Buy
Seller packages
Some MCP capabilities are listed as a pinned npm package you'd run locally, rather than a server you call. These are discoverable but can't be bought yet. Here's how to recognise them.
A seller whose MCP server only speaks stdio can list it as an exact version of an npm package. Discovery marks these capabilities runsLocally: true and payable: false. Their address is { "kind": "package", "command": "npx", "args": [...], "version": "1.4.2" }.
They can't be bought yet
Zanora sells hosted capabilities only, where the seller's server runs the tool and reports the outcome. A package would run on your machine, which needs a different model for who reports what ran. That model is planned, not shipped.
Until then, any attempt to buy a package capability is refused with NOT_SUPPORTED, and no money moves:
zanora_invoke(in@zanora/mcp) andZanoraAgent.invokeMcprefuse before anything is spawned. Even an unpaid first call would run the seller's code.- The gateway won't quote a package capability, whatever client asks.
Pick a result with payable: true instead.
ZANORA_ALLOW_LOCAL_PACKAGES
The setting still exists, and nothing runs without it. It lists the packages an agent may run, allowed by name (@acme/ocr-mcp) or pinned to one version (@acme/ocr-mcp@1.4.2). Because packages aren't payable, it has no effect on purchases today. It's kept so paid packages can be added later without changing your configuration.