@buygit/mcp-server

The only MCP that returns license + supply-chain risk + popularity + price in a single call. 78,094 curated Git assets. Zero config. MIT. Free forever.

MCP server for the BuyGit Open Index — 78,094 curated, deduplicated, license-tagged Git assets from GitHub, Codeberg, npm, crates.io, WordPress, HuggingFace, and 17 other sources — to Claude Desktop, Cursor, Cline, Continue, ChatGPT Apps SDK, and any MCP 2025-11-25 client.

Companion: @buygit/cli — same answers from your shell. npx @buygit/cli search "react form" --license MIT.

Companion: buygit-vscode extension — license-compat + audit from the VS Code command palette + explorer right-click. See packages/vscode-extension.

Works in Antigravity, Claude Desktop, Claude Code, Cursor, Cline, Codex CLI, Continue, Gemini CLI, OpenCode, Roo Code, Windsurf, Zed, and any MCP 2025-11-25 client. Full install matrix in CLIENTS.md.

Cursor one-click install: cursor://anysphere.cursor-deeplink/mcp/install?name=buygit&config=eyJjb21tYW5kIjoibnB4IiwiYXJncyI6WyIteSIsIkBidXlnaXQvbWNwLXNlcnZlckBsYXRlc3QiXX0=

What is BuyGit?

BuyGit is an open marketplace and discovery platform for Git-based digital products — source code, templates, SaaS starters, boilerplates, plugins, AI agents, ML models, and developer tools.

Unlike raw GitHub search, BuyGit curates, deduplicates, and enriches every listing with structured metadata:

• License classification — SPDX identifier + category (permissive / weak-copyleft / strong-copyleft / proprietary) + plain-English compatibility warnings
• Supply-chain risk scoring — 0-100 composite score based on dependency hygiene, secret scan status, malware flags, and maintenance signals
• Popularity scoring — log-scaled 0-100 star score normalized across sources (GitHub, npm, crates.io, etc.)
• Pricing tier — free vs. paid, with USD price for premium listings
• Repository health — stars, forks, language, last commit date, archived/disabled status, upstream health

The catalog currently indexes 78,094 crawler-imported listings from 17+ sources, with continuous crawling adding new assets daily. BuyGit also supports seller-curated premium listings (marketplace), but the MCP server exposes only the public crawler-imported catalog — no auth required.

Key URLs:

• 🌐 Main site: buygit.com
• 📖 MCP landing page: buygit.com/mcp
• 📋 API spec: buygit.com/api/v1/crawler/openapi.json

Why BuyGit over raw GitHub search?

Every tool returns a 4-axis signals block — the differentiator. No other MCP gives you this in one call.

{
  "license_category": "permissive",
  "license_warning": null,
  "popularity": 75,
  "risk": 0,
  "price_usd": 0,
  "pricing_tier": "free"
}

User question	github-mcp	Smithery code-search	context7	Socket MCP	BuyGit MCP
"MIT-compatible image diff library"	raw search, no license	raw search	docs only	safety only	license-filtered
"Is this dependency safe to bundle?"	—	—	—	Socket score	Socket + popularity + license fused
"Compare A vs B by license + activity"	4+ calls	4+ calls	—	—	1 call
"Alternative to GPL X, but MIT-only"	—	—	—	—	buygit_find_alternative
"Is GPL-3.0 safe in my MIT project?"	—	—	—	—	license_warning field
"Explain this listing for me"	—	—	—	—	buygit_explain (AI summary)
"Deep audit with companion MCPs"	manual	—	—	separate	buygit_deep_audit (federation)

We also tell you when NOT to use us — see WHEN_NOT_TO_USE.md.

What you get

14 tools, 7 resource templates, 4 prompts — all backed by the public, read-only, free-forever BuyGit Open Index API. Full client install matrix in CLIENTS.md (13 clients).

Tool	One-line value
buygit_search	Curated, license-tagged, risk-scored search across 78,094 assets. fields= sparse fieldset + summary_mode=compact for token savings.
buygit_get_listing	Replaces 3 separate MCP calls — license + risk + popularity + repo signals + similar in one shot
buygit_list_categories	Full taxonomy with per-category counts
buygit_trending	Curated trending (not GitHub Trending noise), license-aware
buygit_compare	Single-call 2-5 way comparison with license_warning
buygit_stats	Catalog meta — totals by license, category, source, plus data_freshness
buygit_random	Surprise me — license + risk badges on every pick
buygit_find_alternative	License-filtered, risk-scored alternatives — the answer GitHub search cannot give
buygit_check_license_compat	"Is GPL-3 safe in my MIT project?" Returns compatible / review / incompatible with note. The only MCP that answers this without a separate SCA tool.
buygit_audit_repo	Audit any external GitHub repo URL — same 4-axis signals as catalog rows, via live GitHub probe. Falls back to richer cached signals when URL is in our index.
buygit_explain	v0.9.0 · AI-powered listing summary (overview / license / risk / usage focus). Gated on ANTHROPIC_API_KEY. Uses Claude Haiku for cost-efficient summaries.
buygit_diff_versions	v0.9.0 · Time-window signal diff — shows how a listing's license, popularity, and risk changed between snapshots.
buygit_deep_audit	v0.9.0 · Federated deep audit — chains Socket, OpenSSF Scorecard, and TruffleHog companion MCPs alongside BuyGit's own signals for a comprehensive security audit.
search_tools	Meta routing tool — give it a plain-English intent, get the ranked tool to call next. MCP Tool Search Tool semantic.

Resources let you @-mention a listing, category, comparison, or any cacheable static asset and have it attached as conversation context — no tools/call required:

• buygit://listing/{slug} — full listing detail with 4-axis signals
• buygit://category/{slug} — category top 20
• buygit://compare/{slug-a}+{slug-b}+{slug-c} — single-fetch 2-5 way compare
• buygit://trending/{period} — day/week/month trending, pin once and re-reference
• buygit://stats — catalog meta + data_freshness, pin to know catalog scale
• buygit://category-tree — full taxonomy lookup table
• buygit://license/{spdx} — compatibility matrix row for any SPDX id

Prompts (slash-menu in Claude Desktop):

• starter_for_stack — "Find me a starter kit for {stack}"
• alternative_to — "Alternatives to {repo}"
• audit_my_dependency — "Is {slug} safe to ship?"
• explore_category — "What's hot in {category}?"

Install

Claude Desktop

Edit ~/Library/Application Support/Claude/claude_desktop_config.json on macOS or %APPDATA%\Claude\claude_desktop_config.json on Windows:

{
  "mcpServers": {
    "buygit": {
      "command": "npx",
      "args": ["-y", "@buygit/mcp-server@latest"]
    }
  }
}

Restart Claude Desktop. The first tool call may take a few seconds while npx resolves the package.

Cursor

Edit ~/.cursor/mcp.json:

{
  "mcpServers": {
    "buygit": {
      "command": "npx",
      "args": ["-y", "@buygit/mcp-server@latest"]
    }
  }
}

Cline (VS Code extension)

Open the Cline MCP settings (Cline: Open MCP Servers from the command palette) and add:

{
  "buygit": {
    "command": "npx",
    "args": ["-y", "@buygit/mcp-server@latest"]
  }
}

Continue

Continue picks up MCP servers from ~/.continue/config.json:

{
  "mcpServers": {
    "buygit": {
      "command": "npx",
      "args": ["-y", "@buygit/mcp-server@latest"]
    }
  }
}

Self-hosted via Docker

docker run -i --rm ghcr.io/buygit/mcp-server:latest

The container runs stdio MCP. Pipe stdin/stdout from your client.

Try it

After you've added the config and restarted your client, ask:

• "Find me a Next.js SaaS starter under MIT with more than 500 stars."
• "What's trending in AI agents this week on BuyGit?"
• "Tell me about next-saas-starter-pro — is the secret scan clean?"
• "Compare react-saas-template and nextjs-stripe-starter."
• "Explain the license risk of some-gpl-library for my MIT project."
• "Run a deep audit on github.com/some-org/some-repo."

The model will call the right tools, attach the canonical BuyGit links, and let you click through.

Configuration

Env var	Default	Purpose
BUYGIT_API_BASE	https://buygit.com	Override for staging / self-hosted mirror
BUYGIT_MCP_TRANSPORT	stdio	stdio (default, all clients) · http (Streamable HTTP)
BUYGIT_TIMEOUT_MS	15000	Per-request timeout in milliseconds. Increase for slow networks.
BUYGIT_EXPLAIN_MODEL	claude-haiku-4-5-20251001	Anthropic model for buygit_explain summaries.
ANTHROPIC_API_KEY	(none)	Required only for buygit_explain. All other tools work without any key.
BUYGIT_COMPANION_TOOL_MAP	(built-in)	JSON override for companion MCP tool names in buygit_deep_audit.

Architecture

┌─────────────────────────────────────────────┐
│  AI Agent (Claude, GPT, Gemini, …)          │
│  ↕ MCP JSON-RPC (stdio or Streamable HTTP)  │
├─────────────────────────────────────────────┤
│  @buygit/mcp-server                         │
│  14 tools · 7 resources · 4 prompts         │
│  Zod input validation · structuredContent   │
│  Retry w/ exponential backoff (429/503)     │
├─────────────────────────────────────────────┤
│  undici Pool → buygit.com REST API          │
│  Public · Read-only · No auth · Free        │
└─────────────────────────────────────────────┘

Privacy & licensing

The BuyGit Open Index API is public, read-only, no auth. There is no key to install. Requests are not personally identifiable (the server doesn't log the queries you make).

The catalog excludes seller-curated listings — only crawler-imported public-repo metadata is exposed. Each result includes a url field linking back to the canonical BuyGit page; please surface that link when redistributing.

This package is MIT licensed. The API responses are licensed for indexing + attribution per the BuyGit API terms.

Links

• BuyGit main site: https://buygit.com
• BuyGit MCP landing page: https://buygit.com/mcp
• OpenAPI 3.1 spec: https://buygit.com/api/v1/crawler/openapi.json
• Source: https://github.com/genoxdeveloper/buygit-mcp-server
• Issues: https://github.com/genoxdeveloper/buygit-mcp-server/issues
• npm: https://www.npmjs.com/package/@buygit/mcp-server

Develop

cd packages/mcp-server
pnpm install
pnpm build
node dist/index.js   # connects on stdio — feed it MCP JSON-RPC over stdin

Or run the watch build while developing:

pnpm dev

Run tests:

pnpm test           # 57 tests (handler + server + federation)

To smoke-test against the live API:

BUYGIT_API_BASE=https://buygit.com node dist/index.js
# then in another process, send a `tools/list` JSON-RPC frame