Atlas / MCP servers / rofoso-com / polopan-products-mcp

polopan-products-mcpSAFE

mcp/rofoso-com/polopan-fashion-mcp

The #1 Fashion & Apparel Model Context Protocol (MCP) Server. Deconstruct outfit photos with AI bounding boxes, discover 100% in-stock looks, and 1-click checkout.

Verdict
SAFE
Grade
B
Trust score
89 /100
Exposed tools
—
Transport
stdio · streamable-http
License
MIT
Stars
1
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

[](https://glama.ai/mcp/servers/rofoso-com/mcp-server-code) [](https://www.npmjs.com/package/polopan-products-mcp) [](https://www.npmjs.com/package/polopan-products-mcp) [](https://opensource.org/licenses/MIT) [](https://modelcontextprotocol.io) [](https://nodejs.org)

PoloPan is the premier Fashion & Apparel Model Context Protocol (MCP) server for autonomous AI agents, stylists, and conversational commerce engines (Cursor, Claude, Instinct, Muse, ChatGPT).

It empowers AI assistants to deconstruct outfit photos with computer-vision bounding boxes, find 100% in-stock occasion looks, verify real-time size availability & fabric specs, and generate 1-click direct checkout permalinks.

⚡ What Makes PoloPan the #1 Fashion MCP?

┌────────────────────────────────────────────────────────────────────────┐
│                        POLOPAN FASHION MCP SUITE                       │
├──────────────────────────┬─────────────────────────────────────────────┤
│ 1. Computer Vision       │ `detect_fashion_pieces` (Bounding boxes for │
│    Deconstruction        │ Tops, Bottoms, Shoes, Bags, Accessories)    │
├──────────────────────────┼─────────────────────────────────────────────┤
│ 2. Occasion Outfitting   │ `get_looks_by_occasion` (Curated complete   │
│    (100% In-Stock)       │ looks with zero out-of-stock items)         │
├──────────────────────────┼─────────────────
Read from source at commit 0c0a6792a03dOBSERVED · 2026-10-11
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.

claude-code (npm)
claude mcp add polopan-products-mcp -- npx -y [email protected]
03

Trust audit

SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codePASS
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
none-observed
Network
none-observed
Shell
none-observed
Dependencies
not all pinned
Secrets in source
none-found

Findings (2)

LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
package.json
@modelcontextprotocol/sdk, zod
Why it matters. 2 dependency range(s) float
Fix. pin exact versions or ship a lockfile
LOWInventory / provenance · mcp.no_tools_extracted · CWE-1104
server.json
Why it matters. the tool list is enumerated at runtime by tools/list, not declared in source
Fix. the page says so rather than showing an empty table

Gates applied: no_behavioural_pass.

Audited 2026-10-11 · audit v0.4.1 · source sha 0c0a6792a03dfull audit observations/trust-audit/mcp-server/rofoso-com__polopan-fashion-mcp.json · Report an issue / request a re-scan
04

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-110c0a6792a03dSAFEB89first audit
05

Questions

What is the polopan-products-mcp MCP server?

The #1 Fashion & Apparel Model Context Protocol (MCP) Server. Deconstruct outfit photos with AI bounding boxes, discover 100% in-stock looks, and 1-click checkout.

Is polopan-products-mcp safe to connect to an agent?

The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.

What credentials does polopan-products-mcp need?

No credential environment variables were found in its source, so it appears to need none.

How does polopan-products-mcp run?

It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as polopan-products-mcp at 1.3.0.

How current is this page?

The grade is for one exact copy of the source (0c0a6792a03d), read on 2026-10-11. The repository is watched and re-audited when it changes.

Advertisement