
Security News
Open VSX Unblocks Extension IDs Used in Malware Campaign
Open VSX has removed three extension IDs from its malicious-extension list as the legitimate publishers they impersonated move to claim the names for themselves.
MCP server for K-Shop — connect Cursor, Claude, and AI agents to your commerce platform (admin, storefront, or public catalog)
MCP server for K-Shop — connect Cursor, Claude Desktop, Codex, Windsurf, and other AI agents directly to your commerce platform.
Three servers, one package — select which one to connect to with KADUNO_SERVER:
| Server | KADUNO_SERVER | What it exposes | Auth |
|---|---|---|---|
| Admin | admin | Orders, catalog, inventory, customers, platform settings, super-admin control plane — grouped into ~25 domain-router tools covering 200+ actions | API key (staff/operator/admin/super_admin) |
| Storefront | storefront (default) | Customer shopping — browse, cart, checkout, orders, returns, B2B company purchasing, bookings | Customer JWT or agent API key |
| Public | public | Anonymous catalog browsing + guest checkout — no account required | None (or API key for higher rate limits) |
No clone or install needed — run directly via npx:
{
"mcpServers": {
"kshop": {
"command": "npx",
"args": ["-y", "kaduno-mcp@latest"],
"env": {
"KADUNO_API_KEY": "<your-api-key>",
"KADUNO_SERVER": "storefront"
}
}
}
}
Add multiple entries to connect to more than one server at once (e.g. admin + storefront) — each entry is an independent stdio process:
{
"mcpServers": {
"kshop-admin": {
"command": "npx",
"args": ["-y", "kaduno-mcp@latest"],
"env": {
"KADUNO_API_KEY": "ak_live_...",
"KADUNO_SERVER": "admin"
}
},
"kshop-store": {
"command": "npx",
"args": ["-y", "kaduno-mcp@latest"],
"env": {
"KADUNO_API_KEY": "ak_store_...",
"KADUNO_SERVER": "storefront"
}
}
}
}
Add to ~/.cursor/mcp.json (global) or .cursor/mcp.json (project):
{
"mcpServers": {
"kshop": {
"command": "npx",
"args": ["-y", "kaduno-mcp@latest"],
"env": { "KADUNO_API_KEY": "<your-api-key>", "KADUNO_SERVER": "storefront" }
}
}
}
Add to claude_desktop_config.json (macOS: ~/Library/Application Support/Claude/claude_desktop_config.json):
{
"mcpServers": {
"kshop": {
"command": "npx",
"args": ["-y", "kaduno-mcp@latest"],
"env": { "KADUNO_API_KEY": "<your-api-key>", "KADUNO_SERVER": "admin" }
}
}
}
Add to Windsurf's MCP config (Settings → Advanced → MCP Servers), same JSON shape as Cursor above.
Add to ~/.codex/config.toml:
[mcp_servers.kshop]
command = "npx"
args = ["-y", "kaduno-mcp@latest"]
env = { KADUNO_API_KEY = "<your-api-key>", KADUNO_SERVER = "storefront" }
Run directly over stdio:
KADUNO_API_KEY=<your-api-key> KADUNO_SERVER=storefront npx -y kaduno-mcp@latest
public server access does not require a key| Variable | Required | Default | Description |
|---|---|---|---|
KADUNO_SERVER | No | storefront | Which server to connect to: admin | storefront | public |
KADUNO_API_KEY | Yes, unless KADUNO_SERVER=public | — | Your K-Shop API key or agent key |
KADUNO_API_URL | No | https://kshop.kshop01.kloner.clh.no | K-Shop API base URL (override for self-hosted / other tenants) |
npx kaduno-mcp --help # Show usage help
npx kaduno-mcp --version # Show version
kshop.orders, kshop.catalog,
kshop.inventory, kshop.customers, kshop.platform, kshop.control, plus
kshop.finance, kshop.cms, kshop.faq, kshop.reports, kshop.reach,
kshop.crm, kshop.wms, kshop.purchasing, kshop.notifications,
kshop.alerts, kshop.returns, kshop.work_orders, kshop.booking, and more.kshop.storefront (browse/cart/checkout/orders),
kshop.storefront.b2b (company purchasing), kshop.storefront.booking.kshop.public.catalog, kshop.public.checkout,
kshop.public.booking.action
parameter — dramatically fewer tools in your agent's context windowkshop://docs/quickstart-local resource
works without networkOverride the API URL for self-hosted deployments or staging environments:
{
"mcpServers": {
"kshop": {
"command": "npx",
"args": ["-y", "kaduno-mcp@latest"],
"env": {
"KADUNO_API_KEY": "<your-api-key>",
"KADUNO_SERVER": "storefront",
"KADUNO_API_URL": "https://your-store.kloner.clh.no"
}
}
}
}
"Failed to connect to K-Shop <server> server" — verify the API is
reachable at KADUNO_API_URL, and that KADUNO_API_KEY is valid for the
selected KADUNO_SERVER.
"KADUNO_API_KEY is required when KADUNO_SERVER=admin/storefront" — the public server allows anonymous access; admin and storefront require a key.
Tool not found after a server deploy — the proxy automatically retries once after refreshing its catalog; if it still fails, restart your MCP client to force a fresh connection.
git clone <repo-url>
cd publish/mcp
npm install
npm run dev # Run from source via tsx
npm run build # Compile with tsup
MIT
FAQs
MCP server for K-Shop — connect Cursor, Claude, and AI agents to your commerce platform (admin, storefront, or public catalog)
We found that kaduno-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Open VSX has removed three extension IDs from its malicious-extension list as the legitimate publishers they impersonated move to claim the names for themselves.

Product
Socket’s PHP and Composer support is now in Beta for all customers, with PHP reachability analysis generally available.

Product
Socket is bringing experimental protection to Firefox, scanning 97,000+ extensions in Mozilla's official directory for malware and risky updates.