Back to Browse

Canopy Api MCP Server

Developer ToolsModerate6.8MCP RegistryLocalRemote
Free

Server data from the Official MCP Registry

Amazon product API & MCP server: search, prices, reviews, sellers, deals, and ASIN lookup by Canopy.

About

Amazon product API & MCP server: search, prices, reviews, sellers, deals, and ASIN lookup by Canopy.

Remote endpoints: streamable-http: https://mcp.canopyapi.co/mcp

Security Report

6.8
Moderate6.8Moderate Risk

This is a well-structured MCP server for Amazon product data via the Canopy API. Authentication is properly implemented with multiple header format support and validated before MCP transport processing. The codebase demonstrates good security practices with no evidence of malicious patterns, credential leaks, or dangerous operations. Minor code quality observations around error handling do not materially impact security. Supply chain analysis found 1 known vulnerability in dependencies (0 critical, 1 high severity).

3 files analyzed · 4 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.

Permissions Required

This plugin requests these system permissions. Most are normal for its category.

HTTP Network Access

Connects to external APIs or services over the internet.

env_vars

Check that this permission is expected for this type of plugin.

How to Install & Connect

Available as Local & Remote

This plugin can run on your machine or connect to a hosted endpoint. during install.

Documentation

View on GitHub

From the project's GitHub README.

Canopy API MCP Server

A type-safe MCP (Model Context Protocol) server that provides Amazon product data through the Canopy API. Built with xmcp and deployed on Cloudflare Workers.

Features

  • 12 Amazon Data Tools — product info, variants, stock, sales, reviews, search, autocomplete, categories, sellers, authors, and deals
  • Streamable HTTP transport at /mcp (current MCP spec)
  • File-based tools — one file per tool under src/tools/
  • Type Safety — TypeScript types generated from the Canopy OpenAPI spec via openapi-typescript
  • Flexible Auth — middleware accepts the API key in any of four header formats
  • CORS Enabled — preflight + custom API key headers allowed

Quick Start

You'll need a Canopy API key from canopyapi.co.

npm install
npm run dev      # xmcp watcher + wrangler dev (local Workers runtime)
npm run deploy   # build + wrangler deploy --env production

Testing

Use the MCP Inspector and connect to http://localhost:8787/mcp (or your deployed URL). Provide the API key as a request header:

npx -y @modelcontextprotocol/inspector@latest

Or with curl:

curl -X POST http://localhost:8787/mcp \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -H "CANOPY-API-KEY: $CANOPY_API_KEY" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}'

Authentication

The server requires a Canopy API key on every request. Any of these header forms works (checked in this order):

  • CANOPY-API-KEY: your-api-key
  • API-KEY: your-api-key
  • X-API-KEY: your-api-key
  • Authorization: Bearer your-api-key

A missing key returns HTTP 401 with a JSON-RPC error before the request reaches the MCP transport (see src/middleware.ts).

Available Tools

Product Information

  • get_amazon_product — product details by ASIN, URL, or GTIN
  • get_amazon_product_variants — product variants
  • get_amazon_product_stock — stock level estimates
  • get_amazon_product_sales — sales estimates (weekly, monthly, annual)
  • get_amazon_product_reviews — top product reviews

Search & Discovery

  • search_amazon_products — search with filters and sorting
  • get_amazon_autocomplete — search term suggestions
  • get_amazon_deals — current deals

Categories

  • get_amazon_categories — root category taxonomy
  • get_amazon_category — category details with products and subcategories

Entities

  • get_amazon_seller — seller information and product listings
  • get_amazon_author — author information and book listings

Project Structure

canopy-api-mcp/
├── src/
│   ├── tools/                  # one file per tool (auto-discovered by xmcp)
│   │   ├── get-amazon-product.ts
│   │   └── ...
│   ├── lib/
│   │   └── api-key.ts          # reads API key from extra.authInfo
│   ├── middleware.ts           # auth middleware (lifts header → authInfo.token)
│   ├── api-client.ts           # type-safe Canopy REST client
│   └── types/
│       └── api.d.ts            # generated from OpenAPI
├── xmcp.config.ts              # xmcp config (endpoint, CORS, paths)
├── wrangler.jsonc              # Cloudflare Workers config
├── tsconfig.json
└── package.json

Type Safety

src/types/api.d.ts is generated from the Canopy OpenAPI spec. Regenerate when the API changes:

npm run generate

Scripts

  • npm run dev — xmcp watcher + wrangler dev (local Workers runtime)
  • npm run buildxmcp build --cf (emits worker.js for Cloudflare)
  • npm run deploy — build + wrangler deploy --env production
  • npm run delete — remove the deployed Worker
  • npm run generate — regenerate API types from the OpenAPI spec

Migration from v1.x

v2.0 replaces ModelFetch with xmcp. The MCP endpoint moved from /sse/mcp (deprecated SSE transport mount) to /mcp (current Streamable HTTP convention). Update any clients accordingly.

Related

Reviews

No reviews yet

Be the first to review this server!