can call. Exchange must be in 'Disputed' state past its timeout. Returns 
- `expire_dispute_batch` — Marks multiple expired disputes in one transaction. All exchanges must be in 'Disputed' state past their respective timeouts. Permissionless. Returns unsigned t
- `resolve_dispute` — Resolves a dispute by mutual agreement. Workflow: (1) create_dispute_resolution_proposal generates typed data, (2) both parties sign the typed data locally with
- `raise_dispute` — Raises a dispute on a redeemed exchange. Caller must be the buyer. Must be called within disputePeriodDurationInMS after redemption. Returns unsigned transactio
- `retract_dispute` — Retracts a raised dispute, releasing seller deposit and restoring completion flow. Caller must be the buyer who raised it. Returns unsigned transaction data.
- `escalate_dispute` — Escalates a stale dispute to the third-party dispute resolver. Caller must be the buyer. Resolver's escalation fee must be covered. Returns unsigned transaction
- `decide_dispute` — Decides an escalated dispute. Caller must be the dispute resolver assigned to the offer's disputeResolverId. Specify buyerPercent in basis points (0=all to sell
- `refuse_escalated_dispute` — Dispute resolver refuses to decide an escalated dispute. Returns the escalation fee to the buyer and resets dispute to 'Resolving' state. Returns unsigned trans
- `expire_escalated_dispute` — Expires an escalated dispute once the resolver's response period passes without a decision. Permissionless — anyone can call. Returns unsigned transaction data.
- `create_dispute_resolution_proposal` — Generates EIP-712 typed data for a mutual dispute resolution proposal. Both buyer and seller must sign the same buyerPercentBasisPoints value locally with their
- `revoke_voucher` — Revokes a committed (not yet redeemed) voucher on behalf of the seller, returning funds to the buyer. Caller must be the seller assistant. Returns unsigned tran
- `approve_exchange_token` — Grants ERC-20 allowance to the Boson Protocol contract. Must be called before commit_to_offer or deposit_funds when using non-native exchange tokens. Returns un
- `sign_receive_with_erc3009_authorization` — Generates EIP-712 typed data for an ERC-3009 ReceiveWithAuthorization (e.g. USDC). Authorizes the spender (default: protocol diamond) to pull `value` from signe
- `sign_receive_with_erc2612_permit` — Generates EIP-712 typed data for an EIP-2612 Permit. Authorizes the spender (default: protocol diamond) to pull `value` from signerAddress until `deadline`. Sig
- …and 23 more

## Install

**Verdict: review** — Installable, but 2 things to check first: No CVE coverage: this entry has no npm/PyPI coordinates to query OSV against, so "no known vulnerabilities" is not a claim that can be made about it.
**Cautions** (coverage gaps and advisories — never blocking)
- No CVE coverage: this entry has no npm/PyPI coordinates to query OSV against, so "no known vulnerabilities" is not a claim that can be made about it.
- No publisher has proved control of this listing; it is indexed, not vouched for.
**Config** (claude-code):
```json
"{\n  \"mcpServers\": {\n    \"agentic-commerce\": {\n      \"type\": \"http\",\n      \"url\": \"https://mcp.bosonprotocol.io/mcp\"\n    }\n  }\n}"
```

## Blast radius

Contained to moderate — no credential declaration found, from the publisher, the upstream registry, or the README. Known so far: runs on someone else's infrastructure; read-only tool surface.
- Floor 9, ceiling 27 (tier: unknown)
- `unknown` means the floor and ceiling land in different bands — not measured enough to name one. It does not mean low.
- This is impact, not likelihood. A high radius is not a defect: a filesystem server is supposed to write files. It is never part of the trust score.

## Machine-readable views of this entry

- Signed JSON: https://forgeregistry.com/api/v1/packages/io.bosonprotocol%2Fagentic-commerce
- Install plan: https://forgeregistry.com/api/v1/packages/io.bosonprotocol%2Fagentic-commerce/install-plan
- Alternatives: https://forgeregistry.com/api/v1/alternatives/io.bosonprotocol%2Fagentic-commerce
- HTML page: https://forgeregistry.com/registry/io.bosonprotocol%2Fagentic-commerce
- MCP: POST https://forgeregistry.com/api/mcp → `forge_get_package` / `forge_install_plan`

## About this document

Generated by Forge (https://forgeregistry.com) — a compact rendering of the same record served, signed, at the JSON URL above. Trust and scan facts are the registry's own measurements; anything Forge did not measure is named as unmeasured rather than omitted.