storefront guard for VS Code

io.github.maxigirl123/storefront-guard

Verifies a merchant storefront is legitimate before an AI agent commits payment.

client:VS Code transport:stdio runtime:npm

Install storefront guard in VS Code

.vscode/mcp.json

{
  "inputs": [
    {
      "type": "promptString",
      "id": "google-safe-browsing-api-key",
      "description": "GOOGLE_SAFE_BROWSING_API_KEY",
      "password": true
    },
    {
      "type": "promptString",
      "id": "sam-gov-api-key",
      "description": "SAM_GOV_API_KEY",
      "password": true
    },
    {
      "type": "promptString",
      "id": "urlhaus-auth-key",
      "description": "URLHAUS_AUTH_KEY",
      "password": true
    }
  ],
  "servers": {
    "storefront-guard": {
      "type": "stdio",
      "command": "npx",
      "args": [
        "-y",
        "storefront-guard-mcp-server"
      ],
      "env": {
        "GOOGLE_SAFE_BROWSING_API_KEY": "${input:google-safe-browsing-api-key}",
        "SAM_GOV_API_KEY": "${input:sam-gov-api-key}",
        "URLHAUS_AUTH_KEY": "${input:urlhaus-auth-key}"
      }
    }
  }
}

VS Code prompts for each input the first time the server starts, so no secret is written to the file. VS Code docs

storefront guard in other clients

storefront guard MCP server