Canopy API

Canopy MCP Server — Amazon Product Data API for AI Agents

An Amazon product data API served over the Model Context Protocol. Connect Claude, ChatGPT, Cursor, or any MCP client to real-time Amazon data — an Amazon search API, reviews API, price tracker, ASIN lookup, best sellers, deals, and sales estimates — powered by the Canopy API. No headless browsers, no brittle HTML scraping: typed JSON over standard MCP tools.

Built with xmcp and deployed on Cloudflare Workers. Use the hosted remote MCP server at https://mcp.canopyapi.co/mcp or self-host from this repo. Setup guides and client walkthroughs live on the Amazon MCP server page.

Why an Amazon MCP server?

AI agents and LLM apps increasingly need live e-commerce data. This server gives any MCP-capable assistant or agent framework direct tool access to Amazon:

• Shopping assistants — an Amazon search API for agents: query products, compare prices and Buy Box offers, surface deals and coupons in chat
• Price monitoring & competitive intelligence — an Amazon price tracker API for prices, stock estimates, and seller offers on any ASIN
• Product research & market analysis — an Amazon product research tool with best seller rankings, sales estimates, and category taxonomies
• Catalog enrichment — ASIN lookup and ASIN ↔ GTIN/UPC/ISBN/EAN conversion, plus images, variants, and specs
• Review analysis — an Amazon reviews API returning top customer reviews with ratings, helpful votes, and media for summarization

Works as a Claude MCP server (Desktop, Code, and the claude.ai connectors directory), a ChatGPT MCP connector (Apps SDK, with rich product widgets), in Cursor and the MCP Inspector, and with any agent built on the MCP SDK, LangChain, or the OpenAI Agents SDK.

Features

• 17 Amazon Data Tools — product info, variants, offers, stock, sales, reviews, search, autocomplete, categories, best sellers, sellers, authors, deals, and ASIN/GTIN lookup
• Streamable HTTP transport at /mcp (current MCP spec)
• File-based tools — one file per tool under src/tools/
• Type Safety — TypeScript types generated from the Canopy OpenAPI spec via openapi-typescript
• Flexible Auth — OAuth 2.1 sign-in (Supabase authorization server, dynamic client registration) or an API key in any of four header formats
• CORS Enabled — preflight + custom API key headers allowed

Quick Start

Use the hosted server (no install)

Add the remote MCP server to your client and sign in with OAuth, or supply a Canopy API key:

https://mcp.canopyapi.co/mcp

Claude and other OAuth-capable MCP clients will walk you through sign-in automatically. Get an API key at canopyapi.co, and see the Amazon MCP server guide for per-client setup instructions.

Install as an Agent Plugin

This repository is an Agent Plugin (specification 1.0.0). The plugin root is the repository root. A compatible client reads plugin.json, loads skills from skills/, and connects to the MCP server declared in mcp.json.

canopy-api-mcp/
├── plugin.json          # Agent Plugins 1.0.0 manifest
├── mcp.json             # hosted Streamable HTTP server
└── skills/
    └── amazon-product-research/
        ├── SKILL.md
        └── references/tools.md

mcp.json points at the same hosted endpoint as above:

{
  "mcpServers": {
    "canopy": {
      "type": "streamable-http",
      "url": "https://mcp.canopyapi.co/mcp"
    }
  }
}

Authorization stays in the client. OAuth-capable clients discover sign-in from the server. The plugin does not embed an API key: Agent Plugins treats headers as public package data, not a place for secrets. If a client only supports a static header, set CANOPY-API-KEY in that client.

Cursor. After the plugin is listed, install it from Customize or the Cursor Marketplace. To try the directory before it is listed, copy this repository to ~/.cursor/plugins/local/canopy-api-mcp (a symlink that points outside that folder is ignored), reload the window, and confirm the Canopy server and the amazon-product-research skill in Customize.

Other Agent Plugins clients. Load this directory. The client needs Agent Plugins 1.0.0 and the streamable-http transport. There is no archive and no registry protocol in the specification: the package is this directory.

server.json is unchanged. It is the MCP Registry server card, a separate format from plugin.json. npm install, npm run dev, and npm run deploy are unchanged.

Validate the package against the published schemas:

npm run validate:plugin

Run it yourself

You'll need a Canopy API key from canopyapi.co.

npm install
npm run dev      # xmcp watcher + wrangler dev (local Workers runtime)
npm run deploy   # build + wrangler deploy --env production

Testing

Run npm test to build the worker and run the regression suite. Output-schema tests use mocked REST responses to verify that null-valued fields (unavailable prices, coupons, ratings) are stripped before reaching MCP clients, that responses match the advertised JSON Schema, and that malformed values are still rejected. These tests do not require a real Canopy API key.

Use the MCP Inspector and connect to http://localhost:8787/mcp (or your deployed URL). Provide the API key as a request header:

npx -y @modelcontextprotocol/inspector@latest

Or with curl:

curl -X POST http://localhost:8787/mcp \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -H "CANOPY-API-KEY: $CANOPY_API_KEY" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}'

Authentication

Every request must carry credentials. Two modes are supported:

1. OAuth 2.1 (recommended for MCP clients). OAuth-capable clients discover the flow automatically: an unauthenticated request returns 401 with WWW-Authenticate: Bearer resource_metadata="https://mcp.canopyapi.co/.well-known/oauth-protected-resource". Supabase is the authorization server (dynamic client registration supported); consent lives at canopyapi.co. The verified user's Canopy API key is resolved server-side.

2. API key headers. Any of these forms works (checked in this order):

• CANOPY-API-KEY: your-api-key
• API-KEY: your-api-key
• X-API-KEY: your-api-key
• Authorization: Bearer your-api-key

A missing or invalid credential returns HTTP 401 with a JSON-RPC error before the request reaches the MCP transport (see src/middleware.ts).

Available Tools

All 17 tools are read-only (readOnlyHint: true) and annotated with a title.

Product Information

• get_amazon_product — product details by ASIN, URL, or GTIN
• get_amazon_product_variants — product variants
• get_amazon_product_offers — seller offers and Buy Box info
• get_amazon_product_stock — stock level estimates
• get_amazon_product_sales — sales estimates (weekly, monthly, annual)
• get_amazon_product_top_reviews — top customer reviews (title, body, rating, helpful votes, images/videos)

Search & Discovery

• search_amazon_products — search with filters and sorting
• get_amazon_autocomplete — search term suggestions
• get_amazon_deals — current deals, optionally filtered by category
• get_amazon_bestsellers — best-selling products for a category
• get_amazon_bestseller_categories — best seller category list

Categories

• get_amazon_categories — root category taxonomy
• get_amazon_category — category details with products and subcategories

Entities

• get_amazon_seller — seller information and product listings
• get_amazon_author — author information and book listings

Identifiers

• get_amazon_asin_from_gtin — ASIN lookup by ISBN/UPC/EAN
• get_amazon_gtin_from_asin — GTIN lookup by ASIN

Project Structure

canopy-api-mcp/
├── plugin.json                 # Agent Plugins 1.0.0 manifest
├── mcp.json                    # MCP server declaration (Streamable HTTP)
├── skills/
│   └── amazon-product-research/
│       ├── SKILL.md
│       └── references/tools.md
├── server.json                 # MCP Registry server card (separate from plugin.json)
├── LICENSE                     # MIT License
├── src/
│   ├── tools/                  # one file per tool (auto-discovered by xmcp)
│   │   ├── get-amazon-product.ts
│   │   └── ...
│   ├── lib/
│   │   └── api-key.ts          # reads API key from extra.authInfo
│   ├── middleware.ts           # auth middleware (lifts header → authInfo.token)
│   ├── api-client.ts           # type-safe Canopy REST client
│   └── types/
│       └── api.d.ts            # generated from OpenAPI
├── xmcp.config.ts              # xmcp config (endpoint, CORS, paths)
├── wrangler.jsonc              # Cloudflare Workers config
├── worker-entry.ts             # Workers entry (unchanged)
├── tsconfig.json
└── package.json

Type Safety

src/types/api.d.ts is generated from the Canopy OpenAPI spec. Regenerate when the API changes:

npm run generate

Scripts

• npm run dev — xmcp watcher + wrangler dev (local Workers runtime)
• npm run build — xmcp build --cf (emits worker.js for Cloudflare)
• npm run deploy — build + wrangler deploy --env production
• npm run delete — remove the deployed Worker
• npm run generate — regenerate API types from the OpenAPI spec
• npm run validate:plugin — check plugin.json, mcp.json, and skills/ against Agent Plugins 1.0.0

Migration from v1.x

v2.0 replaces ModelFetch with xmcp. The MCP endpoint moved from /sse/mcp (deprecated SSE transport mount) to /mcp (current Streamable HTTP convention). Update any clients accordingly.

License

This project is released under the MIT License. Copyright (c) 2026 Canopy API.

Related

• Model Context Protocol
• xmcp framework
• Amazon MCP Server — Canopy
• Canopy API
• Cloudflare Workers