Agent-native commerce with trusted catalog, durable carts, and Stripe Checkout via MCP and UCP.
Inferred from the transports this listing declares (streamable-http). A client not listed here hasn’t been ruled out — it just isn’t something Forge can confirm.
Verification confirms publisher identity (repo ownership), not code safety. The security scan covers known CVEs and suspicious install scripts.
Read out of the source npm actually ships, at scan time. The package was never executed. Tools registered dynamically at runtime, or hidden inside bundled or minified code, can be missed — so this is a floor on the tool surface, not a complete census of it.
vibecart.list_productsLists products from the configured trusted merchant catalog. Use the returned stable IDs for product lookup or checkout.Lists products from the configured trusted merchant catalog. Use the returned stable IDs for product lookup or checkout.
No input schema was published for this tool.
vibecart.get_productLooks up one product and its trusted USD-cent price from the configured merchant catalog. Does not access Stripe or create a checkout.Looks up one product and its trusted USD-cent price from the configured merchant catalog. Does not access Stripe or create a checkout.
No input schema was published for this tool.
vibecart.get_integration_instructionsReturns concise Next.js App Router guidance for installing VibeCart with trusted catalog pricing, multi-item checkout, and the shared MCP endpoint.Returns concise Next.js App Router guidance for installing VibeCart with trusted catalog pricing, multi-item checkout, and the shared MCP endpoint.
No input schema was published for this tool.
vibecart.create_checkoutCreates a hosted checkout URL for one or more trusted merchant-catalog products. Legacy productId + quantity input remains supported; new integrations should use items[]. VibeCart resolves all prices server-side. This can contact Stripe but never charges by itself; the customer must complete Stripe…Creates a hosted checkout URL for one or more trusted merchant-catalog products. Legacy productId + quantity input remains supported; new integrations should use items[]. VibeCart resolves all prices server-side. This can contact Stripe but never charges by itself; the customer must complete Stripe…
No input schema was published for this tool.
search_catalogSearch the merchant catalog using the UCP Catalog Search capability.Search the merchant catalog using the UCP Catalog Search capability.
No input schema was published for this tool.
lookup_catalogLook up one or more merchant catalog products by stable identifier.Look up one or more merchant catalog products by stable identifier.
No input schema was published for this tool.
get_productGet one merchant catalog product by stable identifier.Get one merchant catalog product by stable identifier.
No input schema was published for this tool.
get_orderGet the current state of a paid order using the UCP Order capability.Get the current state of a paid order using the UCP Order capability.
No input schema was published for this tool.
create_cartCreate a durable UCP cart using trusted merchant catalog pricing.Create a durable UCP cart using trusted merchant catalog pricing.
No input schema was published for this tool.
get_cartGet the current state of a durable UCP cart.Get the current state of a durable UCP cart.
No input schema was published for this tool.
update_cartReplace the contents of a durable UCP cart.Replace the contents of a durable UCP cart.
No input schema was published for this tool.
cancel_cartCancel a durable UCP cart and return its state before invalidation.Cancel a durable UCP cart and return its state before invalidation.
No input schema was published for this tool.
12 of 12 tools published a description.
Tool names and descriptions are written by the publisher and shown verbatim as inert text. They are the strings an MCP client passes to a model, so Forge scans them for prompt-injection patterns — any finding appears with the security scan above. “Privileged” is a keyword match on the tool name, not an audit of what the tool does: a benign-sounding name can still do anything.
Agent-native commerce with trusted catalog, durable carts, and Stripe Checkout via MCP and UCP.
Linked names open Forge’s index of every entry observed exposing that tool. Browse all indexed tools.
This entry publishes no npm package, so Forge has no dependency tree for it. That is a gap in coverage — not a statement that it has no dependencies.