YawLabs/lemonsqueezy-mcp

MCP server for the LemonSqueezy API. Enables managing stores, products, customers, subscriptions, discounts, and license keys from any MCP-compatible AI assistant.

→ YawLabs/lemonsqueezy-mcp · listed on glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings

🚨

Secret credentials may flow to a network call

1 flow detected: LEMONSQUEEZY_SINK_ADMIN_TOKEN. We can’t prove the destination matches the brand the credential belongs to.

🔐

You'll be asked for 3 credentials: LEMONSQUEEZY_API_KEY, LEMONSQUEEZY_SINK_ADMIN_TOKEN, LEMONSQUEEZY_TEST_API_KEY

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// required environment variables

This server reads these from process.env. You'll be asked to provide them before it can run.

configLEMONSQUEEZY_ALLOWED_STORE_IDS

🔐 secretLEMONSQUEEZY_API_KEY— export ="your-api-key"

configLEMONSQUEEZY_API_KEY_COMMAND— All configuration is via environment variables. Only LEMONSQUEEZY_API_KEY (or ) is required; everything else is opt-in.

configLEMONSQUEEZY_DESTRUCTIVE_RATE_LIMIT

configLEMONSQUEEZY_DISABLE_CLASSES— Guardrails — opt-in store allowlist, refund cap, destructive-call rate limit, authority-class disable (), and per-authority-class rate limits (LEMONSQUEEZY_RATE_LIMIT_PER_CLASS)

configLEMONSQUEEZY_LOG

configLEMONSQUEEZY_MAX_REFUND_AMOUNT_CENTS— Rejects ls_refund_order and ls_refund_subscription_invoice calls above this amount.

configLEMONSQUEEZY_RATE_LIMIT_PER_CLASS— Guardrails — opt-in store allowlist, refund cap, destructive-call rate limit, authority-class disable (LEMONSQUEEZY_DISABLE_CLASSES), and per-authority-class rate limits ()

🔐 secretLEMONSQUEEZY_SINK_ADMIN_TOKEN

configLEMONSQUEEZY_SINK_URL

🔐 secretLEMONSQUEEZY_TEST_API_KEY— npm run test:integration # requires + LEMONSQUEEZY_TEST_STORE_ID

configLEMONSQUEEZY_TEST_STORE_ID— npm run test:integration # requires LEMONSQUEEZY_TEST_API_KEY +

// full audit trail

The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.

// embed badge in your README

[![M8ven Score](https://m8ven.ai/badge/mcp/yawlabs-lemonsqueezy-mcp-ah9xo9)](https://m8ven.ai/mcp/yawlabs-lemonsqueezy-mcp-ah9xo9)

commit: 157358dc44e2122294538df1be3931befc5bec97

code hash: a538f3959f3be7529b066d9e3ece924fb16afa7ebf12f6315fba586a9f2aaa89

verified: 6/10/2026, 11:05:30 AM

view raw JSON →