by cinderline
Open-source MCP server for comparing products and asking the buyer before purchase.
# Add to your Claude Code skills
git clone https://github.com/cinderline/northcinderLast scanned: 8/20/2026
{
"issues": [],
"status": "PASSED",
"scannedAt": "2026-08-20T04:35:13.960Z",
"npmAuditRan": true,
"pipAuditRan": true,
"promptInjectionRan": true
}See how northcinder compares with popular alternatives.
northcinder is an open-source ai agents skill for AI coding assistants such as Claude Code, Codex CLI, and ChatGPT, built by cinderline. Open-source MCP server for comparing products and asking the buyer before purchase. It has 1,209 GitHub stars.
Yes. northcinder passed SkillsLLM's automated security scan — a dependency vulnerability audit plus prompt-injection heuristics — with no high-severity issues. You can read the full report in the Security Report section on this page.
Clone the repository with "git clone https://github.com/cinderline/northcinder" and add it to your Claude Code skills directory (see the Installation section above).
northcinder is primarily written in JavaScript. It is open-source under cinderline on GitHub, so you can review or fork the full source.
Yes. SkillsLLM lists many other AI Agents skills you can browse and compare side by side. Open the AI Agents category from the badge at the top of this page, or use the Related Skills and comparison links further down to weigh northcinder against similar tools.
No comments yet. Be the first to share your thoughts!
⚠️ Third-Party Software Notice
This skill is third-party open-source software developed and hosted independently on GitHub. SkillsLLM is an informational directory and does not control or maintain the underlying repository.
Any security checks, ratings, or warnings displayed by SkillsLLM are automated and limited in scope. They do not constitute a security certification or guarantee that the software is safe, error-free, or free from malicious code, vulnerabilities, compromised dependencies, or prompt-injection risks.
Review the source code, permissions, dependencies, and configuration before installing or running any third-party skill. Use is at your own risk. To the maximum extent permitted by applicable law, SkillsLLM is not liable for losses arising from third-party software.
Your shopping agent should work for you.
AI agents are starting to do more than answer shopping questions. Soon they will decide which products people see and, in some cases, buy on their behalf.
Big marketplaces are building the easiest version of this: an agent that searches one catalog and steers the buyer toward that platform's checkout. That may be convenient, but it is not independent advice. The marketplace still decides what can be seen and makes money when the agent closes the sale.
NorthCinder takes a different approach. It compares products from the sources you choose and shows where its facts came from. Before it buys anything, it asks for your approval. NorthCinder is software you run alongside your AI app.
The repository owner does not operate a NorthCinder service. There is no NorthCinder account or cloud service.
You need Node.js 20 or later and an MCP-capable AI app.
npx northcinder init
The command saves your configuration on your computer and prints the MCP entry for your AI app. Local mode is keyless. It runs the MCP server and search engine together in one process, using a temporary loopback port.
Once connected, try a real shopping brief:
Find black wool running shoes under $130. Compare price, delivery, fit, and merchant trust. Tell me why the winner ranked first and which options were ruled out.
NorthCinder does not pretend there is one universal "best" product. It normally shows no more than three useful choices: the strongest fit, a lower-risk option, and a cheaper or meaningfully different option when one exists.
Each result explains why it ranked where it did. You can also inspect the other finalists, rejected offers, and facts that could not be verified.
Product research gets messy quickly. Model names overlap, sellers copy one another, and a polished product page can hide the one detail that makes an item wrong for the buyer.
NorthCinder includes separate research guides for products and sellers. Before doing the research, the MCP host should:
northcinder://research/product or northcinder://research/seller.create_research_plan with the actual request and exact subject.If the sources disagree or do not identify the exact product or seller, the result stays provisional. Research can decide whether an offer is ready to compare, but it cannot add ranking points.
No host and model combination is currently qualified for routine research use. Treat every research result as provisional until the buyer checks its identity, sources, conflicts, and unknowns.
A recommendation is not permission to buy. Every checkout needs a fresh approval for one exact offer and one unit. The signed approval includes the merchant, variant, price, known total, and spending cap. It can be used once.
NorthCinder rejects raw card details. A supported automated checkout can use an opaque payment token, or NorthCinder can hand the buyer a cart link to finish in their own browser.
Order outcomes stay local and only attach to the purchase they belong to. NorthCinder does not silently rewrite the buyer's profile, and its reminders only send notifications.
Seller payment never improves ranking. Sponsored offers stay labeled and below organic results. Missing store coverage stays visible, and unknown seller history remains unknown instead of being guessed safe or unsafe.
NorthCinder reruns the ranking locally and writes recommendations, approvals, and checkout attempts to a local audit log. The ranking specification, trust specification, neutrality audit, and checkout package contain the details.
These checks cover the offers NorthCinder received, not the completeness or truth of a store's catalog.
Your AI app talks to NorthCinder over MCP. NorthCinder runs the search engine locally, checks the ranking before returning it, and keeps the audit log and purchase approvals on your computer. You choose the store connections. The repository owner is not part of this path.
Store access varies, and NorthCinder says when a store was unavailable or not configured. It does not present a partial search as though it covered the whole market.
Built-in adapters cover Shopify, WooCommerce, eBay, Etsy, and read-only Amazon comparison.
If a native connection is missing, the AI app can keep researching with its own browser or search tools. NorthCinder accepts product facts, not cookies, raw pages, passwords, or page instructions. A native connection must confirm the exact offer before checkout or an unattended watch.
Most people should use local mode. If you choose to run the engine separately, set NORTHCINDER_API_KEYS on the service and configure the client with NORTHCINDER_SERVICE_URL and the matching NORTHCINDER_CLIENT_KEY bearer credential. Non-loopback bearer connections must use HTTPS.
Read privacy and software ownership and the security policy for the full boundary.
This is a pnpm workspace. Product packages need Node.js 20 or later. The private site workspace needs Node.js 22.12 or later.
corepack pnpm install --frozen-lockfile
corepack pnpm build
node northcinder/bin/northcinder.js init
The full release checks are documented in CONTRIBUTING.md.
NorthCinder is open source under the MIT License.