Back to Browse

Tarigrisurgical MCP Server

Developer ToolsModerate5.0MCP RegistryLocalRemote
Free

Server data from the Official MCP Registry

Browse the Tarigri Surgical Instruments wholesale catalog, get quotes and draft order inquiries.

About

Browse the Tarigri Surgical Instruments wholesale catalog, get quotes and draft order inquiries.

Remote endpoints: streamable-http: https://mcp.tarigrisurgical.com/mcp

Security Report

5.0
Moderate5.0Moderate Risk

This is a read-only, unauthenticated MCP server for the public Tarigri Surgical wholesale catalog. It has no hardcoded secrets, no shell or file-write operations, and no sending of data; draft_inquiry only builds mailto and WhatsApp links for the user to send. The main concern is that catalog JavaScript fetched from a configurable origin is evaluated with Node's vm module, which is not a security boundary, so the origin must be trusted. Supply chain analysis found 6 known vulnerabilities in dependencies (2 critical, 2 high severity). Package verification found 1 issue.

12 files analyzed · 12 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.

Permissions Required

This plugin requests these system permissions. Most are normal for its category.

HTTP Network Access

Connects to external APIs or services over the internet.

env_vars

Check that this permission is expected for this type of plugin.

How to Install & Connect

Available as Local & Remote

This plugin can run on your machine or connect to a hosted endpoint. during install.

Documentation

View on GitHub

From the project's GitHub README.

Tarigri Surgical MCP Server

A Model Context Protocol server for tarigrisurgical.com, a Sialkot (Pakistan) manufacturer of stainless steel surgical, dental, orthopedic and ENT instruments. It lets AI assistants search the wholesale catalog, price quantities and prepare an order request.

Built from qmmughal/mcp-server-template, upgraded to the high-level McpServer API (SDK 1.32).

Standards coverage

AreaStatus
Transportsstdio (local, npx/node) and Streamable HTTP (remote, stateless, POST /mcp, deployable on Vercel)
ProtocolNegotiated by the official TypeScript SDK (2025-06-18 and earlier)
Tools6 tools, each with title, JSON-Schema input, outputSchema + structuredContent, and annotations (readOnlyHint, destructiveHint: false, idempotentHint, openWorldHint)
ErrorsTool failures return isError: true results (not protocol errors); bad arguments are rejected by schema validation
ResourcesStatic tarigri://catalog, listable template tarigri://product/{sku} with argument completion
Promptssource_instruments with typed arguments
Server infoname, title, version, websiteUrl, and model-facing instructions
SafetyRead-only; nothing is ordered or sent. stdout is reserved for JSON-RPC, logs go to stderr
Testing24 tests, including protocol-level tests through a real MCP Client; verified with the official MCP Inspector over both stdio and HTTP
Not implementedAuthentication (public catalog data), sessions/SSE streams (stateless by design), sampling/elicitation (not needed)

Tools

ToolPurpose
search_productsFilter by text, category, max price, best sellers
get_productFull details for a SKU (price, MOQ, 50+/100+ tiers, material, size, URL)
list_categoriesThe 8 categories with product counts
estimate_quoteIndicative total for SKU + quantity lines; applies volume tiers, flags quantities below MOQ
get_company_infoContact details, hours, buyer FAQ
draft_inquiryDrafts the quotation request as text plus mailto: and WhatsApp links for the user to send themselves

All prices are factory-direct wholesale USD, FOB Sialkot; shipping is quoted separately by Tarigri.

How it works

The site is a client-rendered SPA with no API, but it publishes its catalog as /data.js. The server fetches it, validates it with Zod, converts PKR prices to USD using the site's own rate, and caches it in memory (default 15 min, stale copy served if a refresh fails).

Run locally

npm install
npm run build        # dist/index.js (single bundled executable with shebang)
npm test
npm run inspect      # opens the official MCP Inspector against the build
VariableDefaultMeaning
TARIGRI_SITE_ORIGINhttps://tarigrisurgical.comSite serving /data.js
CATALOG_CACHE_TTL_SECONDS900Catalog cache lifetime
LOG_LEVELinfoLogs go to stderr only
LOG_PRETTYfalsePretty logs when running from source with tsx (not the bundle)

Deploy to Vercel (remote server)

The repo is Vercel-ready: api/mcp.ts is the function, /mcp is rewritten to it, and public/index.html is a landing page with copy-paste configs.

  1. Vercel dashboard → Add New → Project → import qmmughal/tarigrisurgical-mcp-server (or run npx vercel login && npx vercel --prod).
  2. Keep the defaults (vercel.json sets the framework and output directory). No env vars are required.
  3. Optional: add a domain such as mcp.tarigrisurgical.com under Project → Domains.

Your endpoint is then https://<your-domain>/mcp. The endpoint is public and unauthenticated by design (it only exposes the public catalog). Add Vercel's WAF/rate limiting if you expect heavy traffic.

Connect from AI tools

Replace <URL> with your Vercel endpoint (https://…/mcp). Until the package is published to npm, use the local node form with the absolute path to dist/index.js instead of npx.

Claude Code

claude mcp add --transport http tarigri-surgical <URL>
# or local: claude mcp add tarigri-surgical -- node /abs/path/dist/index.js

Claude Desktop: Settings → Connectors → Add custom connector with <URL>, or claude_desktop_config.json:

{ "mcpServers": { "tarigri-surgical": { "command": "node", "args": ["/abs/path/dist/index.js"] } } }

Cursor (.cursor/mcp.json)

{ "mcpServers": { "tarigri-surgical": { "url": "<URL>" } } }

VS Code / GitHub Copilot (.vscode/mcp.json)

{ "servers": { "tarigri-surgical": { "type": "http", "url": "<URL>" } } }

Windsurf (~/.codeium/windsurf/mcp_config.json)

{ "mcpServers": { "tarigri-surgical": { "serverUrl": "<URL>" } } }

Gemini CLI (~/.gemini/settings.json)

{ "mcpServers": { "tarigri-surgical": { "httpUrl": "<URL>" } } }

Codex CLI (~/.codex/config.toml)

[mcp_servers.tarigri-surgical]
command = "node"
args = ["/abs/path/dist/index.js"]

Any client that only supports stdio: npx -y mcp-remote <URL>.

Notes

  • data.js is evaluated in an empty node:vm context with a timeout, then schema-validated. vm is not a security sandbox, so only point TARIGRI_SITE_ORIGIN at a site you trust.
  • Product images on the site are illustrative; CE/ISO certificate numbers are not published, only "available on request". The server never claims more.
  • If the site changes the shape of data.js, validation fails with a clear error rather than returning bad data.

License

MIT

Reviews

No reviews yet

Be the first to review this server!