
Research
/Security News
PolinRider Spreads Through Compromised GitHub Accounts and Packagist
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.
@buywhere/mcp-server
Advanced tools
Agent-native product catalog API and MCP server for cross-border search and price comparison. 50M+ products across 6 markets. Works with Claude Desktop, Cursor, VS Code, Cline, and any MCP-compatible client.
Agent-native product catalog API — 50M+ products, real-time pricing, cross-border search for AI agents via Model Context Protocol.
Works with Claude Desktop, Cursor, VS Code Copilot, Cline, OpenCode, Codex, and any MCP-compatible client.
npm install -g @buywhere/mcp-server
Or run directly:
npx @buywhere/mcp-server
Get a free API key → buywhere.ai/api-keys

44-second demo: product search, deal discovery, price comparison, and multi-region support.
User: "Find me wireless earbuds under $50 available in Singapore"
Agent: [calls search_products → returns 5 matching products]
User: "Compare the top 3"
Agent: [calls compare_prices → side-by-side with best-value pick]
| Tool | Description |
|---|---|
search_products | Search catalog by keyword, category, price, region |
get_product | Full product details by ID (prices, specs, images) |
compare_prices | Side-by-side comparison of 2–5 products |
get_price | Current prices across all merchants for one product |
get_affiliate_link | Click-tracked affiliate URL for a product |
get_catalog | Available product category taxonomy |
Add to claude_desktop_config.json:
{
"mcpServers": {
"buywhere": {
"command": "npx",
"args": ["-y", "@buywhere/mcp-server"],
"env": { "BUYWHERE_API_KEY": "bw_live_xxxx" }
}
}
}
Same config — add to your MCP settings file:
{
"mcpServers": {
"buywhere": {
"command": "npx",
"args": ["-y", "@buywhere/mcp-server"],
"env": { "BUYWHERE_API_KEY": "bw_live_xxxx" }
}
}
}
| Variable | Default | Description |
|---|---|---|
BUYWHERE_API_KEY | (required) | API key from buywhere.ai/api-keys |
BUYWHERE_API_URL | https://api.buywhere.ai/mcp | Custom API base URL |
git clone https://github.com/BuyWhere/buywhere-mcp.git
cd buywhere-mcp
npm install
npm run build
npm start
The first agent-native cross-border product catalog API. 50M+ products indexed from 3,700+ retailers across Singapore, Southeast Asia, and US markets — all through a single MCP server.
npx @buywhere/mcp-server, no SDK neededBuyWhere also supports the Agent-to-Agent (A2A) protocol for multi-agent task delegation. View our Agent Card at /.well-known/agent.json.
See CONTRIBUTING.md for how to report issues, submit PRs, and suggest features.
If you find this project useful:
MIT
FAQs
Stdio bridge to the hosted BuyWhere MCP server — 300M+ products, 150,000+ stores, deliver_to ranking.
The npm package @buywhere/mcp-server receives a total of 107 weekly downloads. As such, @buywhere/mcp-server popularity was classified as not popular.
We found that @buywhere/mcp-server demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.

Company News
Allow myself to introduce... myself.