Medusa Mcp

MCP server for Medusa JS SDK

→ SGFGOV/medusa-mcp · listed on mcp_so

Install from

mcp.so

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings

🚨

Known vulnerabilities in dependencies: 1 critical, 2 high

Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.

🔐

You'll be asked for 5 credentials: COOKIE_SECRET, JWT_SECRET, MEDUSA_PASSWORD, NEXT_PUBLIC_MEDUSA_PUBLISHABLE_KEY, PUBLISHABLE_KEY

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// required environment variables

This server reads these from process.env. You'll be asked to provide them before it can run.

configADMIN_CORS

configAUTH_CORS

🔐 secretCOOKIE_SECRET

configDATABASE_URL

🔐 secretJWT_SECRET

configMEDUSA_BACKEND_URL— Your Medusa backend URL

🔐 secretMEDUSA_PASSWORD— Medusa admin password (for admin)

configMEDUSA_USERNAME— Medusa admin username (for admin)

🔐 secretNEXT_PUBLIC_MEDUSA_PUBLISHABLE_KEY

🔐 secretPUBLISHABLE_KEY— Your Medusa publishable API key

configSTORE_CORS

configTEST_TYPE

// full audit trail

The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.

// improvement guidance — verified publishers only

We have 2 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Score](https://m8ven.ai/badge/mcp/sgfgov-medusa-mcp-1hyid3)](https://m8ven.ai/mcp/sgfgov-medusa-mcp-1hyid3)

commit: d1ce4896b456e5ee85273db79ba4d250045c6965

code hash: 962485d9bee73d9d7445fd485a99cf9aefa351736f32dc2ef71167c996f4fc12

verified: 4/18/2026, 7:18:45 PM

view raw JSON →