Unchained Engine
About
E-Commerce Engine with built-in MCP Server
Details
- Author
- unchainedshop
- Categories
- Productivity
Jump to
Setup
Install Unchained Engine in your MCP client (Claude Desktop, Cursor, Windsurf, and others).
Repository: https://github.com/unchainedshop/unchained
Follow the installation instructions in the repository README, then restart your MCP client.
E-Commerce Engine with built-in MCP Server
Unchained Engine is a modular, API-first e-commerce platform built as a monorepo with npm workspaces. It provides a complete solution for building custom e-commerce applications with GraphQL APIs, extensible plugin architecture, and support for modern use cases like subscriptions, quotations, and tokenized products.
- Node.js >=22 (see.nvmrc)
- MongoDB 4.4+ (or use MongoDB Memory Server for development)
Then navigate tohttp://localhost:4000/to view the welcome screen. Login with:
- User:admin@unchained.local
- Password:password
A minimum of 24GB VRAM is needed for this.
llama-server -hf ggml-org/gpt-oss-20b-GGUF --ctx-size 0 --jinja -ub 2048 -b 2048
Unchained Engine is organized in a hierarchical structure:
platform → Highest level orchestration, combines all packages ↓ api → GraphQL API layer with Express/Fastify adapters ↓ core → Business logic coordination, integrates all core- modules ↓ core- → Domain-specific modules (users, products, orders, etc.) ↓ infrastructure → Base utilities (mongodb, events, logger, utils, roles)
Business logic modules for e-commerce functionality:
Foundational utilities used across all layers:
Unchained uses a Director/Adapter pattern for extensibility. Directors manage collections of adapters that implement specific behaviors.
See theCore READMEfor detailed documentation on creating custom adapters.
The@unchainedshop/pluginspackage includes:
- Stripe, PayPal, Braintree, Datatrans, Saferpay
- Payrexx, Cryptopay, Apple IAP
- Invoice (standard and prepaid)
- Post (manual shipping), Store pickup, Digital delivery
- Product catalog pricing, Currency conversion, Tax calculation (Swiss VAT)
- Order-level and product-level discounts, Price rounding
- MongoDB GridFS, MinIO/S3-compatible storage
- Email (Nodemailer), SMS (Twilio, Bulkgate), Push notifications
- Currency rate updates (ECB, Coinbase), Bulk import
- Node.js EventEmitter, Redis pub/sub, AWS EventBridge
npm install # Install all dependencies npm run dev # Start development with hot-reload npm run build # Build all packages npm test # Run all tests npm run lint # Lint and fix code
npm run test:run:unit # Run unit tests only npm run test:run:integration # Run integration tests node --test path/to/test.ts # Run a single test file
unchained/ ├── packages/ # All npm packages │ ├── platform/ # Main entry point │ ├── api/ # GraphQL API │ ├── core/ # Business logic orchestration │ ├── core-*/ # Domain modules │ ├── plugins/ # Official plugins │ ├── ticketing/ # Ticketing extension │ └── ... # Infrastructure packages ├── examples/ # Example implementations │ ├── kitchensink/ # Full-featured example │ ├── minimal/ # Minimal setup │ └── ... └── tests/ # Integration tests
SeeMIGRATION.mdfor upgrade instructions between major versions.
Unchained provides a Claude Code skill to help with upgrades:
claude "skill install https://docs.unchained.shop/skills/upgrade-unchained/SKILL.md"
This skill guides Claude through fetching the correct migration guide, changelog, and examples for your target version.
Unchained Engine is designed for deployment in security-sensitive environments including banking, government, and enterprise contexts.
- Password Hashing: PBKDF2-SHA512 with 300,000 iterations
- Token Security: SHA-256 hashing, cryptographically random generation
- Session Encryption: AES-256-GCM (optional)
- Payment Signatures: HMAC-SHA-256/512
For US federal government and regulated environments, run Unchained with FIPS-validated cryptography:
# Use Chainguard FIPS image FROM cgr.dev/chainguard/node-fips:latest WORKDIR /app COPY . . CMD ["node", "index.js"]
API Hardening (Denial-of-Service Protection)
The GraphQL API doesnotimpose query-complexity, depth, alias-count, or rate limits by default. Unchained is a headless engine embedded in your own server process, so where and how these edge protections are enforced is a deployment decision that belongs to the integrator — appropriate thresholds depend on your schema extensions, traffic profile, and infrastructure (CDN, WAF, API gateway, reverse proxy).
Anonymous access is enabled by default for read-only storefront queries (e.g.assortments,products,filters,languages,currencies,countries,search). Because GraphQL lets a single request batch many aliased fields, an unbounded query can fan out into many database operations. Bounding this is the operator's responsibility.
-
Query validation (in-process).GraphQL Yoga plugins and validation rules are forwarded straight throughstartPlatform/startAPIServerto the underlying Yoga server. For example, usingGraphQL Armor:
import { startPlatform } from '@unchainedshop/platform'; import { maxAliasesPlugin } from '@escape.tech/graphql-armor-max-aliases'; import { maxDepthPlugin } from '@escape.tech/graphql-armor-max-depth'; import { maxTokensPlugin } from '@escape.tech/graphql-armor-max-tokens'; await startPlatform({ // ...your options plugins: [ maxAliasesPlugin({ n: 15 }), maxDepthPlugin({ n: 10 }), maxTokensPlugin({ n: 1000 }), ], });
Rate limiting & request-size limits (at the edge).Enforce per-IP / per-token rate limits and body-size caps at your reverse proxy, API gateway, or WAF (e.g. nginxlimit_req, Cloudflare, AWS WAF). Keep anonymous traffic on a tighter budget than authenticated traffic.
Pagination caps.If you expose custom list resolvers, clamplimit/ pagination server-side.
SeeSECURITY.mdfor complete security documentation, compliance details, and deployment recommendations.
- Security Documentation
- Changelog
- Benchmarks
Please see ourContribution Guidelines.
See ourContributor Covenant Code of Conduct.
The 1Password MCP server creates a bridge that allows MCP clients such as Codex and Kiro to manage your 1Password Environments with secure authorization prompts.
This is the 1st, easiest, and cheapest PPT, slides, presentation AI generation MCP Server in the world.
Persistent memory for any AI assistant. Zero token cost until recall. Stores memories in local SQLite, ranks by 6-factor scoring, returns results 79% smaller than JSON. Works with Claude, ChatGPT, Grok, Cursor, Windsurf, and any MCP client.
A MCP server that enables AI assistants to interact with Anki, the spaced repetition flashcard application.
Enables LLM clients to interact with macOS applications through AppleScript. Built using the @beyondbetter/bb-mcp-server library, this server provides safe, controlled execution of predefined scripts with optional support for arbitrary script execution.
An MCP server for WordPress plugin audits
Turn your AI assistant into a digital marketing hub that creates, organizes, and analyzes links and QR Codes on demand.
Connect AI clients to Cal.com scheduling through the Model Context Protocol using the hosted server at mcp.cal.com or a local instance.
Sync Calendars, Scheduling Links, AI Executive Scheduling Assistant, Unified Calendar
Sign in to leave a review
Use Google, GitHub, or an email account so ratings stay tied to real people.
No reviews posted yet.
