
Commerce Evidence Toolkit
io.github.iamgeorgekellyPublished by GitHub account iamgeorgekellyv0.1.0Updated Oct 24, 2026
Read-only local evidence checks for product records, feed snapshots, and dimensions.
Overview
A local, read-only MCP server that runs three rule-based checks on product records, feed snapshots and product dimensions.
- What you can do
- Review a single product record against selected fields and return clear or hold, with copy or mapped methods and optional supplied evidence. Compare explicit source and feed snapshots by item ID, evidence references, timestamps and age policy to return match, update_needed or hold. Compare named length, width and height measurements on the same basis, with units and a millimetre tolerance, to return match, mismatch or hold. Every response carries a tool version, a documentation reference and the full result with its ruleset version.
- When to use it
- Useful when an agent needs a consistent, offline second opinion on product data before acting: checking a product listing, deciding whether a feed snapshot is stale, or comparing stated dimensions within a declared tolerance. It suits teams following the published Agentic Commerce Field Guide rules who want the same checks available to an assistant.
- Requirements
- Runs as a local process over stdio; Node.js 22 or later is required. Install the versioned MCPB bundle through a compatible client's import flow, or extract it and point the client at the absolute path of server/index.mjs. Running from source needs npm and network access for dependency installation; the checks themselves run locally. No accounts, API keys or environment variables are declared.
Installation
In SourceWeft
- Open Commerce Evidence Toolkit in the dashboard and add it to a workspace.
- Enable the server for the chats that should use its tools.
Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.
Other MCP clients
Follow the launch instructions in the repository.
README
Commerce Evidence Toolkit
Three local, read-only checks for agents working with product data. The package wraps the same versioned comparison rules published in the Agentic Commerce Field Guide.
Version 0.1.0 · MIT licensed. Download the versioned release, or run the source as described below. Registry availability is separate from a GitHub release; consult the live registry for its current state.
What it does
The checks do not fetch references, authenticate evidence, contact a merchant, change a feed, place orders or send telemetry. A match is not provider acceptance, live product truth, physical fit or compatibility. This is a selected local review contract, not a complete provider schema validator. Hold results are evidence decisions, not protocol failures.
Install the versioned bundle
Download commerce-evidence-toolkit-0.1.0.mcpb and SHA256SUMS from the v0.1.0 release. Check the archive against its published SHA-256 checksum. The bundle contains the server and production dependencies; Node.js 22 or later is required.
Use your compatible client's MCPB import flow, or extract the archive to a directory and configure the absolute path to its server/index.mjs using the JSON example below. MCPB support varies by client. Protocol tests do not establish certification by any desktop app.
A Node package archive is also included in the release. Installing that archive requires npm to install its dependencies. It has not been published to npm.
Run from source
Requires Node.js 22 or later and npm. Dependency installation uses the network; the three comparison operations run locally after installation.
The final command starts an MCP server over standard input/output. It waits for a compatible client; it is not a browser URL. Do not print debug messages to stdout, which carries the protocol.
For a compatible client that accepts an MCP JSON configuration, replace the path below with the absolute location of your checkout:
Client configuration locations differ. This example declares the transport and executable; it does not claim every assistant automatically installs or invokes the server.
Try a complete input
The files in examples/ are complete tool arguments, not bare internal records. The three starter examples below are fictional and use frozen times where relevant.
Ask your client to call the named tool with that file's JSON object. Every successful response includes structured content with toolVersion, a canonical documentation URL and the full result. Each core result retains its own ruleset version and evidence limitations. Incomplete accepted inputs return holds; malformed envelopes and excessive requests return protocol tool errors. The wrapper caps serialized requests at 200,000 UTF-8 bytes and nesting at 25 levels; individual checks impose narrower limits.
Dimension values are positive decimal strings and explicit units (in, cm, mm, m); tolerance is a nonnegative decimal string in millimetres. Do not silently rename depth to length, treat diameter as two axes, or substitute package measurements. Product-record review covers selected positive USD fields; feed freshness is a selected current USD snapshot contract. References are caller assertions and are never fetched.
One observed comparison
examples/observed-dimensions.json contains the HOLMERUD 40541421 dimensions observed on public US and GB product pages for the September 24 study. It returns match at the declared 2 mm display threshold and mismatch at zero. Fractional inch displays are represented exactly as decimals. The tool does not fetch or authenticate the linked sources. This threshold is not a manufacturing or installation tolerance. The study retains eight complete comparisons and 22 unresolved listings; it is not an industry error-rate estimate.
Verify and package
npm run bundle creates a local .mcpb archive with the production dependencies and a SHA-256 file under dist/. The Node package can be built with npm pack. A local package build is not an npm or MCP Registry publication.
The test suite compares all 40 fixture/method cases against their source rules (10 dimensions, 6 freshness, and 12 product records under 2 methods), checks error bounds and input immutability, and invokes all 40 over stdio with the TypeScript SDK client. The clean-install test installs the archive into a temporary directory and calls all three tools. A separate Python SDK client test calls all three examples and an incomplete-input hold. These are protocol tests with synthetic inputs, not independent users or desktop-app certification.
Evidence and scope
provenance.json records the source site commit, actual production download verification time, and SHA-256 for every file in artifacts/. The September 24 snapshot adds dimensions to the existing product-feed and measurement artifacts. Verification recomputes hashes and the earlier portability/freshness cases. Synthetic cases show rule behavior, not merchant error rates or model accuracy.
Primary tool documentation:
Please cite the relevant guide and this version or commit. CITATION.cff provides author metadata. To report a correction, open an issue with the tool version, a minimal non-sensitive input, expected result, actual result and supporting reference. Never post customer data or credentials.
Licensing
Original software, documentation, tests and fictional fixtures are available under the MIT License; see license scope. Third-party dependencies retain their own license notices in the packaged dependency directories. Linked specifications, source pages, images and trademarks are not relicensed by this repository.
Source: README.md at commit 787150d
Tools
0Version history
1- v0.1.0LatestSep 25, 2026
Score
50% of the applicable checks met
How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.
- Reached in the last 30 days25 pts
Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.
- Auth declared10 pts
Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.
- Tools listed15 pts
Answer tools/list without a credential, or ship a package that starts in a sandbox without one.
- DescriptionRequired15 pts
- Logo10 pts
- Documentation15 pts
- License10 pts