
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
cartscout-mcp
Advanced tools
MCP server that lets AI agents look up live product prices, stock, variants and deals from Shopify, WooCommerce, Walmart, eBay and Amazon stores.
Give Claude, Cursor or any MCP-capable AI agent live product prices, stock, variants and deal ratings from online stores. Paste a product link into the chat and ask "is this a good price?", "which of these three stores is cheapest and in stock?" or "does it come in size 10?".
Works with Shopify, WooCommerce, Walmart and eBay stores, with Amazon in beta. The data comes from the CartScout API, which handles fetching, bot filters and parsing. Try the API in your browser first, no sign-up needed.
| Tool | What the agent gets | Uses |
|---|---|---|
get_product | Price, list price and discount, stock, variants (sizes, colours) with their own price and stock, SKU / GTIN, rating, optional reviews and description | 1 extraction |
compare_products | 2-10 pages ranked: cheapest, cheapest in stock, best rated, biggest discount, price spread, same product by GTIN | 1 extraction per URL, PRO plan or higher |
check_deal | Deal rating of the current price against its recorded history, with average, lowest and highest price | 1 extraction (or none with refresh: false) |
get_price_history | Recorded price and stock changes with current, lowest and highest price | No extractions |
Every tool is read-only and returns structured JSON with an output schema. Responses are trimmed for agents: bulky parts such as all variants, reviews and the description are included only when the agent asks for them.
X-RapidAPI-Key from the RapidAPI dashboard.claude mcp add cartscout -e RAPIDAPI_KEY=your-rapidapi-key -- uvx --from git+https://github.com/Veselin15/cartscout-mcp cartscout-mcp
Settings → Developer → Edit config, then add:
{
"mcpServers": {
"cartscout": {
"command": "uvx",
"args": ["--from", "git+https://github.com/Veselin15/cartscout-mcp", "cartscout-mcp"],
"env": { "RAPIDAPI_KEY": "your-rapidapi-key" }
}
}
}
Add the same mcpServers block to ~/.cursor/mcp.json (all projects) or .cursor/mcp.json (one project).
CartScout reads product pages; it does not search stores. Give the agent product URLs, or let it find them with a web search tool first.
| Variable | Default | Purpose |
|---|---|---|
RAPIDAPI_KEY | required | Your RapidAPI key |
CARTSCOUT_RAPIDAPI_HOST | cartscout-api.p.rapidapi.com | RapidAPI host of the API |
CARTSCOUT_API_URL, CARTSCOUT_API_KEY | unset | Use a directly issued CartScout key instead of RapidAPI |
The server sends only the product URLs your agent asks about to the CartScout API. Without a key
it still starts and lists its tools (handy for MCP inspectors); each tool call then explains how to
add RAPIDAPI_KEY.
docker build -t cartscout-mcp .
docker run -i --rm -e RAPIDAPI_KEY=your-rapidapi-key cartscout-mcp
cartscout-mcp --transport streamable-http --port 8000 serves the tools at
http://127.0.0.1:8000/mcp. Every client connected to it uses the key from the environment, so keep
it on a private address.
cached: true).uv sync
uv run pytest
MIT
FAQs
MCP server that lets AI agents look up live product prices, stock, variants and deals from Shopify, WooCommerce, Walmart, eBay and Amazon stores.
We found that cartscout-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.