Kuaidi100 launched China's first MCP-protocol-compatible logistics information service platform. The core API services of Kuaidi100's Baidiy
Tools
addWatchlistProduct
Add a listing to the signed-in user's watchlist by productListingId so they can follow it and, with notifications on (the default), hear about changes. A listing already on the watchlist returns CONFLICT; subscription tier limits apply.
notifications boolean/null
Whether to be notified about changes to the listing (default true).
productListingId string · required
ID of the listing (pl_…) to add.
A call is made on an account: it counts against an allowance and the publisher sees it, which is why this one asks who you are first.
93/100
tool-list score
37
tools declared
remote
via our gateway
—
p95 latency
What it does
Search art and antiques from dealers and auction houses; manage your watchlist and saved searches.
Quickstart
# 1 — sign in once: npx mcprush@latest login
# it asks for a key from mcprush.com/dashboard#access
# 2 — install
npx mcprush@latest add aura-historia/aura-historia-mcp
# 3 — ask your agent for something these tools do
# addWatchlistProduct, createUserAddress, createUserSearchFilter and 34 more
Windows PowerShell says 'running scripts is disabled on this system'? Run Set-ExecutionPolicy -Scope CurrentUser RemoteSigned once, or type npx.cmd instead of npx (codex.cmd, gemini.cmd, grok.cmd likewise). PowerShell 7 needs neither.
Aura Historia costs nothing on mcprush: there is no plan to choose here, no cap to set and nothing mcprush can bill you for.
Publisher
Installation
Where are you running it?
Every route below installs the same thing and ends at the same approval screen. Nothing here runs on your machine — this server runs on the publisher’s own infrastructure behind our gateway, and what you install is the connection to it.
Claude Codedeclared by this listing
Claude Code has its own MCP command, and the key rides on it as a header — the gateway refuses a call that carries none. Claude Code reads MCPRUSH_KEY each time it connects, so the key stays out of its config: export your key from Access in your shell profile (macOS, Linux), or run setx MCPRUSH_KEY <your key> and open a new terminal (Windows). Or let npx mcprush@latest add aura-historia/aura-historia-mcp write the entry with the key for you; --scope user makes it available in every project.
claude mcp add --transport http --scope user aura-historia-mcp https://mcprush.com/gw/aura-historia-mcp/mcp --header 'Authorization: Bearer ${MCPRUSH_KEY}'Reconnect, or start a new session, and the tools appear in the model’s tool list.
Free to install on mcprush: no card. The gateway still answers a key, so you sign in once — which is also what gives you saved lists, release alerts and a budget cap.
What it writes
One config entry pointing at the gateway. The server itself runs on the publisher’s own infrastructure, so nothing from this listing executes on your machine.
What you approve
37 tools, with what each one reads, writes and reaches shown before you agree — the same list on every route above. Read the tool surface.
Tool surface
What the model actually sees. Descriptions are diffed on every release — see version history.
Add a listing to the signed-in user's watchlist by productListingId so they can follow it and, with notifications on (the default), hear about changes. A listing already on the watchlist returns CONFLICT; subscription tier limits apply.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| notifications | boolean/null | no | Whether to be notified about changes to the listing (default true). |
| productListingId | string | yes | ID of the listing (pl_…) to add. |
Save a new private address with a label and its location in the signed-in user's address book; Aura Historia resolves the location for shipping estimates. Each call creates a new address, so repeating a call that timed out can create a duplicate.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| geography | object | yes | Where the address is: the reference release, the address text (required) and optionally country, subdivision and postal code. |
| label | string | yes | Name of the address in the address book. |
Save a listing search for the signed-in user. Aura Historia matches new listings against it in the background and, with notifications on (the default), notifies the user, so matches appear later. Subscription tier limits apply. Each call creates a new saved search, so repeating a call that timed out can create a duplicate. Amounts are always integers in the currency's minor unit when one exists (E
| Parameter | Type | Required | Notes |
|---|---|---|---|
| acceptShippingDestination | no | Optional guard confirming the shipping destination: the filter's shipping country must equal the country of the referenced address or browsing preference. | |
| name | string | yes | Name of the saved search, at most 255 characters (longer names are cut off). |
| notifications | boolean | no | Whether matches trigger notifications (default true). |
| search | object | yes | Criteria a listing must meet to match this saved search; the members are those of the listing search. |
Permanently delete one of the signed-in user's notifications by notificationId. Returns an empty object; an unknown ID returns NOT_FOUND.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| notificationId | string | yes | ID of the notification (ntf_…). |
Permanently delete every notification of the signed-in user, including those beyond the listed page. Takes no arguments. Returns an empty object.
Takes no parameters.
Permanently delete one of the signed-in user's saved addresses. expectedVersion must equal its current version. If the address is the browsing destination, that destination is cleared too. Returns an empty object.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| addressId | string | yes | ID of the saved address (uaddr_…). |
| expectedVersion | integer | yes | Current version from the last read; a stale version returns CONFLICT. |
Permanently delete one of the signed-in user's saved searches. Returns an empty object; an unknown ID returns NOT_FOUND.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| userSearchFilterId | string | yes | ID of the saved search (sf_…). |
Remove a listing from the signed-in user's watchlist by productListingId. Returns an empty object; a listing that is not on the watchlist returns NOT_FOUND, also after an earlier call removed it.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| productListingId | string | yes | ID of the listing (pl_…). |
Get one auction by its auctionId: name, provider, format, schedule, reported status, reported and visible lot counts, and the link to its catalogue at the provider.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| auctionId | string | yes | ID of the auction (auc_…). |
List the lots of one auction by its auctionId in catalogue order, as listings in the requested language and currency with shipping details. Pass the returned searchAfter object as a JSON string to get the next page. For a signed-in user, each result also carries userState sections for which the token has the read scope: watchlist:read, search-filters:read, notifications:read or users:read. Amounts
| Parameter | Type | Required | Notes |
|---|---|---|---|
| auctionId | string | yes | ID of the auction (auc_…). |
| currency | string | no | Currency of the returned prices, as an ISO 4217 code (default EUR). |
| language | string | no | Language of the returned listing text, as an ISO 639-1 code (default en). |
| pageSize | integer/null | no | Number of lots per page, from 1 to 100 (default 21); values outside that range are clamped. |
| searchAfter | string/null | no | Continuation from the previous page: its searchAfter object serialized as a JSON string, passed back exactly as returned. |
Get the destination Aura Historia uses to estimate shipping while the signed-in user browses: NONE, one of their saved addresses (ADDRESS) or a country with an optional postal code (COUNTRY_POSTAL), with its version.
Takes no parameters.
Get the full details of one listing by its productListingId: text, prices, images, provider, availability, auction and shipping, in the requested language and currency. Use it when the user wants more than a search result shows. For a signed-in user, each result also carries userState sections for which the token has the read scope: watchlist:read, search-filters:read, notifications:read or users:
| Parameter | Type | Required | Notes |
|---|---|---|---|
| currency | string | no | Currency of the returned prices, as an ISO 4217 code (default EUR). |
| language | string | no | Language of the returned listing text, as an ISO 639-1 code (default en). |
| productListingId | string | yes | ID of the listing (pl_…). |
Get the full details of one listing by its productListingTitleSlugId, the last segment of an Aura Historia listing page URL (/products/{slug}). Returns the same details as the lookup by productListingId. For a signed-in user, each result also carries userState sections for which the token has the read scope: watchlist:read, search-filters:read, notifications:read or users:read. Amounts are always
| Parameter | Type | Required | Notes |
|---|---|---|---|
| currency | string | no | Currency of the returned prices, as an ISO 4217 code (default EUR). |
| language | string | no | Language of the returned listing text, as an ISO 639-1 code (default en). |
| productListingTitleSlugId | string | yes | Slug ID of the listing, the last segment of an Aura Historia listing page URL. |
Get the complete history of one listing by its productListingId: when it was first seen and every recorded change, in event order. Use it for questions about price development or past changes. With currency, each price is also converted at the exchange rate of its event. Returns every event in one result; a history too large for one response fails instead of being truncated. Amounts are always int
| Parameter | Type | Required | Notes |
|---|---|---|---|
| currency | no | Currency to also show each price in, converted at the exchange rate of its event, as an ISO 4217 code; without it only the source prices are returned. | |
| productListingId | string | yes | ID of the listing (pl_…). |
Get the public profile of one provider (a dealer, auction house, marketplace or auction platform) by its listingSourceSlugId, the last segment of an Aura Historia provider page URL (/shops/{slug}): name, operator, website and image.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| listingSourceSlugId | string | yes | Slug ID of the provider, the last segment of an Aura Historia provider page URL. |
Get the latest calculated statistics of the Aura Historia catalogue: live listings, listings added in the last seven days, countries, languages and indexed providers by type, with the time they were calculated. Takes no arguments.
Takes no parameters.
Find listings similar to one listing, identified by its productListingId. Returns up to size neighbours (default 20; values outside 1 to 50 are clamped) in the requested language and currency. EMBEDDING_PENDING means the listing is not yet prepared for comparison and a later call can succeed; READY with an empty list means nothing similar was found. For a signed-in user, each result also carries
| Parameter | Type | Required | Notes |
|---|---|---|---|
| currency | string | no | Currency of the returned prices, as an ISO 4217 code (default EUR). |
| language | string | no | Language of the returned listing text, as an ISO 639-1 code (default en). |
| productListingId | string | yes | ID of the listing (pl_…). |
| size | integer/null | no | Number of similar listings to return, from 1 to 50 (default 20); values outside that range are clamped. |
Get the signed-in user's Aura Historia account: email, name, language, currency and measurement unit, content preference, marketing consent, subscription tier and role.
Takes no parameters.
Get one of the signed-in user's saved addresses by addressId, with its resolved location and the attribution of the geocoding provider.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| addressId | string | yes | ID of the saved address (uaddr_…). |
Get one of the signed-in user's saved searches by userSearchFilterId, with its criteria, state and notification settings. Amounts are always integers in the currency's minor unit when one exists (EUR 119199 = €1,191.99; USD in cents). For currencies without minor units, such as JPY, the amount is whole units (211453 = ¥211,453). Follow ISO 4217 exponents.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| userSearchFilterId | string | yes | ID of the saved search (sf_…). |
List all of the signed-in user's saved searches with their criteria, state and notification settings. Takes no arguments. Amounts are always integers in the currency's minor unit when one exists (EUR 119199 = €1,191.99; USD in cents). For currencies without minor units, such as JPY, the amount is whole units (211453 = ¥211,453). Follow ISO 4217 exponents.
Takes no parameters.
List the listings on the signed-in user's watchlist with their full details and notification settings, in the requested language and currency. Pass the returned searchAfter array as a JSON string to get the next page. Amounts are always integers in the currency's minor unit when one exists (EUR 119199 = €1,191.99; USD in cents). For currencies without minor units, such as JPY, the amount is whol
| Parameter | Type | Required | Notes |
|---|---|---|---|
| currency | string | no | Currency of the returned prices, as an ISO 4217 code (default EUR). |
| language | string | no | Language of the returned listing text, as an ISO 639-1 code (default en). |
| searchAfter | string/null | no | Continuation from the previous page: its searchAfter array of [RFC 3339 watchlist creation time, listing ID] serialized as a JSON string, passed back exactly as returned. |
| size | integer/null | no | Number of results per page, from 1 to 100 (default 21); values outside that range are clamped. |
List auctions of the auction houses and platforms that Aura Historia indexes, filtered by provider, format, reported status and schedule period and sorted by creation or schedule time. Use it to find upcoming, running or past auctions. A schedule period needs timeRole, from and to together, and sorting by schedule time needs timeRole. Pass the returned searchAfter object as a JSON string to get th
| Parameter | Type | Required | Notes |
|---|---|---|---|
| format | no | Only auctions of this format. | |
| from | no | Start of the schedule period for timeRole, as an ISO 8601 date-time with offset; give it together with to and timeRole. | |
| listingSourceId | no | Only auctions of this provider, as a listing source ID (ls_…). | |
| order | no | Sort direction, asc or desc. | |
| pageSize | integer/null | no | Number of auctions per page, from 1 to 100 (default 21); values outside that range are clamped. |
| reportedStatus | no | Only auctions with this status as the provider reports it. | |
| searchAfter | string/null | no | Continuation from the previous page: its searchAfter object serialized as a JSON string, passed back exactly as returned with the same filters and sort. |
| sort | no | created (default) orders by creation time; scheduled orders by the timeRole instant and requires timeRole. | |
| timeRole | no | Schedule instant that from and to filter on and sort=scheduled orders by; required with from/to and with sort=scheduled. | |
| to | no | End of the schedule period for timeRole, as an ISO 8601 date-time with offset; give it together with from and timeRole. |
List the signed-in user's notifications, such as watchlist changes and new saved-search matches, with each listing as it was when notified, in the requested language. Returns up to size notifications (default 21, 1 to 100); pass the returned searchAfter array as a JSON string to get the next page. Amounts are always integers in the currency's minor unit when one exists (EUR 119199 = €1,191.99; U
| Parameter | Type | Required | Notes |
|---|---|---|---|
| language | string | no | Language of the returned notification text, as an ISO 639-1 code (default en). |
| searchAfter | string/null | no | Continuation from the previous page: its searchAfter array of [created time, notification ID] serialized as a JSON string, passed back exactly as returned. |
| size | integer/null | no | Number of results per page, from 1 to 100 (default 21); values outside that range are clamped. |
List the listings that matched one of the signed-in user's saved searches, oldest match first, in the requested language and currency. Matching runs in the background, so an empty first page means there are no matches yet. Returns up to size matches (default 21, 1 to 100); pass the returned searchAfter array unchanged to get the next page. Amounts are always integers in the currency's minor unit w
| Parameter | Type | Required | Notes |
|---|---|---|---|
| currency | string | no | Currency of the returned prices, as an ISO 4217 code (default EUR). |
| language | string | no | Language of the returned listing text, as an ISO 639-1 code (default en). |
| searchAfter | no | Continuation from the previous page: its searchAfter array of [RFC 3339 match time, listing ID], passed back exactly as returned. | |
| size | integer/null | no | Number of results per page, from 1 to 100 (default 21); values outside that range are clamped. |
| userSearchFilterId | string | yes | ID of the saved search (sf_…). |
List the signed-in user's saved addresses with their resolved locations. Returns up to limit addresses (default 25, 1 to 100); pass the returned next as after to get the next page.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| after | no | Continuation from the previous page: its next address ID, passed back exactly as returned. | |
| limit | integer/null | no | Number of addresses per page, from 1 to 100 (default 25). |
Turn notifications for a watched listing on or off, or pause (INACTIVE_BY_USER) or resume (ACTIVE) the entry. Omitted fields stay unchanged and null is invalid; resuming is subject to subscription tier limits. Returns the listing with its full details in the requested language and currency. Amounts are always integers in the currency's minor unit when one exists (EUR 119199 = €1,191.99; USD in c
| Parameter | Type | Required | Notes |
|---|---|---|---|
| currency | string | no | Currency of the returned prices, as an ISO 4217 code (default EUR). |
| language | string | no | Language of the returned listing text, as an ISO 639-1 code (default en). |
| notifications | boolean | no | Whether to be notified about changes to the listing; omit to keep the current setting, null is rejected. |
| productListingId | string | yes | ID of the listing (pl_…). |
| state | string | no | ACTIVE or INACTIVE_BY_USER; omit to keep the current state, null is rejected. |
Search the providers whose listings Aura Historia indexes (dealers, auction houses, marketplaces and auction platforms) by name. Without a query it browses all providers; a query too short to match returns no results. Returns 1 to 50 providers per page (default 21); pass the returned searchAfter unchanged, with the same query and size, to get the next page.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| query | string/null | no | Optional source-name text; omission or whitespace browses, insufficient text returns no matches. |
| searchAfter | string/null | no | Continuation from the previous page: pass back exactly as returned, with the same query and size. |
| size | integer | no | Number of providers per page, from 1 to 50 (default 21); continuations are bound to the query and page size. |
Set or clear the destination used to estimate shipping while the signed-in user browses: NONE clears it, ADDRESS selects one of their saved addresses and COUNTRY_POSTAL a country with an optional postal code. expectedVersion must equal the current version. Returns the new destination and version.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| destination | object | yes | The browsing destination to store, replacing the current one. |
| expectedVersion | integer | yes | Current version from the last read; a stale version returns CONFLICT. |
Search Aura Historia's index of art, antiques and design objects listed by dealers, auction houses, marketplaces and auction platforms. Use it to find listings by text and by filters such as price, dates, availability, provider, auction, location and shipping. Returns listing summaries in the requested language and currency, with the total when known; pass the returned searchAfter object unchanged
| Parameter | Type | Required | Notes |
|---|---|---|---|
| auctionId | array | no | Only listings that belong to these auctions, given as auction IDs (auc_…). |
| availability | no | Only listings in one of these exact availability states; combined with orderability, a listing must satisfy both. | |
| created | object | no | Range on the listing's creation time, as ISO 8601 date-times with offset; both bounds inclusive. |
| currency | string | no | Currency prices are returned in and price is interpreted in, as an ISO 4217 code (default EUR). |
| enhancedSearchDescription | string/null | no | Optional natural-language description that refines the ranking of productQuery results. Only effective together with productQuery; on its own it returns unranked, unrelated results. |
| excludeListingSourceId | array | no | Leave out listings from these providers, given as listing source IDs (ls_…). |
| excludeProductListingId | array | no | Listing IDs (pl_…) to leave out of the results. |
| geography | no | Where listings are located, by country, subdivision or distance from a point; every member given must hold. | |
| includeUnspecifiedAvailability | boolean/null | no | Also include listings that state no availability (default false). |
| language | string | no | Language of the returned listing text and of the titles productQuery is matched against, as an ISO 639-1 code (default en). |
| listingSourceId | array | no | Only listings from these providers, given as listing source IDs (ls_…). |
| lotBiddingOpens | object | no | Range on the time bidding on the lot opens, as ISO 8601 date-times with offset; min inclusive, max exclusive. |
| lotScheduledCloses | object | no | Range on the lot's scheduled closing time, as ISO 8601 date-times with offset; min inclusive, max exclusive. |
| order | no | Sort direction, asc or desc (default desc); only valid together with sort. | |
| orderability | no | Only listings whose availability falls into one of these orderability groups; combined with availability, a listing must satisfy both. | |
| price | no | Price range in the request's currency, with both bounds inclusive. Amounts are always integers in the currency's minor unit when one exists (EUR 119199 = €1,191.99; USD in cents). For currencies w | |
| productQuery | array | no | Keyword phrases matched against listing titles; every word of one phrase must match, and a listing matches when any phrase does. |
| searchAfter | no | Continuation from the previous page: pass back exactly as returned by the previous page, with the same filters and sort. | |
| shipping | no | Only listings whose advertised shipping terms meet these conditions for a destination country; every member given must hold. | |
| size | integer/null | no | Number of results per page, from 1 to 100 (default 21); values outside that range are clamped. |
Mark every notification of the signed-in user as seen or unseen, including those beyond the listed page. Returns an empty object.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| seen | boolean | yes | true marks as seen, false as unseen. |
Mark one of the signed-in user's notifications as seen or unseen by notificationId. Returns an empty object; an unknown ID returns NOT_FOUND.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| notificationId | string | yes | ID of the notification (ntf_…). |
| seen | boolean | yes | true marks as seen, false as unseen. |
Mark the signed-in user's notifications with the given notificationIds (at least one) as seen or unseen. Unknown IDs are ignored. Returns an empty object.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| notificationIds | array | yes | IDs (ntf_…) of the notifications to update; unknown or foreign IDs are ignored and an empty list is rejected. |
| seen | boolean | yes | true marks as seen, false as unseen. |
Record whether a listing that matched one of the signed-in user's saved searches is relevant: true or false sets the feedback, null clears it and omission keeps it. Returns the match; a listing that is not a current match returns NOT_FOUND. Amounts are always integers in the currency's minor unit when one exists (EUR 119199 = €1,191.99; USD in cents). For currencies without minor units, such as
| Parameter | Type | Required | Notes |
|---|---|---|---|
| feedback | boolean/null | no | Feedback on the match, true or false; omit to keep the stored value, null clears it. |
| productListingId | string | yes | ID of the listing (pl_…). |
| userSearchFilterId | string | yes | ID of the saved search (sf_…). |
Update the signed-in user's name, language, currency, measurement unit or whether unassessed or sensitive content is shown. Omitted fields stay unchanged and null clears an optional field; the content preference cannot be null. Returns the updated account.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| currency | no | Preferred currency, as an ISO 4217 code; omit to keep it, null clears it. | |
| firstName | string/null | no | First name; omit to keep it, null clears it. |
| language | no | Preferred language, as an ISO 639-1 code; omit to keep it, null clears it. | |
| lastName | string/null | no | Last name; omit to keep it, null clears it. |
| measurementUnit | no | Preferred measurement unit system; omit to keep it, null clears it. | |
| showUnassessedOrSensitiveContent | boolean | no | Whether listings with unassessed or sensitive content are shown; omit to keep it, null is rejected. |
Replace the label and location of one of the signed-in user's saved addresses. expectedVersion must equal the address's current version; a stale version returns CONFLICT. Returns the updated address.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| addressId | string | yes | ID of the saved address (uaddr_…). |
| expectedVersion | integer | yes | Current version from the last read; a stale version returns CONFLICT. |
| geography | object | yes | New location of the address, replacing the current one entirely. |
| label | string | yes | New name of the address, replacing the current one. |
Change the name, criteria, state or notification setting of one of the signed-in user's saved searches. Omitted fields stay unchanged and null clears fields that can be cleared; availability, orderability and includeUnspecifiedAvailability change together. Matching against new criteria runs in the background. Returns the saved search. Amounts are always integers in the currency's minor unit when o
| Parameter | Type | Required | Notes |
|---|---|---|---|
| acceptShippingDestination | no | Optional guard confirming the shipping destination: the filter's shipping country must equal the country of the referenced address or browsing preference. | |
| name | string/null | no | New name, at most 255 characters (longer names are cut off); omit to keep the current name. |
| notifications | boolean/null | no | Whether matches trigger notifications; omit to keep the current setting. |
| search | no | Partial criteria: omitted members stay unchanged, null clears enhancedSearchDescription, auctionId, price, the date ranges and the availability query, and availability, orderability and `inc | |
| state | no | ACTIVE or INACTIVE_BY_USER; omit to keep the current state, and activating a filter checks all its criteria against the current tier. | |
| userSearchFilterId | string | yes | ID of the saved search (sf_…). |
Free
$0 forever
- Every tool, no call limit, and mcprush charges nothing
- A buyer key from your dashboard — the gateway refuses a call without one
- Answers through our gateway, so every call is in your log
- Nothing to cap, because mcprush bills nothing
What counts against your monthly calls
| Tool | Unit | Calls used | Out of the allowance |
|---|
Nothing here is billable: mcprush charges nothing to install Aura Historia or to call it, and its free tier carries no monthly call limit.
Call allowance · this installenforced at the gateway
Monthly allowance, in calls
—
—
Alert at 80% · then the tool returns a normal MCP error
Used this month: —
ATool-list grade · score 93 / 100
Release 1.0.0 · scanned 9 Nov 2026
Graded from the tools this server lists, not from its source code.
Two independent axes, because powerful and malicious are different questions. The grade is threat only. The capability level is blast radius, and it is never a penalty on the grade — it is priced as one subtract-only term in the score, where you can see it.
Threat score100
Client score93
Findings0 threat · 0 capability
Capabilitymoderate
Coveragemanifest
Verificationnot in this report
Surface digestf04389f4306de7556971ac5fdbd733a1435e4f83bb4b58d563002d7324f7ac5e
Score vectorthreat 100 → client 93
| Term | Level | What it prices | Points |
|---|---|---|---|
| capability-exposure | moderate | capability blast radius (moderate) — client exposure if the model is manipulated | −3 |
| coverage-honesty | manifest | inspection depth (manifest) — how much of the target the scan could see | −4 |
score = clamp(round(threatScore − E_cap − E_ver − E_cov), 0, 100). No model, no opinion, no network call at scoring time: the same methodology version against the same bytes always produces this number, and every line above is a field of the report rather than a summary of it.
What the scan could actually read
A grade is only as meaningful as its coverage, so the scanner publishes its own depth before it publishes its result.
The scan read each tool’s name, description, input schema and annotations exactly as the server listed them the last time it answered us; no code was reviewed. We ask the server again about once a month, and a list that changed is graded again.
Tool surfaceread
Implementation sourcenot available
Package metadatanot available
Live transportnot available
The implementation source was not read — this reflects the declared tool metadata only.
Capability — what it could do if the model were manipulated
Tags derived from each tool’s schema and the implementation, not from what the tool calls itself. moderate is the level these add up to.
| Tool | Capability tags | Why the tag was assigned |
|---|---|---|
| addWatchlistProduct | state-write | state-write: declares readOnlyHint: false |
| createUserAddress | state-write | state-write: declares readOnlyHint: false |
| createUserSearchFilter | state-write | state-write: declares readOnlyHint: false |
| deleteNotification | state-write | state-write: declares readOnlyHint: false, destructiveHint: true |
| deleteNotifications | state-write | state-write: declares readOnlyHint: false, destructiveHint: true |
| deleteUserAddress | state-write | state-write: declares readOnlyHint: false, destructiveHint: true |
| deleteUserSearchFilter | state-write | state-write: declares readOnlyHint: false, destructiveHint: true |
| deleteWatchlistProduct | state-write | state-write: declares readOnlyHint: false, destructiveHint: true |
| discoverPartyLocations | no tags | |
| getAuction | no tags | |
| getAuctionCatalogue | no tags | |
| getBrowsingDestination | no tags | |
| getProductListing | no tags | |
| getProductListingByTitleSlug | no tags | |
| getProductListingHistory | no tags | |
| getPublicListingSourceBySlug | no tags | |
| getPublicOverview | no tags | |
| getSimilarProductListings | no tags | |
| getUserAccount | no tags | |
| getUserAddress | no tags | |
| getUserSearchFilter | no tags | |
| getUserSearchFilters | no tags | |
| getWatchlistProductListings | no tags | |
| listAuctions | no tags | |
| listNotifications | no tags | |
| listSearchFilterMatches | no tags | |
| listUserAddresses | no tags | |
| patchWatchlistProduct | state-write | state-write: declares readOnlyHint: false, destructiveHint: true |
| searchPublicListingSources | no tags | |
| setBrowsingDestination | state-write | state-write: declares readOnlyHint: false, destructiveHint: true |
| simpleSearchProductListings | no tags | |
| updateAllNotificationsSeen | state-write | state-write: declares readOnlyHint: false, destructiveHint: true |
| updateNotificationSeen | state-write | state-write: declares readOnlyHint: false, destructiveHint: true |
| updateNotificationsSeen | state-write | state-write: declares readOnlyHint: false, destructiveHint: true |
| updateSearchFilterMatchFeedback | state-write | state-write: declares readOnlyHint: false, destructiveHint: true |
| updateUserAccount | state-write | state-write: declares readOnlyHint: false, destructiveHint: true |
| updateUserAddress | state-write | state-write: declares readOnlyHint: false, destructiveHint: true |
| updateUserSearchFilter | state-write | state-write: declares readOnlyHint: false, destructiveHint: true |
Toxic-flow graph
The lethal trifecta, checked as a graph rather than as a checklist: untrusted input, a sensitive source and an external sink have to meet before there is a path worth worrying about.
The public result for this release does not print the flow graph, so there is nothing to show here. That is not the same as "no paths were found": what the scan did read is above, under coverage.
Supply chain and provenance
Integrityfirst-seen
Surface digestf04389f4306de755
Scanned2026-11-09
This is the first scan of this surface here, so there is nothing yet to compare it against.
Every result on this tab comes from one deterministic pass over the published package — offline, rule by rule, and auditable line by line above. Same methodology version, same bytes, same score.
Release history
The gateway serves every install the publisher’s current release, so a release cannot be pinned or rolled back to here yet. The history below is for reading; the current release on file is 1.0.0.
1.0.0
undated
latestNo release note was published with this version.
—
no reviews yet
Who can review
One review per account, from a signed-in account that does not publish this listing. Nothing else is asked — you can say what you think before you install it. Publishers can reply once per review, and a review can be edited or deleted by whoever wrote it.
Sign in to write one
Any signed-in account that does not publish Aura Historia can review it, once — before installing it or after. A review from an account that has installed it is marked as one.
No reviews yet
Nobody has reviewed this listing. The rating on the card is the mean of the reviews written here and nothing else, so there is no rating until somebody writes the first — which takes a signed-in account that does not publish it, and nothing else.