Digikala Mcp

What was checked

Plain notes from the hygiene checks.

• Permissions

  Pass

  No shell or command execution found, and no extra permission was declared.

• Install and update

  Pass

  No install-time script found, and dependencies are pinned or absent.

• Network

  Serious

  accepts a host from input, with no fixed list in this file.

  NETWORK_HOST_FROM_INPUT

  src/digikala_mcp/catalog.py, line 105

  data = (await fetch("/v1/search/", params))["data"]

  src/digikala_mcp/catalog.py, line 143

  calls = [fetch("/v1/search/", {**base, **_prices(min_price, max_price), "page": n}) for n in range(1, pages + 1)]

  src/digikala_mcp/catalog.py, line 145

  calls.append(fetch("/v1/search/", {**base, "page": 1})) # unfiltered, so the floor sees the real items

  Show more

  src/digikala_mcp/catalog.py, line 197

  fetch(f"/v1/categories/{category_code}/search/", {**budget, "has_selling_stock": 1, "page": n})

  src/digikala_mcp/catalog.py, line 204

  calls = [fetch("/v1/search/", {**base, **budget, "page": n}) for n in range(1, pages + 1)]

  src/digikala_mcp/catalog.py, line 206

  calls.append(fetch("/v1/search/", {**base, "page": 1})) # unfiltered, to see what the real items cost

  src/digikala_mcp/catalog.py, line 276

  data = (await fetch("/v1/autocomplete/", {"q": query}))["data"]

  src/digikala_mcp/catalog.py, line 325

  data = (await fetch(path, {"page": 1}))["data"]

  src/digikala_mcp/catalog.py, line 327

  data = (await fetch("/v1/search/", {"q": query, "page": 1}))["data"]

  src/digikala_mcp/catalog.py, line 393

  body = await fetch("/v1/category-tree/", cache=False)

  src/digikala_mcp/catalog.py, line 449

  return listing((await fetch(path, params))["data"])

  src/digikala_mcp/catalog.py, line 471

  await fetch(f"/v1/brands/{brand_code}/", listing_params(sort, min_price, max_price, None, in_stock_only, page))

  src/digikala_mcp/catalog.py, line 497

  data = (await fetch(f"/v1/sellers/{seller_code}/", listing_params(sort, None, None, None, in_stock_only, page)))[

  src/digikala_mcp/catalog.py, line 545

  return listing((await fetch(path, params))["data"])

  src/digikala_mcp/catalog.py, line 561

  data = (await fetch("/v1/best-selling/", {"category_id": category_id} if category_id else None))["data"]

  src/digikala_mcp/catalog.py, line 609

  data = (await fetch(f"/fresh/v1/categories/{category_code}/search/", params))["data"]

  src/digikala_mcp/catalog.py, line 611

  data = (await fetch("/fresh/v1/search/", {"q": query, **params}))["data"]

  src/digikala_mcp/http.py, line 59

  """The Chrome profile sends navigation-only headers; a None value makes curl drop them (API calls are XHR)."""

  src/digikala_mcp/http.py, line 156

  async def fetch(path: str, params: dict[str, Any] | None = None, cache: bool = True) -> Any:

  src/digikala_mcp/product.py, line 46

  p = (await fetch(f"/product/v1/products/{product_id}/"))["data"]["product"]

  src/digikala_mcp/product.py, line 51

  p = (await fetch(f"/fresh/v1/product/{product_id}/"))["data"]["product"]

  src/digikala_mcp/product.py, line 94

  data = (await fetch(f"/v1/product/{product_id}/price-chart/"))["data"]

  src/digikala_mcp/product.py, line 141

  data = (await fetch(f"/v1/rate-review/products/{product_id}/", {"page": page, "sort": api_sort}))["data"]

  src/digikala_mcp/product.py, line 181

  data = (await fetch(f"/v1/product/{product_id}/questions/", {"page": page, "sort": api_sort}))["data"]

  src/digikala_mcp/product.py, line 219

  await fetch(

  src/digikala_mcp/product.py, line 243

  items = (await fetch("/v1/product/compare/", params))["data"]["compare_products"]

  src/digikala_mcp/product.py, line 327

  data = (await fetch(f"/v1/product/{product_id}/digipay-credit/"))["data"]

  src/digikala_mcp/services.py, line 18

  data = (await fetch("/v1/digiplus/plans/"))["data"]

  src/digikala_mcp/services.py, line 46

  coins, gold = await asyncio.gather(fetch("/v1/super-app/price-list/"), fetch("/v1/super-app/price-chart/gold18/"))

  src/digikala_mcp/services.py, line 96

  a = (await fetch("/v1/map/reverse-geo/", {"latitude": lat, "longitude": long}))["data"].get("address") or {}

  src/digikala_mcp/services.py, line 107

  data = (await fetch("/v1/map/geo/", params))["data"]

• Secrets

  Pass

  No read of a credential file or secret environment variable found.

• Agent instructions

  Pass

  No instruction to ignore earlier instructions or to hide a step.

• Obfuscation

  Note

  a file was over the read cap and was not fully read.

  OBFUSCATION_FILE_OVER_READ_CAP

  uv.lock, line 1

  version = 1

• Licence

  Pass

  A licence file is present (LICENSE).

• Maintainer activity

  Pass

  The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit 9c66fbe7aa33. accepts a host from input, with no fixed list in this file. a file was over the read cap and was not fully read.

Date and source

Date checked: 27 Oct 2026

Read how this letter is chosen