← Back to search

BuyAPI

TheSnakeFang streamable_http Scanned 24d ago

Vendor intelligence for AI coding agents choosing developer tools and stacks.

C
70.7 / 100

Versions

0.7.1latest
May 4, 2026
0.7.0
May 1, 2026
0.6.5
Apr 29, 2026
0.6.4
Apr 29, 2026
0.6.3
Apr 29, 2026
+ show 9 moreshow less
0.6.2
Apr 28, 2026
0.6.1
Apr 28, 2026
0.6.0
Apr 28, 2026
0.5.1
Apr 28, 2026
0.5.0
Apr 28, 2026
0.4.0
Apr 28, 2026
0.3.2
Apr 28, 2026
0.3.1
Apr 28, 2026
0.3.0
Apr 28, 2026
PermissionsTool SafetyAuthAnnotationsCode QualityStabilitySpecVuln HistoryAuthorTransparencyCommunity

Tools 7

vendors.resolve
annotations: none low

Finds BuyAPI vendor IDs for a user question. Category is optional; provide it when known. Use this for vendor discovery before vendors.details, or when the user asks which provider in a category fits their constraints. Do not use this for local coding/debugging/docs questions unless they involve choosing a software vendor or tool. If the category is outside BuyAPI's corpus, the tool returns an explicit "not in corpus yet" result instead of inventing vendors.

vendors.details
annotations: none low

Retrieves detailed vendor information including pricing, features, limits, gotchas, comparisons, and source provenance. Call vendors.resolve first unless the user already provided a BuyAPI vendor ID like /database/supabase.

vendorId string
vendors.evidence
annotations: none low

Returns recent BuyAPI evidence rows for a vendor, category, stack, or comparison. Use this when the user asks why BuyAPI believes something, what sources support a vendor page, or what recent human/source signals exist.

limit number
stacks.findSimilar
annotations: none low

Finds public stack profiles related to a vendor or recent curated stack examples. Use this when the user asks who uses a tool, what similar builders use, or wants examples of real stack combinations.

limit number
vendors.compare
annotations: none low

Compares two or more BuyAPI vendors for a specific workload or decision. Use this for head-to-head questions like "Convex vs Supabase vs Neon for a realtime SaaS" or "Stripe vs Paddle for a marketplace".

query string
vendors.estimateCost
annotations: none low

Produces deterministic monthly cost estimates from BuyAPI pricing data and explicit workload inputs. Use this when the user asks for cost math. Missing workload fields are returned as assumptions or unknowns instead of being hallucinated.

stacks.recommend
annotations: none low

Recommends a complete stack from BuyAPI's corpus with a structured decision matrix, cost estimate, assumptions, unknowns, alternatives, and sources. Use this when the user is starting a project or asks for a complete stack choice. Do not use this for local coding/debugging/docs questions that do not involve software or vendor selection. Do not call vendors.resolve first; this tool handles retrieval and ranking.

projectDescription string

Permissions 3

network medium
Server uses network capabilities via: fetch()
shell high
Server uses shell capabilities via: child_process, spawn()
env_vars low
Server uses env_vars capabilities via: process.env

Scan Findings 29

low
Tool 'vendors.resolve' has no annotations annotation_checker · 100%
low
Tool 'vendors.details' has no annotations annotation_checker · 100%
low
Tool 'vendors.evidence' has no annotations annotation_checker · 100%
low
Tool 'stacks.findSimilar' has no annotations annotation_checker · 100%
low
Tool 'vendors.compare' has no annotations annotation_checker · 100%
low
Tool 'vendors.estimateCost' has no annotations annotation_checker · 100%
low
Tool 'stacks.recommend' has no annotations annotation_checker · 100%
medium
OAuth implementation without PKCE auth_checker · 75%
info
Sandbox failed to start for behavioral verification behavioral_verifier · 100%
medium
Vulnerable dependency: @modelcontextprotocol/sdk@1.12.1 (GHSA-345p-7cg4-v4c7) dependency_analyzer · 95%
medium
Vulnerable dependency: @modelcontextprotocol/sdk@1.12.1 (GHSA-8r9q-7v3j-jr4g) dependency_analyzer · 95%
medium
Vulnerable dependency: @modelcontextprotocol/sdk@1.12.1 (GHSA-w48q-cv73-mx4w) dependency_analyzer · 95%
medium
Vulnerable dependency: vitest@4.1.5 (GHSA-82fw-gwwq-j7x9) dependency_analyzer · 95%
info
package.json metadata manifest_parser · 100%
info
Tool: vendors.resolve manifest_parser · 85%
info
Tool: vendors.details manifest_parser · 85%
info
Tool: vendors.evidence manifest_parser · 85%
info
Tool: stacks.findSimilar manifest_parser · 85%
info
Tool: vendors.compare manifest_parser · 85%
info
Tool: vendors.estimateCost manifest_parser · 85%
info
Tool: stacks.recommend manifest_parser · 85%
info
Transport: stdio manifest_parser · 90%
info
Required env vars (2) manifest_parser · 80%
info
Sandbox failed to start for output poisoning scan output_poisoning · 100%
medium
Permission: network access detected permission_analyzer · 70%
high
Permission: shell access detected permission_analyzer · 95%
low
Permission: env_vars access detected permission_analyzer · 90%
info
SBOM generated: 10 components sbom_generator · 100%
medium
No build provenance detected (SLSA L0) slsa_assessor · 90%