Back to MCP Trust Indexm8ven
69
/ 100
1 month ago
glama

amazon-mcp

MCP server for Amazon Selling Partner API and Advertising API, enabling access to orders, inventory, pricing, ads, and reports via natural language.

→ coaxon/amazon-mcp· listed on glama
Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
✅
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
✅
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
🔐
You'll be asked for 15 credentials: MELI_CLIENT_SECRET, MELI_REFRESH_TOKEN, TIKTOK_APP_KEY, TIKTOK_APP_SECRET, TIKTOK_ACCESS_TOKEN, AMAZON_LWA_CLIENT_SECRET, AMAZON_LWA_REFRESH_TOKEN, AMAZON_ADS_CLIENT_SECRET, AMAZON_ADS_REFRESH_TOKEN, AMAZON_MCP_API_KEY, AMAZON_MCP_PREVIEW_TOKEN_SECRET, SLACK_SIGNING_SECRET, STRIPE_WEBHOOK_SECRET, NOTIFY_SMTP_PASSWORD, NOTIFY_WEBHOOK_SECRET
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// required environment variables
This server reads these from process.env. You'll be asked to provide them before it can run.
configAMAZON_MCP_DATA_DIR— "": "/path/to/amazon-mcp/data"
configMELI_APP_ID
🔐 secretMELI_CLIENT_SECRET
🔐 secretMELI_REFRESH_TOKEN
configMELI_SITE_IDS
configMELI_USER_ID
configAMAZON_SELLER_ID— optional but recommended (Merchant Token)
🔐 secretTIKTOK_APP_KEY
🔐 secretTIKTOK_APP_SECRET
🔐 secretTIKTOK_ACCESS_TOKEN
configTIKTOK_SHOP_CIPHER
configAMAZON_COGS_DB_PATH
configAMAZON_LWA_CLIENT_ID— [Developer Console](https://developer.amazon.com) → your SP-API app → LWA credentials
🔐 secretAMAZON_LWA_CLIENT_SECRET
🔐 secretAMAZON_LWA_REFRESH_TOKEN— Seller Central → authorize app → refresh token
configAMAZON_SP_API_REGION
configAMAZON_MARKETPLACE_ID
configAMAZON_ADS_CLIENT_ID
🔐 secretAMAZON_ADS_CLIENT_SECRET
🔐 secretAMAZON_ADS_REFRESH_TOKEN
configAMAZON_ADS_PROFILE_ID
configAMAZON_MCP_DRY_RUN— Default =1 serves bundled fixtures — no LWA app, no Seller Central auth.
configAMAZON_CACHE_TTL
🔐 secretAMAZON_MCP_API_KEY— HTTP transport (Cursor / remote client). Set in server .env first.
configAMAZON_MCP_ALERT_DB
configAMAZON_MCP_PROJECT_ROOT
configAMAZON_MCP_FORCE_CORE— 1 python -m amazon_mcp # simulate core-only in monorepo
configFASTMCP_HOST
configAMAZON_MCP_HOST— AMAZON_MCP_TRANSPORT=streamable-http =127.0.0.1 AMAZON_MCP_PORT=8780 python -m amazon_mcp
configFASTMCP_PORT
configAMAZON_MCP_PORT— AMAZON_MCP_TRANSPORT=streamable-http AMAZON_MCP_HOST=127.0.0.1 =8780 python -m amazon_mcp
configAMAZON_TENANT_ID
configAMAZON_MCP_LOG_LEVEL
configAMAZON_MCP_TRANSPORT— streamable-http AMAZON_MCP_HOST=127.0.0.1 AMAZON_MCP_PORT=8780 python -m amazon_mcp
configAMAZON_MCP_NOTIFICATION_WEBHOOK_URL
configAMAZON_MCP_DEFAULT_TIER
configAMAZON_USAGE_LEDGER_DB
configAMAZON_SLACK_PERMISSIONS_PATH
configAMAZON_MCP_SLACK_PERMISSIONS_ENFORCE
🔐 secretAMAZON_MCP_PREVIEW_TOKEN_SECRET
🔐 secretSLACK_SIGNING_SECRET
configAMAZON_MCP_SLACK_INTERACTIVE_ENABLED
🔐 secretSTRIPE_WEBHOOK_SECRET
configSTRIPE_PRICE_TIER_MAP
configNOTIFY_WEBHOOK_HEADERS
configNOTIFY_EMAIL_ENABLED
configNOTIFY_SMTP_HOST
configNOTIFY_SMTP_PORT
configNOTIFY_SMTP_USERNAME
🔐 secretNOTIFY_SMTP_PASSWORD
configNOTIFY_EMAIL_FROM
configNOTIFY_EMAIL_TO
configNOTIFY_SMTP_TLS
configNOTIFY_SES_REGION
configNOTIFY_SES_FROM
configNOTIFY_SLACK_ENABLED
configNOTIFY_SLACK_WEBHOOK_URL
configNOTIFY_SLACK_CHANNEL
configNOTIFY_DISCORD_ENABLED
configNOTIFY_DISCORD_WEBHOOK_URL
configNOTIFY_WEBHOOK_ENABLED
configNOTIFY_WEBHOOK_URL
🔐 secretNOTIFY_WEBHOOK_SECRET
configAMAZON_BRIEFING_ASSETS_DIR
configAMAZON_MCP_PUBLIC_BASE_URL
configAMAZON_DEFAULT_LEAD_TIME_DAYS
configAMAZON_DEFAULT_SAFETY_STOCK_DAYS
configAMAZON_MCP_DAILY_BRIEFING_SCHEDULE_ENABLED
configAMAZON_MCP_DAILY_BRIEFING_SCHEDULE_TIME
configAMAZON_MCP_DAILY_BRIEFING_SCHEDULE_TZ
// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 5 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/coaxon-amazon-mcp-17o2y2)](https://m8ven.ai/mcp/coaxon-amazon-mcp-17o2y2)
commit: 1c84a289fa2380375fbebbc9cd6f106a6d3a5d33
code hash: 5a4973d7ea659025a633a558b0ad1678a8ad82ad930adf31b63d7e661fc90927
verified: 6/28/2026, 9:06:32 AM
view raw JSON →