Inspection report
amazon-sp-api-mcp
Open source MCP server from ailumia. Tool list: code-checked7.
The answer
0
What can it change in your account?
None of the 6 tools on record can change data.
name based Read and write here are inferred from tool names and descriptions, not from a test.
| Area | Access | Write tools | Read tools |
|---|---|---|---|
| Orders | · Orders no tool on record | 0 | 0 |
| Ads | · Ads no tool on record | 0 | 0 |
| Listings | · Listings no tool on record | 0 | 0 |
| Pricing | · Pricing no tool on record | 0 | 0 |
| Inventory | · Inventory no tool on record | 0 | 0 |
| Reports | R Reports read only | 0 | 2 |
| Finance | · Finance no tool on record | 0 | 0 |
Record
The facts on file.
- Type
- open-source
- Vendor or owner
- ailumia
- License
- Apache-2.03
- Authentication
- LWA refresh token4
- Transport
- stdio, http
- Marketplaces
- DE, US6
- Pricing
- free / open source (self-hosted; upstream API costs apply)5
- Last commit
- Aug 27, 2026
- Last release
- Jul 20, 2026, @ailumia/amazon-sp-api-mcp v1.0.0 on npm
- GitHub stars
- 4
- Tool list from
- code-checked7
Tools
All 6 tools we found.
Grouped by what they do to your data. The access column shows why we put a tool there.
read Reads data 6
| Tool | Description | Area | Access basis |
|---|---|---|---|
| describe_operation | Return the exact method, path, parameters, request body, and validation schema for an operation ID. | Other | name based |
| discover_operations | Search the version-aware Amazon SP-API registry. Use this before describe_operation or invoke_operation. | Other | name based |
| get_artifact | Read a chunk from a large or binary result saved by invoke_operation or run_report. | Reports | name based |
| invoke_operation | Execute an operation using a stable account name. Multiple-account configurations require accountName. Writes require confirm=true unless dryRun=true. | Other | name based |
| list_accounts | List safe account metadata, including account names, regions, and marketplace participations. Credentials are never returned. | Other | name based |
| run_report | Create a report for a stable account name, poll until completion, download and decompress it, then return an artifact reference. | Reports | name based |
Method
How we checked this server.
We read the tool definitions in the source code. We did not run the server against a seller account.7
Not tested with credentials. We did not connect this server to a seller or ads account. A tool marked read can still have side effects we could not see, and a vendor can add write tools at any time. Check the list again before you grant access.
Areas come from keywords in tool names, as explained on the matrix page.
Notes
Sources for this report
- 1Source repository or product pagegithub.com
- 2Documentationgithub.com
- 3License: GitHub API repo.license (search 2026-10-30)
- 4Authentication: static scan of repo (env names / code patterns)
- 5Pricing: https://github.com/ailumia/amazon-sp-api-mcpgithub.com
- 6Marketplaces: marketplace IDs found in code
- 7Our MCP inventory of Oct 30, 2026: tool list, access marks, stars and last commit. GitHub repository search (22 queries, unauthenticated) -> shallow clone -> static extraction (extract_tools.py) -> optional runtime tools/list (mcp_probe.py); vendor/official from public docs. access=read|write is a name/description heuristic unless access_basis says otherwise.