# Running seller packages

> Some MCP capabilities are a pinned npm package that you run locally, rather than a server you call. This is off by default. Here's how to allow a specific package, and what protects you when you do.

A seller whose MCP server only speaks stdio can still sell it: they publish an **exact version** of an npm package, and buyers run it the way MCP clients already run `npx -y …`. Discovery marks these capabilities `runsLocally: true`, and their address is `{ "kind": "package", "command": "npx", "args": [...], "version": "1.4.2" }`.

Payment, receipts, refunds and policies work exactly as for a hosted capability. The difference is that **the seller's code runs on your machine.**

## It's off unless you allow it

Nothing runs by default. A search result can never cause code to execute. You allow packages **by name**:

```json title="@zanora/mcp"
"env": {
  "ZANORA_ALLOW_LOCAL_PACKAGES": "@acme/ocr-mcp,@acme/tts@2.1.0"
}
```

```ts title="@zanora/sdk"
import { CompositeMcpToolCaller, LocalSpawnMcpToolCaller, StreamableHttpMcpToolCaller } from "@zanora/mcp";

const mcpCaller = new CompositeMcpToolCaller(
  new StreamableHttpMcpToolCaller(),
  new LocalSpawnMcpToolCaller({
    policy: {
      allow: ["@acme/ocr-mcp"],                            // or "@acme/ocr-mcp@1.4.2" to allow one version only
      env: { ACME_REGION: "eu" },                          // passed to the package explicitly, never inherited
      timeoutMs: 60_000,
    },
  }),
);
const agent = new ZanoraAgent({ /* … */ mcpCaller });
```

## What protects you

- **Allowed per package.** Allowing `@acme/ocr-mcp` allows nothing else. Add `@version` to allow one exact version only.
- **Exact versions.** A seller can only publish an exact version, never a range, and the pin is checked again before the process starts. The code that was published is the code that runs.
- **A clean environment.** The package gets only the variables you pass in `env`. It never inherits your shell's secrets.
- **Approved launchers only.** Package addresses must use an approved launcher such as `npx`.

If a purchase is refused because the package isn't allowed, that's this setting working. An agent should report it to its user and not try to get around it.