Buywhere — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Buywhere (Agent Skill) and scored it 45/100 (orange). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 1 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 2 flagged
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
The product catalog API for AI agent commerce — search, compare, and track prices across 40+ retailers in Southeast Asia and the US.
BuyWhere is an agent-native product catalog API indexing 5M+ products from 40+ retailers across Singapore, Malaysia, Indonesia, Thailand, the Philippines, Vietnam, and the United States. It is purpose-built for AI shopping agents: BM25-ranked search, structured price comparison, deals discovery, and affiliate link tracking out of the box. The API is MCP-compatible and works with Claude Desktop, Cursor, LangChain, CrewAI, and any MCP-enabled AI client.
Get an API key at buywhere.ai/api-keys, then:
export BUYWHERE_API_KEY="bw_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
export BUYWHERE_BASE_URL="https://api.buywhere.ai"Search products across platforms
curl -sS --get "$BUYWHERE_BASE_URL/v1/products" \
-H "Authorization: Bearer $BUYWHERE_API_KEY" \
--data-urlencode "q=wireless headphones" \
--data-urlencode "limit=5"Get a specific product by ID
curl -sS "$BUYWHERE_BASE_URL/v1/products/78234" \
-H "Authorization: Bearer $BUYWHERE_API_KEY"Deals feed — biggest discounts right now
curl -sS --get "$BUYWHERE_BASE_URL/v1/deals" \
-H "Authorization: Bearer $BUYWHERE_API_KEY" \
--data-urlencode "min_discount=20" \
--data-urlencode "limit=10"Build an AI agent using BuyWhere MCP tools and win API credits, featured placement, and a Built With BuyWhere badge.
Tools: search_products, get_product, compare_prices, find_deals, browse_categories, get_category_products, get_deals
Timeline: Submissions open through May 19, 2026
[Enter the Challenge →](https://buywhere.ai/challenge) | Quick Start | MCP Setup
BuyWhere is listed in the awesome-mcp-servers registry. Connect to Claude Desktop, Cursor, Windsurf, or any MCP-compatible AI client in seconds.
Install the MCP server:
pip install httpx mcp
python /path/to/buywhere-api/mcp_server.pyClaude Desktop — add to ~/Library/Application Support/Claude/claude_desktop_config.json:
{
"mcpServers": {
"buywhere": {
"command": "python",
"args": ["/path/to/buywhere-api/mcp_server.py"],
"env": {
"BUYWHERE_API_KEY": "your_api_key_here",
"BUYWHERE_API_URL": "https://api.buywhere.ai"
}
}
}
}Cursor — add to Cursor settings → MCP servers using the same JSON config above.
Available MCP tools: search_products, get_product, compare_prices, get_deals, find_deals, browse_categories, get_category_products.
| Resource | Description |
|---|---|
| API Documentation | Full endpoint reference, authentication, error codes |
| API Examples | Worked examples for common agent use cases |
| Quickstart Guide | First query in under 5 minutes |
| AI Agent Framework Guide | LangChain, Claude, and GPT integration patterns for BuyWhere |
| Developer FAQ | Common auth, search, category, and rate-limit fixes |
| Release Notes v1.0 | What shipped in the GA release |
| MCP Setup | MCP server configuration for AI clients |
| API Healthcheck Monitor | Synthetic monitoring for /v1/search and /v1/products |
| Region | Retailers |
|---|---|
| Singapore | Shopee SG, Lazada SG, Amazon SG, Carousell SG, Zalora SG, Qoo10 SG, Courts, Challenger, FairPrice / FairPrice Xtra, Watsons SG, Harvey Norman, Gain City, Popular, Don Don Donki, IKEA SG, Decathlon SG, Uniqlo SG, Sephora SG, and more |
| Malaysia | Shopee MY, Lazada MY, Zalora MY, Watsons MY, Carousell MY |
| Indonesia | Shopee ID, Tokopedia, Bukalapak, Zalora ID |
| Thailand | Shopee TH, Lazada TH, Central TH |
| Philippines | Shopee PH, Lazada PH, Zalora PH |
| Vietnam | Shopee VN, Tiki, Sendo |
| United States | Amazon US, Walmart, Target, Costco, Best Buy, Chewy, Wayfair, Etsy, Ulta, Zappos, REI, and more |
| Australia | Amazon AU, Catch, Big W, Bunnings, Coles, Officeworks |
| Japan / Korea | Rakuten, Amazon JP, Yodobashi, Daiso JP, Coupang (KR) |
| Tier | Key Prefix | Limit | Use Case |
|---|---|---|---|
| Free | bw_free_* | 60 req/min | Development and testing |
| Live | bw_live_* | 600 req/min | Production |
| Partner | bw_partner_* | Unlimited | Data partners |
Rate limit status is returned in response headers (X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset). On 429 Too Many Requests, use exponential backoff starting at 2 seconds.
BuyWhere is a Python/FastAPI service backed by PostgreSQL and Redis, with platform-specific scrapers deployed as ECS Fargate tasks. The scraping pipeline handles 40+ platforms concurrently using distributed Redis locks, NDJSON normalization, and BM25-ranked search via PostgreSQL FTS5.
Architecture details: SCRAPING_ARCHITECTURE.md
# Local development
docker-compose up
# API available at http://localhost:8000Proprietary — © 2026 BuyWhere. All rights reserved.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.