Vtex (leosepulveda) MCP Server
mcp-vtex
npm
v1.6.0
Published by leosepulveda — no publish provenance, so origin is unverified, but the source is public: the repository link below is self-declared yet readable, so you can inspect the code before adopting it.
MCP server for VTEX API - Complete integration for e-commerce management
The grade answers one question — how safe is this server for you to adopt — so it is computed in two auditable stages. Nothing below is an opinion or an LLM's guess; every line is a real term the deterministic engine applied, and the same input always yields the same number.
1. Threat score — 100 − 0 = 100. What the published surface and source actually contain:
The deterministic scan raised no scored threat in the surface it inspected — the threat score stayed at 100. Capability observations and advisory notes are recorded but never lower it.
2. Client adoption risk — 100 − 4 = 96. Three small, subtract-only factors that reflect your risk in adopting it — a clean scan proves less on a powerful, unverified or barely-inspectable package, so the grade says so plainly:
| Points | Adoption-risk factor |
|---|---|
| −3 | capability blast radius (moderate) — client exposure if the model is manipulated |
| −1 | publisher verification (public source) — no provenance, but the source is public and inspectable |
Capability observations and info notes are shown under Findings but never scored.
Open any row's finding below for the file, line and evidence behind a deduction.
Findings 1
medium Hardcoded egress to an external endpoint (dist/vtex-client.js)MTC-SRC-003
In the server's implementation (`dist/vtex-client.js:885`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: const response = await axios.get(`https://${this.accountName}.${this.environment}.com.br/api/checkout/pub/orderForm/${o
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server dist/vtex-client.js
Tools 131
Each tool and what it can reach — statically extracted from the published source.
vtex_send_emailnetwork egressvtex_add_coupon_to_cartno sensitive capabilityvtex_add_item_to_cartno sensitive capabilityvtex_approve_reviewno sensitive capabilityvtex_approve_skuno sensitive capabilityvtex_archive_couponno sensitive capabilityvtex_archive_promotionno sensitive capabilityvtex_assign_sku_specification_valueno sensitive capabilityvtex_authenticate_userno sensitive capabilityvtex_autocompleteno sensitive capability
Show 121 more tools ↓
vtex_cancel_orderno sensitive capabilityvtex_cancel_subscriptionno sensitive capabilityvtex_clear_cartno sensitive capabilityvtex_create_app_tokenno sensitive capabilityvtex_create_brandno sensitive capabilityvtex_create_categoryno sensitive capabilityvtex_create_cms_templateno sensitive capabilityvtex_create_couponno sensitive capabilityvtex_create_dockno sensitive capabilityvtex_create_documentno sensitive capabilityvtex_create_email_templateno sensitive capabilityvtex_create_gift_cardno sensitive capabilityvtex_create_gift_card_transactionno sensitive capabilityvtex_create_or_update_priceno sensitive capabilityvtex_create_payment_providerno sensitive capabilityvtex_create_productno sensitive capabilityvtex_create_promotionno sensitive capabilityvtex_create_reviewno sensitive capabilityvtex_create_skuno sensitive capabilityvtex_create_specificationno sensitive capabilityvtex_create_specification_fieldno sensitive capabilityvtex_create_specification_field_valueno sensitive capabilityvtex_create_specification_groupno sensitive capabilityvtex_create_subscriptionno sensitive capabilityvtex_create_warehouseno sensitive capabilityvtex_delete_brandno sensitive capabilityvtex_delete_categoryno sensitive capabilityvtex_delete_cms_templateno sensitive capabilityvtex_delete_dockno sensitive capabilityvtex_delete_documentno sensitive capabilityvtex_delete_payment_providerno sensitive capabilityvtex_delete_priceno sensitive capabilityvtex_delete_productno sensitive capabilityvtex_delete_reviewno sensitive capabilityvtex_delete_warehouseno sensitive capabilityvtex_deny_skuno sensitive capabilityvtex_get_brandno sensitive capabilityvtex_get_categoryno sensitive capabilityvtex_get_client_by_emailno sensitive capabilityvtex_get_cms_templateno sensitive capabilityvtex_get_computed_priceno sensitive capabilityvtex_get_couponno sensitive capabilityvtex_get_dockno sensitive capabilityvtex_get_documentno sensitive capabilityvtex_get_email_templateno sensitive capabilityvtex_get_facetsno sensitive capabilityvtex_get_gift_cardno sensitive capabilityvtex_get_gift_card_by_codeno sensitive capabilityvtex_get_inventoryno sensitive capabilityvtex_get_orderno sensitive capabilityvtex_get_orderformno sensitive capabilityvtex_get_payment_providerno sensitive capabilityvtex_get_priceno sensitive capabilityvtex_get_productno sensitive capabilityvtex_get_product_and_sku_idsno sensitive capabilityvtex_get_product_by_identifierno sensitive capabilityvtex_get_promotionno sensitive capabilityvtex_get_reviewno sensitive capabilityvtex_get_review_summaryno sensitive capabilityvtex_get_segmentno sensitive capabilityvtex_get_seller_commissionsno sensitive capabilityvtex_get_sessionno sensitive capabilityvtex_get_skuno sensitive capabilityvtex_get_sku_approval_statusno sensitive capabilityvtex_get_sku_by_refidno sensitive capabilityvtex_get_sku_specificationsno sensitive capabilityvtex_get_specification_fieldno sensitive capabilityvtex_get_subscriptionno sensitive capabilityvtex_get_transactionno sensitive capabilityvtex_get_user_profileno sensitive capabilityvtex_get_warehouseno sensitive capabilityvtex_invite_sellerno sensitive capabilityvtex_invoice_orderno sensitive capabilityvtex_list_app_tokensno sensitive capabilityvtex_list_brandsno sensitive capabilityvtex_list_categoriesno sensitive capabilityvtex_list_category_specificationsno sensitive capabilityvtex_list_cms_templatesno sensitive capabilityvtex_list_couponsno sensitive capabilityvtex_list_docksno sensitive capabilityvtex_list_email_templatesno sensitive capabilityvtex_list_gift_card_providersno sensitive capabilityvtex_list_gift_cardsno sensitive capabilityvtex_list_inventory_by_warehouseno sensitive capabilityvtex_list_ordersno sensitive capabilityvtex_list_payment_methodsno sensitive capabilityvtex_list_payment_providersno sensitive capabilityvtex_list_pricesno sensitive capabilityvtex_list_productsno sensitive capabilityvtex_list_promotionsno sensitive capabilityvtex_list_reviewsno sensitive capabilityvtex_list_sellersno sensitive capabilityvtex_list_skusno sensitive capabilityvtex_list_specification_field_valuesno sensitive capabilityvtex_list_specification_groupsno sensitive capabilityvtex_list_subscriptionsno sensitive capabilityvtex_list_warehousesno sensitive capabilityvtex_pause_subscriptionno sensitive capabilityvtex_remove_item_from_cartno sensitive capabilityvtex_search_documentsno sensitive capabilityvtex_search_productsno sensitive capabilityvtex_simulate_shippingno sensitive capabilityvtex_start_handlingno sensitive capabilityvtex_unarchive_promotionno sensitive capabilityvtex_update_brandno sensitive capabilityvtex_update_categoryno sensitive capabilityvtex_update_dockno sensitive capabilityvtex_update_documentno sensitive capabilityvtex_update_email_templateno sensitive capabilityvtex_update_inventoryno sensitive capabilityvtex_update_item_quantityno sensitive capabilityvtex_update_payment_providerno sensitive capabilityvtex_update_productno sensitive capabilityvtex_update_promotionno sensitive capabilityvtex_update_reviewno sensitive capabilityvtex_update_seller_commissionno sensitive capabilityvtex_update_sessionno sensitive capabilityvtex_update_skuno sensitive capabilityvtex_update_subscriptionno sensitive capabilityvtex_update_warehouseno sensitive capabilityvtex_validate_tokenno sensitive capability
What this scan could not see
- Tools were statically extracted from the published source (131 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command "npx -y <package>".
Versions 1
Scan history per published version. The engine is deterministic — the same version always yields the same score, so a changed score means the package itself changed.
| Version | Score | Findings | Engine | Scanned |
|---|---|---|---|---|
v1.6.0 latest |
A 96/100 | 1 | 1.13.0 | 2026-09-07 |
Embed this score
Show this server's live Trust Score in your README, docs or website. The badge is served straight from the registry and updates automatically after every rescan — no API key needed. It links back to this page, so anyone who sees the grade can also read the findings behind it instead of taking a number on faith.
Verify this score yourself
The score above is reproducible: the same package version always yields the same result. Run it locally or over the free API — no account, no LLM, fully deterministic.
npx mcptrustchecker scan mcp-vtex --onlineOther implementations of Vtex 3
Independent packages implementing the same tool, scanned with the same engine. Compare all 4 side by side →
MCP server for VTEX API integration
MCP Server for VTEX APIs - Comprehensive integration with VTEX e-commerce platform providing 163+ API endpoints
An MCP wrapper for VTEX Commerce APIs
More in Productivity & Workflow
MCP AgentChat - 让 AI Agent 通过 Telegram 与用户实时交互：发送消息、图片，等待用户回复
A Model Context Protocol (MCP) server for Airthings Air Quality Monitor devices.
MCP server for Anki
TypeScript package for reading and searching Apple Notes on macOS via direct SQLite access. Includes markdown conversion, attachment support, and offers a local MCP server!
Verified biotech catalyst calendar (PDUFA/AdComm/trial readouts) anchored to official sources.
Appointment booking platform letting agents check provider availability and create bookings.