cross-shop

cross-shop batches product search, exact product detail, and anonymous destination shipping quotes across public storefronts and marketplaces. Its compact JSON output is built for AI agents: store constants are hoisted, empty fields disappear, search results use handles instead of refs, and image URLs stay in the run cache.

Install

Install the CLI from PyPI:

uv tool install cross-shop
cross-shop search '[{"store":"https://example.com","query":"bearing"}]'

Run a one-off command without installing:

uvx cross-shop search '[{"store":"https://example.com","query":"bearing"}]'

Other commands follow the same form:

cross-shop product '["r1.1.1"]'
cross-shop quote '[{"store":"https://example.com","lines":[{"item":"r1.1.1.2","quantity":3}]}]'
cross-shop images r1.1.1 1:3
cross-shop config show

From a source checkout, replace cross-shop with uv run --project <package-dir> cross-shop. Run tests with uv run --project <package-dir> pytest.

Related MCP server: KaliCart Global

MCP

The stdio MCP server exposes search, product, quote, and images with the same compact results as the CLI. Register it with Claude Code:

claude mcp add cross-shop -- uvx cross-shop mcp

Equivalent .mcp.json:

{
  "mcpServers": {
    "cross-shop": {
      "command": "uvx",
      "args": ["cross-shop", "mcp"]
    }
  }
}

Pi can read the same config through pi-mcp-adapter, installed with pi install npm:pi-mcp-adapter.

Commands

• search <entries-json> [--limit 20] [--description-chars 300] [--redetect] [--debug] accepts 1–100 {store,query} entries. Repeated stores share one session and detection, and products are deduplicated.

• product <items-json> [--description-chars 2000] [--redetect] [--debug] accepts 1–100 product URLs, run handles, or ref objects.

• quote <quotes-json> [--destination <json>] [--redetect] [--debug] accepts 1–20 stores with 1–20 lines each. One cart contains every line for a store entry.

• images <item-handle> [N|START:END] downloads at most ten cached product images and prints absolute paths.

• config set-destination <json>, config show, and config import-vendors <path> manage persistent configuration. config show reports configured credential blocks without printing secrets or private-key paths.

• mcp runs the stdio MCP server.

Search and product write monotonic run IDs. r7.2.5 means item 5 from store 2 in run 7; r7.2.5.3 means its third variant. Handles expire after seven days. Product detail emits strict, self-contained durable refs such as {"platform":"shopify","store":"https://example.com","variant_id":"gid://shopify/ProductVariant/123"}. Product URLs with query strings or fragments are rejected because those components can carry identity; Amazon product URLs are normalized to their ASIN.

Store workers run concurrently, up to five at a time. Operations for one store remain sequential in one isolated cookie jar. An unexpected adapter exception becomes an api_error for that store without aborting other workers. Exit status is 1 when any entry has status:api_error.

Storefronts and marketplaces

Storefront adapters cover Shopify, WooCommerce, Magento GraphQL/HTML/guest REST, BigCommerce Stencil/Storefront REST, Squarespace, Wix, Ecwid, and Salesforce Commerce Cloud boundaries. Wix, Ecwid, and customized SFCC or OpenCart checkout remain explicit browser boundaries.

These origins use marketplace adapters without live platform detection:

Google Shopping, Amazon search, AliExpress, and Walmart search results are leads. Re-verify the exact listing, variant, stock, and delivered price. An Etsy listing with variations prices its cheapest offering, so its variant is named Lowest-priced variation.

Data and settings

The default data directory comes from platformdirs.user_data_path("cross-shop"). Set CROSS_SHOP_DATA_DIR to override it. Runtime data never writes into the package tree.

• settings.json stores destination and optional integrations.

• vendors.json is the atomic, lock-protected canonical-origin platform registry.

• run-counter never resets, so deleted runs cannot make old handles point at new data.

• runs/ stores full seven-day result payloads, including refs and image URLs omitted from stdout.

• images/ stores files downloaded by images.

Destination precedence is --destination, then settings.json, then the built-in San Francisco address. country and postal_code are required; region, city, and address1 are optional.

{
  "destination": {"country":"US","region":"CA","city":"San Francisco","address1":"747 Howard St","postal_code":"94103"},
  "web_bot_auth": {"private_key_path":"/secure/private.pem","key_directory_url":"https://agent.example/.well-known/http-message-signatures-directory"},
  "ebay": {"client_id":"…","client_secret":"…"},
  "bestbuy": {"api_key":"…"},
  "etsy": {"keystring":"…","shared_secret":"…"},
  "shopify_global": {"profile_url":"https://agent.example/profile.json"}
}

Credentials

• SERPAPI_API_KEY: SerpApi Google Shopping, Amazon, and Walmart search.

• ALIEXPRESS_APP_KEY and ALIEXPRESS_APP_SECRET: AliExpress Affiliate Product Query.

• settings.ebay.client_id and settings.ebay.client_secret: eBay Developers Program production Browse API keyset. Production access requires eBay marketplace account-deletion notification compliance.

• settings.bestbuy.api_key: Best Buy Developer API key, issued only to company-domain email addresses. Its terms cap caching at 72 hours and forbid use on behalf of other retailers.

• settings.etsy.keystring and settings.etsy.shared_secret: Etsy Open API v3 app credentials from the approval-gated registration at etsy.com/developers/register.

• settings.shopify_global.profile_url: public UCP agent profile required by Shopify's Global Catalog contract.

Missing marketplace credentials produce a structured setup error only when that marketplace is requested.

Web Bot Auth

Shopify product URLs resolve through the public Ajax product endpoint; durable variant refs resolve through Storefront GraphQL. Unsigned Shopify HTTP is the default. settings.web_bot_auth opts into Ed25519 HTTP Message Signatures. The signer validates the key type and JWK thumbprint, creates fresh nonce and expiry material for every request, refuses pre-signed requests, and signs redirects only after the Shopify adapter verifies the HTTPS authority and API path. A configured but missing or unreadable key is an api_error; the tool never falls back to unsigned traffic.

Host your public key directory with the included Cloudflare Worker.