buywhere-mcp
BuyWhere/buywhere-mcpProduct search API for AI agents via Model Context Protocol. Search & compare 11M+ products across Singapore, SEA, and US markets. Multi-currency pricing, inventory, and deal discovery — built for AI agent commerce, not store management. - Win the "Build With BuyWhere" Challenge: <a href="https://buywhere.ai/challenge">buywhere.ai/challenge</a>
High risk — review the findings below
We found multiple concerning patterns in this package. Some of these might be legitimate (for example, a build tool might need to run commands), but you should review each finding below and decide if the explanations make sense for what this package claims to do.
What We Found(1 issue)
Each card explains what was found and what it means in plain English. Click "Technical details" for the full breakdown.
Caution. This package reads your secret passwords and API tokens from your system. If it also has network access, your credentials could be sent to someone else's server. Check WHY it needs your secrets.
Technical details
Reading sensitive environment variables (tokens, secrets, keys, passwords) suggests data exfiltration. MCP servers should declare required env vars, not silently read secrets.
process.env.BUYWHERE_API_KEYFinding Summary
0
Critical
1
High
0
Medium
0
Low
0
Info