Canopy API MCP server

Canopy API MCP Server

A type-safe MCP (Model Context Protocol) server that provides Amazon product data through the Canopy API. Built with xmcp and deployed on Cloudflare Workers.

Features

• 17 Amazon Data Tools — product info, variants, offers, stock, sales, reviews, search, autocomplete, categories, best sellers, sellers, authors, deals, and ASIN/GTIN lookup
• Streamable HTTP transport at /mcp (current MCP spec)
• File-based tools — one file per tool under src/tools/
• Type Safety — TypeScript types generated from the Canopy OpenAPI spec via openapi-typescript
• Flexible Auth — OAuth 2.1 sign-in (Supabase authorization server, dynamic client registration) or an API key in any of four header formats
• CORS Enabled — preflight + custom API key headers allowed

Quick Start

You'll need a Canopy API key from canopyapi.co.

npm install
npm run dev      # xmcp watcher + wrangler dev (local Workers runtime)
npm run deploy   # build + wrangler deploy --env production

Testing

Use the MCP Inspector and connect to http://localhost:8787/mcp (or your deployed URL). Provide the API key as a request header:

npx -y @modelcontextprotocol/inspector@latest

Or with curl:

curl -X POST http://localhost:8787/mcp \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -H "CANOPY-API-KEY: $CANOPY_API_KEY" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}'

Authentication

Every request must carry credentials. Two modes are supported:

1. OAuth 2.1 (recommended for MCP clients). OAuth-capable clients discover the flow automatically: an unauthenticated request returns 401 with WWW-Authenticate: Bearer resource_metadata="https://mcp.canopyapi.co/.well-known/oauth-protected-resource". Supabase is the authorization server (dynamic client registration supported); consent lives at canopyapi.co. The verified user's Canopy API key is resolved server-side.

2. API key headers. Any of these forms works (checked in this order):

• CANOPY-API-KEY: your-api-key
• API-KEY: your-api-key
• X-API-KEY: your-api-key
• Authorization: Bearer your-api-key

A missing or invalid credential returns HTTP 401 with a JSON-RPC error before the request reaches the MCP transport (see src/middleware.ts).

Available Tools

All 17 tools are read-only (readOnlyHint: true) and annotated with a title.

Product Information

• getamazonproduct — product details by ASIN, URL, or GTIN
• getamazonproduct_variants — product variants
• getamazonproduct_offers — seller offers and Buy Box info
• getamazonproduct_stock — stock level estimates
• getamazonproduct_sales — sales estimates (weekly, monthly, annual)
• getamazonproducttopreviews — top customer reviews (title, body, rating, helpful votes, images/videos)

Search & Discovery

• searchamazonproducts — search with filters and sorting
• getamazonautocomplete — search term suggestions
• getamazondeals — current deals
• getamazonbestsellers — best-selling products for a category
• getamazonbestseller_categories — best seller category list

Categories

• getamazoncategories — root category taxonomy
• getamazoncategory — category details with products and subcategories

Entities

• getamazonseller — seller information and product listings
• getamazonauthor — author information and book listings

Identifiers

• getamazonasinfromgtin — ASIN lookup by ISBN/UPC/EAN
• getamazongtinfromasin — GTIN lookup by ASIN

Project Structure

Shortened. The full README is on GitHub.