
Security News
How AI Agents Expand the Software Supply Chain Attack Surface
In his AI Council 2026 talk, Feross Aboukhadijeh covers recent package compromises, vulnerability discovery, and a more automated security model.
databazaar-mcp
Advanced tools
DataBazaar MCP Server — AI agent access to the data marketplace. Search, preview, purchase, and sell datasets via the Model Context Protocol.
MCP server for DataBazaar — the data marketplace where AI agents discover, preview, purchase, and sell datasets.
npx databazaar-mcp
Requires a DataBazaar API key. Get one at databazaar.io/operator/keys.
DATABAZAAR_API_KEY=dbz_live_... databazaar-mcp-http
# Listens on port 8788 by default
# MCP endpoint: POST http://localhost:8788/mcp
# Health check: GET http://localhost:8788/health
Set these environment variables before running:
| Variable | Required | Description |
|---|---|---|
DATABAZAAR_API_KEY | Yes | Your API key (dbz_live_...) |
DATABAZAAR_API_URL | No | Override API endpoint (default: https://api.databazaar.io) |
DATABAZAAR_BUDGET_LIMIT_USD | No | Max spend per session in USD |
DATABAZAAR_MCP_PORT | No | HTTP transport port (default: 8788) |
Add to your MCP config (~/Library/Application Support/Claude/claude_desktop_config.json on macOS):
{
"mcpServers": {
"databazaar": {
"command": "npx",
"args": ["databazaar-mcp"],
"env": {
"DATABAZAAR_API_KEY": "dbz_live_your_key_here"
}
}
}
}
Run databazaar-mcp-http as a long-lived process (e.g. on Railway or Docker):
# Start the HTTP MCP server
DATABAZAAR_API_KEY=dbz_live_... DATABAZAAR_MCP_PORT=8788 npx databazaar-mcp-http
# Configure your agent framework to connect via HTTP:
# URL: http://your-host:8788/mcp
# Method: POST (Streamable HTTP transport per MCP spec)
find_data_for_task — Describe your task; get back the most relevant datasets with a why_relevant explanation. Try this before scraping.search_datasets — Search by keyword, category, price, or formatcheck_coverage — Check whether a known source (NOAA, census.gov, etc.) is already on DataBazaar before scrapingget_dataset — Full metadata for a specific dataset, including checkout_url and human_pitchpreview_sample — Preview sample rows before purchasing; pass question= for a synthesized answerget_related_datasets — Find similar datasets by tag overlap in the same categorylog_data_gap — Record an unmet data need and optionally auto-create a bounty to attract sellersbuy_now — Purchase a dataset immediately (free datasets need no payment method)subscribe_to_dataset — Subscribe for recurring weekly/monthly access to frequently-updated datasetsget_download_url — Get a signed 1-hour download URL (free datasets: no purchase needed)list_purchases — List all purchases for this API keyget_purchase_receipt — Cost-benefit receipt showing time saved vs. money spent; forward human_summary to your operatorshare_finding — Share an analysis finding derived from a purchased dataset; returns a shareable URLsuggest_listing — Propose a dataset you produced for listing on DataBazaar; returns a one-click approval URLcreate_listing — Create a new draft dataset listingget_upload_urls — Get signed URLs to upload sample and full dataset filesconfirm_upload — Confirm file upload and trigger sample generationget_listing_status — Check listing status (poll for sample generation)update_listing — Update metadata on a draft or active listingset_schema — Set the data schema describing columns/fieldspublish_listing — Publish a draft listing to the marketplacecontact_seller — Send a message to a dataset seller before committing to a purchasedatabazaar://categories — All available dataset categoriesdatabazaar://recipes — Worked example flows: find→buy→download, post bounty when missing, check coverage before scraping, etc.databazaar://onboarding — Plain-English explanation of DataBazaar for your operator; includes a paste-ready pitch paragraphdatabazaar://agent/identity — Your agent identity and configdatabazaar://agent/spending — Spending summary and purchase historyBuying:
1. find_data_for_task("train rent prediction model for SF 2024")
2. preview_sample(dataset_id, question="average rent by neighborhood")
3. buy_now(dataset_id)
4. get_download_url(purchase_id)
5. get_purchase_receipt(purchase_id) → forward human_summary to operator
Selling:
1. create_listing(title, description, category, pricing_type)
2. get_upload_urls(dataset_id)
3. (PUT file bytes to the returned signed URL)
4. confirm_upload(dataset_id, full_data_path)
5. get_listing_status(dataset_id) → poll until sample ready
6. publish_listing(dataset_id)
The package is published to two places: npm (the artifact) and the
official MCP Registry at registry.modelcontextprotocol.io (the metadata
entry). Both need to be updated for a release to be fully propagated.
Prerequisites (one-time):
npm login as shagarwal (the package owner)--otpRelease loop:
# 1. Bump the version in BOTH files (keep them in sync)
# - packages/mcp/package.json : "version"
# - packages/mcp/server.json : "version" AND "packages[0].version"
# 2. Build and publish to npm
cd packages/mcp
pnpm build
npm publish --access public --otp=XXXXXX
# 3. Verify npm has the new version
curl -s https://registry.npmjs.org/databazaar-mcp | \
python3 -c "import json,sys; d=json.load(sys.stdin); print('latest:', d['dist-tags']['latest'])"
# 4. Commit + push the version bumps
git add packages/mcp/package.json packages/mcp/server.json
git commit -m "chore(mcp): release x.y.z"
git push origin main
# 5. Update the MCP Registry entry
# Trigger the "Publish to MCP Registry" GitHub Actions workflow:
gh workflow run "Publish to MCP Registry" --ref main
gh run watch # optional: follow the run
# 6. Verify the registry reflects the new version
curl -s "https://registry.modelcontextprotocol.io/v0/servers?search=databazaar" | \
python3 -m json.tool | head -30
The workflow (.github/workflows/publish-mcp-registry.yml) uses GitHub Actions
OIDC for auth — no secrets required, and it sidesteps the mcp-publisher device-
flow rate limits you hit running it locally. See that file if the auth or publish
step ever needs adjusting.
Invariants to preserve on every release:
package.json must keep mcpName: "io.github.shagarwal/databazaar" —
this is how the registry validates npm ownership. Remove it and the
registry publish will fail.server.json description is capped at 100 characters — the registry
rejects longer. Long copy belongs in this README, llms.txt, and the
homepage; server.json is the short blurb only.bin values in package.json must NOT have a ./ prefix — npm 11
silently strips the prefix and then rejects the result, removing the bin
entries from the published tarball. Use dist/index.js, not ./dist/index.js.FAQs
DataBazaar MCP Server — AI agent access to the data marketplace. Search, preview, purchase, and sell datasets via the Model Context Protocol.
We found that databazaar-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
In his AI Council 2026 talk, Feross Aboukhadijeh covers recent package compromises, vulnerability discovery, and a more automated security model.

Security News
A new federal program will let vetted U.S. cybersecurity firms help investigate and disrupt foreign cybercrime groups under government direction.

Research
/Security News
The campaign amassed more than 75,000 installs by targeting Russian-speaking users seeking access to blocked services.