Giftcardshop Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Giftcardshop Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
MCP server that lets AI agents browse the giftcardshop catalog and buy gift cards with Lightning - no account, no signup. The agent pays a Lightning invoice and receives a single-view reveal link with the code.
Read tools work against the live public API with no key. create_order is early access: it needs the shared GCS_INTERNAL_SECRET (request one at https://giftcardshop.org/contact); without it the read tools still work and create_order reports that it is not configured.
| Tool | Kind | Backed by |
|---|---|---|
list_brands | read | GET /v1/brands |
search_products | read | GET /v1/products |
get_product | read | GET /v1/products/:id (variants + denominations) |
get_order_status | read | GET /v1/orders/:id (payment state + reveal availability) |
create_order | write | POST /internal/agent-orders (HMAC) -> Lightning invoice |
Read tools pass the API JSON through verbatim. create_order returns { orderId, invoiceId, invoiceUrl, bolt11?, sats?, total, currency, expiresAt }.
# read-only (browsing works, create_order reports "not configured")
npx @giftcardshop/mcp
# with checkout enabled
GCS_INTERNAL_SECRET=<64-hex> npx @giftcardshop/mcpClaude Desktop / any MCP client (stdio):
{
"mcpServers": {
"giftcardshop": {
"command": "npx",
"args": ["-y", "@giftcardshop/mcp"],
"env": { "GCS_INTERNAL_SECRET": "<64-hex>" }
}
}
}| Env | Default | Purpose |
|---|---|---|
GCS_API_BASE | https://api.giftcardshop.org | public API base |
GCS_INTERNAL_SECRET | (unset) | 64-hex HMAC secret; enables create_order. Unset = read-only. |
create_order POSTs to POST /internal/agent-orders, HMAC-signed with GCS_INTERNAL_SECRET (header x-internal-sig), and returns a Lightning invoice. Pay it, then poll get_order_status for the single-view reveal link. No Nostr identity and no partner account required.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.