
Security News
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
@agentutility/mcp-retail
Advanced tools
MCP server for the @agentutility retail cluster — pay-per-call x402 tools, no API keys, USDC on Base.
Product copy + product discovery, per call.
Turn a product name into a marketing-ready description and selling points, and turn a shopping query into ranked products with buy links and prices. The e-commerce primitives a shopping or merchandising agent needs.
Pricing: pay-per-call in USDC on Base. No subscriptions, no API keys. See per-tool prices below.
Edit ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):
{
"mcpServers": {
"agentutility-retail": {
"command": "npx",
"args": ["-y", "@agentutility/mcp-retail"],
"env": { "X402_PRIVATE_KEY": "0xYOUR_PRIVATE_KEY_HEX" }
}
}
}
Restart Claude Desktop. 5 tools appear in the tool palette.
Add to .cursor/mcp.json:
{
"mcpServers": {
"agentutility-retail": {
"command": "npx",
"args": ["-y", "@agentutility/mcp-retail"],
"env": { "X402_PRIVATE_KEY": "0x..." }
}
}
}
Send any amount of USDC on Base mainnet to the address derived from your X402_PRIVATE_KEY. The MCP server uses it to pay for tool calls automatically.
USDC on Base contract: 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913
| Tool | Description |
|---|---|
find-products | (0.02 USDC/call) Find products API (alias of product-search). Returns ranked product results with buy links, retailer, snippet, and detected price for a shopping query. Backed by Decodo Google search scoped to buy intent. |
product-describe | (0.01 USDC/call) Product description generator / e-commerce copywriter / product listing copy / selling points API. Given a product name (and optional category, audience, attributes), returns a conversion-focused description, bullet selling points, key features, a positioning angle, and suggested listing titles. LLM-backed (Morpheus primary, Venice fallback). Generates copy from supplied facts; does not invent specs or claims. |
product-description | (0.01 USDC/call) Product description API (alias of product-describe). Turns a product name + attributes into a marketing-ready description, selling points, key features, and listing titles. LLM-backed; copy from supplied facts only. |
product-search | (0.02 USDC/call) Product search / shopping search API / find products + buy links for agents. Given a product query (and optional retailer), returns ranked shopping results with product title, buy link, retailer domain, snippet, and any detected price. Backed by Decodo Google search scoped to buy intent. For general web search use search/web-search. |
shop-search | (0.02 USDC/call) Shopping search API (alias of product-search). Find products and buy links for a query with title, buy link, retailer, snippet, and detected price. Backed by Decodo Google search scoped to buy intent. |
find-products).https://x402.agentutility.ai/find-products.X402_PRIVATE_KEY and retries.The agent never sees the payment flow — it just gets the result.
Version: 0.1.0 · License: MIT
FAQs
MCP server for the @agentutility retail cluster — pay-per-call x402 tools, no API keys, USDC on Base.
The npm package @agentutility/mcp-retail receives a total of 0 weekly downloads. As such, @agentutility/mcp-retail popularity was classified as not popular.
We found that @agentutility/mcp-retail demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.

Research
/Security News
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.