Bitroad MCP server

Overview

From the repository's own README, as read at the audited commit.

# Bitroad MCP server[![bitroadai/bitroad-mcp MCP server](https://glama.ai/mcp/servers/bitroadai/bitroad-mcp/badges/score.svg)](https://glama.ai/mcp/servers/bitroadai/bitroad-mcp)Bitroad is a marketplace built for AI agents. Your agent searches a catalogue ofgoods and services, places orders under spending caps you set, tracks delivery,and handles returns and disputes, all through the Model Context Protocol.**Endpoint:** `https://app.bitroad.ai/api/v1/mcp`Transport is spec-compliant Streamable HTTP with JSON-RPC 2.0. Auth is OAuth 2.1with dynamic client registration and PKCE, so most clients need nothing more thanthe URL above.- Website: https://bitroad.ai- Documentation: https://bitroad.ai/docs- Sign up: https://buy.bitroad.ai/sign-up## How it works1. Create a buyer account at [buy.bitroad.ai](https://buy.bitroad.ai/sign-up).2. Add the endpoint to your MCP client and approve the consent screen.3. Your agent can now browse and read orders immediately.4. To let it spend, add a card and set delegation caps in your dashboard. Until   you do, there is no purchase path at all.Spending is bounded by three caps you control: per transaction, per day, andtotal. A purchase above any cap is refused outright, with a reason of`per_tx_cap_exceeded`, `daily_cap_exceeded` or `total_cap_exceeded`. Separately,you can set a confirmation threshold: a purchase at or above it is allowed butreturns `confirmation_required` with a token, and needs your explicit sign-offbefore it proceeds. Agents never see card details; a card can only be added byyou through Stripe hosted checkout.## Connect your clientThere are three shapes. Pick the one that matches your client.### CLI clients```bash# Claude Codeclaude mcp add --transport http bitroad https://app.bitroad.ai/api/v1/mcp# Gemini CLIgemini mcp add --transport http bitroad https://app.bitroad.ai/api/v1/mcp```Run the client and trigger the OAuth flow (`/mcp` in Claude Code, automatic inGemini CLI), then approve on the Bitroad consent screen.### C

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude mcp add mcp --env BITROAD_API_KEY=${BITROAD_API_KEY} -- npx -y @bitroad/[email protected]

{
  "mcpServers": {
    "mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@bitroad/[email protected]"
      ],
      "env": {
        "BITROAD_API_KEY": "${BITROAD_API_KEY}"
      }
    }
  }
}

Details

Source

bitroadai/bitroad-mcp

npm

@bitroad/mcp@1.0.0

Transports

streamable-http

Credentials it reads

BITROAD_API_KEY

Tools

Registered at runtime; the list could not be read from source.

License

MIT

Stars

0 · pushed 5d ago

Trust audit

Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

What the source does

Filesystem

none-observed

Network

none-observed

Shell

none-observed

Dependencies

pinned

Secrets in source

none-found

Findings (2)

resolve({ endpoint: `http://127.0.0.1:${port}/api/v1/mcp`, close: () => server.close() });

Gates applied: no_behavioural_pass.

Audited 2026-09-13 · audit v0.4.0 · source sha d6bb7b23132d · full audit: observations/trust-audit/mcp-server/bitroadai__bitroad.json · Report an issue or request a re-scan

Audit history

Also audited

Servers with a similar trust profile.

Questions