
Research
/Security News
OpenAPI React Query Codegen Compromised in Mini Shai-Hulud npm Supply Chain Attack
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.
@agentpromocode/mcp
Advanced tools
Stdio MCP server for agent checkout: resolve plausible public promo offers, then report whether the offer worked.
{
"mcpServers": {
"agentpromocode": {
"command": "npx",
"args": ["-y", "@agentpromocode/mcp"],
"env": {
"AGENTPROMOCODE_API_KEY": "apc_...",
"AGENTPROMOCODE_API_BASE": "https://api.agentpromocode.com"
}
}
}
}
Add this server to your Cursor MCP configuration:
{
"mcpServers": {
"agentpromocode": {
"command": "npx",
"args": ["-y", "@agentpromocode/mcp"],
"env": {
"AGENTPROMOCODE_API_KEY": "apc_...",
"AGENTPROMOCODE_API_BASE": "https://api.agentpromocode.com"
}
}
}
}
resolveCalls POST /v1/resolve.
Input:
{
"domain": "nike.com",
"basket": { "value": 99, "currency": "USD" },
"agent_id": "optional-agent-id"
}
Returns ranked offer candidates, confidence labels, and an attribution_token.
feedbackCalls POST /v1/feedback.
Input:
{
"attribution_token": "atk_...",
"code": "WELCOME10",
"outcome": "worked",
"basket_value": 99,
"geo": "US"
}
outcome must be one of worked, expired, ineligible, or error.
AGENTPROMOCODE_API_KEY (required)AGENTPROMOCODE_API_BASE (optional, default https://api.agentpromocode.com)/v1/feedback is mandatory. Sustained low feedback-to-resolve ratio can suspend the API key because feedback is what turns unverified public offers into a reliable agent-commerce dataset.
This package is an MCP wrapper around the Agent Commerce Discount Protocol (ACDP) reference implementation.
https://github.com/agentpromocode/acdphttps://api.agentpromocode.com/openapi.jsonhttps://agentpromocode.com/llms.txtpnpm install
pnpm build
AGENTPROMOCODE_API_KEY=apc_... node dist/index.js
pnpm build
npm publish --access public
MIT.
FAQs
MCP server for agentpromocode.com — resolve + feedback tools
The npm package @agentpromocode/mcp receives a total of 16 weekly downloads. As such, @agentpromocode/mcp popularity was classified as not popular.
We found that @agentpromocode/mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.

Security News
Socket joins more than 100 technology, cybersecurity, and financial organizations calling for a global surge in cyber defense.

Product
Enterprise security teams can now detect malware, credential theft, suspicious network activity, and risky updates across Microsoft Edge extensions.