Running seller packages

A seller whose MCP server only speaks stdio can still sell it: they publish an exact version of an npm package, and buyers run it the way MCP clients already run npx -y …. Discovery marks these capabilities runsLocally: true, and their address is { "kind": "package", "command": "npx", "args": [...], "version": "1.4.2" }.

Payment, receipts, refunds and policies work exactly as for a hosted capability. The difference is that the seller's code runs on your machine.

#It's off unless you allow it

Nothing runs by default. A search result can never cause code to execute. You allow packages by name:

"env": {
  "ZANORA_ALLOW_LOCAL_PACKAGES": "@acme/ocr-mcp,@acme/tts@2.1.0"
}

import { CompositeMcpToolCaller, LocalSpawnMcpToolCaller, StreamableHttpMcpToolCaller } from "@zanora/mcp";

const mcpCaller = new CompositeMcpToolCaller(
  new StreamableHttpMcpToolCaller(),
  new LocalSpawnMcpToolCaller({
    policy: {
      allow: ["@acme/ocr-mcp"],                            // or "@acme/ocr-mcp@1.4.2" to allow one version only
      env: { ACME_REGION: "eu" },                          // passed to the package explicitly, never inherited
      timeoutMs: 60_000,
    },
  }),
);
const agent = new ZanoraAgent({ /* … */ mcpCaller });

#What protects you

• Allowed per package. Allowing @acme/ocr-mcp allows nothing else. Add @version to allow one exact version only.
• Exact versions. A seller can only publish an exact version, never a range, and the pin is checked again before the process starts. The code that was published is the code that runs.
• A clean environment. The package gets only the variables you pass in env. It never inherits your shell's secrets.
• Approved launchers only. Package addresses must use an approved launcher such as npx.

If a purchase is refused because the package isn't allowed, that's this setting working. An agent should report it to its user and not try to get around it.