Kuaidi100 launched China's first MCP-protocol-compatible logistics information service platform. The core API services of Kuaidi100's Baidiy
Nothing to run from here
Horoshop is installed from its publisher's own source and answers where it runs, so this marketplace is not in the path of a single call. There is no address here to send one to, and a panel that pretended otherwise would be showing you an answer we made up. Install it and call it from your own client — the Installation tab has the entry for each one.
99/100
trust score
60
tools declared
local
runs on your machine
59
downloads
What it does
Unofficial server for Horoshop (Хорошоп) stores: catalog, orders, SEO, feeds, admin. 118 tools.
Quickstart
This one is not published to a package registry, so there is no one-line install: it is built and started the way its own source says.
Publishernot claimed
IGAll 1 server
IgorShutko1 server
1 category
Collected from a public index. Nobody has claimed this account, so nothing here was written by its author — claim it if it is yours.
Installation
Where are you running it?
Every route below installs the same thing and ends at the same approval screen. This one runs on your machine: your client starts Horoshop as a process under your own user, with your files and your network, so the tool surface below is what it can do to your computer rather than to a server somewhere else. Its scan result is on the Security tab — read the surface before you approve it.
This one is not published to a package registry, so there is no one-line install: it is built and started the way its own source says.
Tool surface
What the model actually sees. Descriptions are diffed on every release — see version history.
List the reverse-engineered admin entity types the generic admin tools can reach (slug, handler id, title, and whether it needs special handling). Use to discover what horoshop_admin_record_get / _save / _list / _delete can target.
No parameter schema on file.
Build the admin URL that prints an existing Nova Poshta waybill for one or more orders. It only assembles the address — nothing is requested, and the endpoint itself cannot create a waybill (with no Nova Poshta credentials it answers «Дані авторизації не заповнені»; creating a real TTN is a…
No parameter schema on file.
Attach images that were uploaded over FTP to /content/import_images/. File names bind to products by article: <article>@<n>.jpg for the main gallery, <article>@gallery_common@<n>.jpg or <article>@gallery_360@<n>.jpg for the others. Only jpeg/gif/png are accepted.
No parameter schema on file.
List product stickers/icons (id, title, enabled). Horoshop v4 only. Use the titles when setting icons on catalog_import; reference existing stickers rather than inventing names.
No parameter schema on file.
Read or set the site-wide tracking scripts injected into every storefront page: scriptOnTop (right after <body>), scriptOnBottom (before </body>), scriptInHead (inside <head>), and ga4Id (the GA4 measurement/resource id). This is where GTM, Meta Pixel, GA and any custom JS live — HTML/JS…
No parameter schema on file.
Read or set the checkout form's behaviour: the e-mail fields (showEmail, requireEmail), requireAuthorization, the newsletter opt-in (newsletterSubscription + newsletterSubscriptionDefault), showCouponCode, showCountries, phoneMask, the 'do not call' option (orderWithoutCallback +…
No parameter schema on file.
Read or set how the catalog behaves: modification grouping (groupModifications, useGeneratedTitle, highlightUnavailableModifications, highlightMissingModifications), compareItems, allowListView, price rounding (currencyRoundTo), primarySort (enum), newIconDaysDuration, the B2B…
No parameter schema on file.
Read or set the store's brand-level settings: the display siteName, and the translatable headerSite (common title), siteDescription, slogan, copyright, aboutStore (the 'О магазине' block on the home page). Plus timezone (enum), multicurrencyEnabled, commentsModeration,…
No parameter schema on file.
Read or set which social-login buttons the storefront offers: facebookAuth, googleAuth, linkedInAuth (all booleans, true=enabled). Enabling here shows the provider; the client_id/secret are configured separately. Call with no args to read. DRY RUN BY DEFAULT.
No parameter schema on file.
List the store's attribute-value dictionaries (Справочники / books) — id and name (e.g. Матеріал, Единицы измерения, Розмір футболки). Use the id with horoshop_admin_dictionary_values (as book or id, both accepted).
No parameter schema on file.
Create a NEW attribute dictionary (справочник / book) — the value list a product characteristic points at. This is the container, not its values: fill it afterwards with horoshop_admin_dictionary_value_set / _add_value.
No parameter schema on file.
Rename an existing dictionary (справочник / book). Renames the CONTAINER only — its values keep their own titles (those are horoshop_admin_dictionary_value_set).
No parameter schema on file.
List the values of an attribute dictionary by id (from horoshop_admin_dictionaries) — value id + text. Read-only, headless. The id may be passed as book or as id (that tool returns it as id); both work.
No parameter schema on file.
List EVERY 301 redirect in the store, with the target record each one points to (history_id is the handle update/delete take). Reads the whole redirects grid, not just its first page — the screen renders 20 target rows at a time, and a plain page read used to report 16 of a store's 35 redirects.
No parameter schema on file.
Delete one or more 301 redirects by history_id (from horoshop_admin_redirect_list). DRY RUN BY DEFAULT — the dry run shows what each id currently redirects, so you can see what you are about to switch off. Pass dryRun:false to delete; deletion is verified by re-reading the store. Ids that are…
No parameter schema on file.
Turn a payment or delivery option on/off and/or retitle it per language — the thing that decides what a buyer can actually pick at checkout. kind picks the list, id is the option id from horoshop_payment_export / horoshop_delivery_export. Verify the result where it matters with…
No parameter schema on file.
Create or edit an order status — the labels your orders move through, in every language. Omit id to create. successful marks the status that counts as a completed sale (it drives reporting), inReports includes it in report totals. Read the current list with horoshop_orders_get_statuses. DRY…
No parameter schema on file.
Read or replace the phones/messengers/e-mails a buyer sees in the header and on the contacts page. These are not in the design config or the public API: they live in a table the admin builds in JavaScript, so this is the only way to reach them from here. ONE TABLE HOLDS EVERY LANGUAGE, told apart…
No parameter schema on file.
Verify the admin-panel session for a store (separate from the /api/ token — this logs into the control panel with the store credentials). Returns who is authenticated. Use before admin write tools to confirm access.
No parameter schema on file.
Read the store's design 'application JSON' — the full theme config (colours, blocks, homepage layout, header/footer, mobile, banners…). Without section returns the version and top-level section names; pass a section (e.g. "header", "homepage", "footer") to get that subtree. Read the shape here…
No parameter schema on file.
Edit the store's design config by deep-merging a patch into one of its top-level sections (the design editor's blocks): common, header, footer, homepage, catalog, catalogCategories, product, mobile, cart, banners, contacts, brands, favorites, etc. Read the current shape first with…
No parameter schema on file.
Read the store's custom CSS (desktop and mobile) from the client-styles editor. ALWAYS CHECK available BEFORE ACTING ON THE RESULT: the «Редактор CSS» admin section is per-store AND per-account — when THIS login has no rights to that section (the common case: the menu simply omits it) or the…
No parameter schema on file.
Set the store's custom CSS. Provide desktop and/or mobile (the one you omit is preserved). Horoshop recompiles SCSS after saving. DRY RUN BY DEFAULT — pass dryRun:false to save. BLIND-WRITE GUARD: the save always posts BOTH sides, so it can only preserve what it could read. If…
No parameter schema on file.
List the store's languages (id + label) from the languages grid. Use an id with horoshop_admin_language_set.
No parameter schema on file.
Edit a language's settings by id: site_title (its name), enabled (0/1), is_displayed_in_admin (0/1), currency (currency id — see the language editor), noindex (0/1). Read-modify-write; posts to the languages route. DRY RUN BY DEFAULT. (Adding/removing languages changes the whole storefront and is…
No parameter schema on file.
Read the store's Checkbox.ua ПРРО (Ukrainian fiscal receipts) configuration from the general-settings form. Returns all 17 fields by human name: the mode toggles (enabled, automaticReceipts, useTax), receipt sending (sendCheckOnEmail, sendCheckViaSms), receipt layout (footer,…
No parameter schema on file.
Write the store's Checkbox.ua ПРРО settings on the general-settings form (read-modify-write, then verify by re-reading). Writable keys: booleans enabled, automaticReceipts, useTax, sendCheckOnEmail, sendCheckViaSms, deliveryAsProduct, paymentAsProduct; texts footer,…
No parameter schema on file.
Read the admin «Аналитика» dashboard in one call — no order pagination. Returns, for the store's default reporting window: currentPeriod and previousPeriod, each with orders (totalOrders, ordersPerDay, totalSum, averageCheck), conversion (totalVisitors, visitorsPerDay,…
No parameter schema on file.
Read which characteristics a data template defines — grouped as the admin shows them (e.g. "Модификации" vs "Характеристики"), each with its param id, label, API field name, type, and the dictionary it draws values from. THIS IS THE FIELD LIST catalog_import/export accepts for products in that…
No parameter schema on file.
List the dictionaries a select-type characteristic can bind to, in the exact book_<id> form the admin expects, with their names. Use before horoshop_admin_template_param_add.
No parameter schema on file.
Remove a characteristic from a data template by its param id (from horoshop_admin_template_schema). DESTRUCTIVE: products in that category lose the field and its stored values. DRY RUN BY DEFAULT. A param that is not on the template answers {deleted:false, alreadyGone:true} rather than erroring…
No parameter schema on file.
Read the five booleans on the store's 'Дополнительные SEO настройки' screen: paginationCanonicalFirstPage (canonical → first pagination page), paginationNoindex (noindex the pagination pages), seoTextWithGetParams (show the SEO text on URLs that carry GET params), catalogInBreadcrumbs (add…
No parameter schema on file.
Turn any of the five 'Дополнительные SEO настройки' booleans on or off: paginationCanonicalFirstPage, paginationNoindex, seoTextWithGetParams, catalogInBreadcrumbs, brandInBreadcrumbs (all true=on). This screen is a self-POST singleton (it posts back to itself, not save.php); the tool…
No parameter schema on file.
Fetch the store's live /robots.txt from the storefront (through the anti-bot). READ-ONLY: Horoshop generates robots.txt on the platform side — there is no admin editor for it (the 'save-robots' button on the SEO screen is just the mis-named submit for the SEO flags, and no robots textarea…
No parameter schema on file.
Rebuild the store's sitemap via the admin's utils/sitemap.php?create. The public /sitemap.xml may be a <sitemapindex> pointing at generated children (pages / catalog) or a single flat <urlset>; either way this refreshes it to reflect the current catalog. Non-destructive and idempotent —…
No parameter schema on file.
Read the store's public /sitemap.xml without touching anything. Handles BOTH flavours: a <sitemapindex> (reports each child sitemap, its lastmod, and how many <url> entries it holds) and a flat <urlset> (reports the single sitemap's own <url> count, no recursion). Use it to check the…
No parameter schema on file.
List product/data templates (Шаблоны товаров) — the characteristic schemas categories use (id + name, e.g. "КАТАЛОГ: Товар"). Use an id with the get/set tools.
No parameter schema on file.
Read a product template by id: its title and internal name/table. Read-only. Use before horoshop_admin_product_template_set. LIMITATION: this returns only the template's identity (6 meta fields) — the characteristic schema itself (which fields a category's products get) is NOT exposed by this…
No parameter schema on file.
Edit a product template's fields by id. Pass set as a map of exact form field names → values (get them from horoshop_admin_product_template_get) — most commonly {"handler[title]":"New name"}. Read-modify-write: the rest of the schema is preserved. DRY RUN BY DEFAULT. Editing the characteristic…
No parameter schema on file.
List B2B customer groups (id, title, visible price level, product visibility, dropshipping flag, allowed payment/delivery methods). Use customer_group_id from here when importing users.
No parameter schema on file.
List configured price levels/types (id, title). Use these level_id values in catalog_import's price_levels[]. The retail price is still set via the plain price field, not here.
No parameter schema on file.
Register a target URL to receive JSON (PUT) when a store event fires. Events: order_created, user_signup, request_call_me, order_paid, user_update, order_update, comments_created. Max 5 subscribers per event. The queue is flushed by cron ~every 5 min, so delivery is not instant. Returns the…
No parameter schema on file.
Stop delivering an event to a target URL. Needs the subscription id returned by subscribe plus the same target_url.
No parameter schema on file.
List all order statuses configured on the store (id, multilingual title, is_successful). Horoshop v4+. Use to resolve the numeric statuses returned by orders_get. Note the admin's status switcher labels these differently — status 6 reads «Отправлен» there but is titled «Доставляется», and status 4…
No parameter schema on file.
List catalog categories/pages under a parent (id, parent, multilingual title, discount). Use the returned ids as parent.id when importing products.
No parameter schema on file.
Upsert "bought together" product sets, matched by the set article (which must not clash with a real product article). A set holds 2..N member product articles. Price is either discountPercent off the summed member prices, or an explicit discountedPrice.
No parameter schema on file.
Delete product sets by their set articles. Destructive but scoped to sets only — it never touches real products. Removing a non-existent set returns a WARNING, not an error.
No parameter schema on file.
List the store's payment options (id, multilingual title/description, payment_method, enabled, gateway link). The ids appear on orders as payment_type.id.
No parameter schema on file.
List payment methods (id, title, is_simple). is_simple=false means the buyer is sent to a payment gateway after checkout. Referenced by payment options' payment_method.
No parameter schema on file.
List delivery options (id, multilingual title, type, enabled, allowed payment ids, price_options). The ids appear on orders as delivery_type.id and differ per store.
No parameter schema on file.
List delivery type categories (id, multilingual title), e.g. courier, warehouse pickup, Ukrposhta. Referenced by delivery options' type.
No parameter schema on file.
Export currencies and exchange rates. By default only front-enabled currencies are returned; filter by ISO codes or ids. enabledOnly, when set, ignores the iso filter.
No parameter schema on file.
Read the current cart for this store's buyer session — lines (with their hash), quantities and totals. The session is kept per store, so add/remove/get see the same cart. Use it to test the funnel: what a real customer would have before checkout.
No parameter schema on file.
Set the quantity of one cart line, addressed by its hash (from horoshop_cart_get). Returns the updated cart.
No parameter schema on file.
Remove one line from the cart by its hash (from horoshop_cart_get).
No parameter schema on file.
Fetch the checkout page as the buyer with the current cart and report what it offers: which delivery and payment options are actually rendered, and the cart lines it shows. An empty cart redirects to the home page — add something first. This is how to verify that enabling/disabling a payment or…
No parameter schema on file.
List the Horoshop stores this server is configured for — names and base URLs only, never credentials. Use a returned name as the store argument on any other tool. The store marked isDefault is used when store is omitted. Also returns serverBuild — the build this running process is executing,…
No parameter schema on file.
Verify that the configured credentials authenticate against a store, without exposing the token. Run this first when other calls return UNAUTHORIZED. Horoshop tokens live 600 s and are refreshed by the server automatically. Returns serverBuild: the build id + timestamp of the code THIS process…
No parameter schema on file.
Export registered site users, optionally by registration date range, paginated with offset/limit. B2B stores additionally return customer_group_id, balance, manager, company and role.
No parameter schema on file.
Upsert users, matched by the unique email. title (full name) and email are required. The response log reports per-user codes (0 ok, 1 missing required, 2 validation, 3 error).
No parameter schema on file.
Free
$0 forever
- Every tool, no call limit
- No card, and mcprush charges nothing for it
- Source published under MIT
- Runs on your machine — nothing of it reaches our gateway
- Nothing to cap, because mcprush bills nothing
What counts against your monthly calls
| Tool | Unit | Calls used | Out of the allowance |
|---|
Nothing here is billable: mcprush charges nothing to install Horoshop or to call it, at any volume.
Call allowance · this installenforced at the gateway
Monthly allowance, in calls
—
—
Alert at 80% · then the tool returns a normal MCP error
Used this month: —
ATrust score 99 / 100
Release 0.3.0 · scanned 14 Oct 2026
Two independent axes, because powerful and malicious are different questions. The grade is threat only. The capability level is blast radius, and it is never a penalty on the grade — it is priced as one subtract-only term in the score, where you can see it.
Threat score100
Client score99
Findings4 threat · 0 capability
Capabilityminimal
Coveragesource
Verificationrepo
Surface digest2dc22d3bf39daa3966da07121ef3ae7218597d0cc75600bd6ac9471b4c82a657
Score vectorthreat 100 → client 99
| Term | Level | What it prices | Points |
|---|---|---|---|
| capability-exposure | minimal | capability blast radius (minimal) — client exposure if the model is manipulated | −0 |
| verification-discount | repo | publisher verification (public source) — no provenance, but the source is public and inspectable | −1 |
| coverage-honesty | source | inspection depth (source) — how much of the target the scan could see | −0 |
score = clamp(round(threatScore − E_cap − E_ver − E_cov), 0, 100). No model, no opinion, no network call at scoring time: the same methodology version against the same bytes always produces this number, and every line above is a field of the report rather than a summary of it.
What the scan could actually read
A grade is only as meaningful as its coverage, so the scanner publishes its own depth before it publishes its result.
Tool surfacenot available
Implementation sourceread
Package metadataread
Live transportnot available
No tools were enumerated, so prompt-injection, capability and toxic-flow analysis had no tool surface to inspect. To grade a package’s real runtime tools, scan the running server: --command "npx -y <package>".
Capability — what it could do if the model were manipulated
Tags derived from each tool’s schema and the implementation, not from what the tool calls itself. minimal is the level these add up to.
| Tool | Capability tags | Why the tag was assigned |
|---|---|---|
| No per-tool rows for this release — see the note below. | ||
No tool surface was enumerated, so there is nothing to attribute a capability to.
Toxic-flow graph
The lethal trifecta, checked as a graph rather than as a checklist: untrusted input, a sensitive source and an external sink have to meet before there is a path worth worrying about.
The public result for this release does not print the flow graph, so there is nothing to show here. That is not the same as "no paths were found": what the scan did read is above, under coverage.
Supply chain and provenance
Integrityfirst-seen
Surface digest2dc22d3bf39daa39
Scanned2026-10-14
This is the first scan of this surface here, so there is nothing yet to compare it against.
Every result on this tab comes from one deterministic pass over the published package — offline, rule by rule, and auditable line by line above. Same methodology version, same bytes, same score.
Release history
It installs from its repository rather than from a versioned package, so the command cannot be pinned to a release. The history below is for reading; the current release on file is 0.3.0.
0.3.0
undated
latestNo release note was published with this version.
—
no reviews yet
Who can review
One review per account, from a signed-in account that does not publish this listing. Nothing else is asked — you can say what you think before you install it. Publishers can reply once per review, and a review can be edited or deleted by whoever wrote it.
Sign in to write one
Any signed-in account that does not publish Horoshop can review it, once — before installing it or after. A review from an account that has installed it is marked as one.
No reviews yet
Nobody has reviewed this listing. The rating on the card is the mean of the reviews written here and nothing else, so there is no rating until somebody writes the first — which takes a signed-in account that does not publish it, and nothing else.