Mercado Libre MCP Server

Complete MCP server for Mercado Libre seller operations — products, orders, pricing, stock, questions, ads, reputation, competitor analysis

Security Scan

The skill's code and metadata are coherent with a Mercado Libre MCP server, but it contains a credential-leak risk (logs a substring of refreshed tokens to stderr), and there are small metadata/instruction mismatches you should review before installing.

Purpose & Capability

Name, description, tools, required binaries (node) and npm dependencies (@modelcontextprotocol/sdk, zod) align with a MCP server for Mercado Libre. The requested env vars (ML_CLIENT_ID, ML_CLIENT_SECRET, ML_REFRESH_TOKEN) are expected for OAuth auto-refresh mode.

Instruction Scope

SKILL.md and README instruct only to set ML credentials and run the server; runtime instructions call only Mercado Libre APIs. However, auth.ts logs a portion of any newly returned refresh_token to stderr and writes the new refresh_token into process.env — these actions broaden what runtime output may contain and can leak secrets into logs.

Install Mechanism

There is no external download/install-from-URL; this is an instruction/code-only package with dependencies declared in package.json. Dependencies come from npm (typical). No suspicious install URLs or archive extraction were found.

Credentials

Requested env vars (ML_CLIENT_ID, ML_CLIENT_SECRET, ML_REFRESH_TOKEN) are appropriate for auto-refresh, but SKILL.md also documents an alternative ML_ACCESS_TOKEN mode that is not declared as an optional required env in the registry metadata. More importantly, the code prints the new refresh token (first 20 chars) to stderr when ML returns an updated refresh_token, which can leak sensitive credentials into logs/monitoring systems.

Persistence & Privilege

always: false and normal autonomous invocation are set. The skill registers tools and runs as a stdio MCP server; it does not modify other skills or system-wide configuration. Updating process.env at runtime is local to the process and not itself a persistence escalation, but combined with stderr logging it poses an information-leak risk.

What to consider before installing

This package appears to implement the Mercado Libre MCP features it claims, but take precautions before installing or running it with real credentials: - The code will perform OAuth refreshes and, if Mercado Libre returns a new refresh_token, the server will set process.env.ML_REFRESH_TOKEN and print the first ~20 characters of the new refresh token to stderr. That log can expose part of your credential to logs/monitoring systems. Consider removing or redacting that console.error line before running, or ensure logs are not stored in an untrusted place. - If you don't need auto-refresh, prefer supplying ML_ACCESS_TOKEN (short-lived) managed by your own scheduler (n8n/cron) instead of giving client_secret + refresh_token to this process. - Run the server in an isolated environment/container, not on a host with other sensitive workloads or shared logging, and rotate credentials after first use if you test it. - Review dependencies (npm modules) and run npm audit / vet the @modelcontextprotocol/sdk package versions you will install. - Check that the ML_CLIENT_ID/ML_CLIENT_SECRET you provide have minimal scopes required for the operations you need. If you want, I can point to the exact lines to change (remove/redact the refresh token log) and show a small patch to avoid printing tokens to stderr.

The first complete MCP server for Mercado Libre. 11 tools for seller operations — manage products, orders, pricing, stock, customer questions, advertising, reputation, and competitor intelligence.

Setup

Two authentication modes:

Option A: Direct token (recommended if you have n8n/cron managing refresh)

ML_ACCESS_TOKEN=APP_USR-...
ML_SITE_ID=MLA

Option B: Auto-refresh (standalone, no external dependencies)

1. Create an app at developers.mercadolibre.com
2. Authorize via OAuth to get your refresh token
3. Set environment variables:

ML_CLIENT_ID=your_client_id
ML_CLIENT_SECRET=your_client_secret
ML_REFRESH_TOKEN=your_refresh_token
ML_SITE_ID=MLA

Tools

Read operations

• list_products — List all products/listings for a seller with price, stock, status, and thumbnails
• get_orders — Get orders/sales with buyer info, items, shipping, and payment details
• list_questions — List questions received on listings, filterable by status (unanswered/answered)
• get_item_metrics — Get visits, health score, conversion rate, and catalog status for a listing
• get_reputation — Get seller reputation: level, completed sales, claims, cancellations, handling time
• search_competitors — Search competitor products by keyword with price, seller, sales volume
• get_categories — Browse ML categories and required attributes for publishing

Write operations

• update_price — Update listing price (returns before/after for confirmation)
• update_stock — Update available quantity (returns before/after for confirmation)
• answer_question — Answer a buyer question (public, visible to all buyers)
• manage_ads — Activate, pause, or check status of Product Ads

Supported countries

Works with all Mercado Libre sites: MLA (Argentina), MLU (Uruguay), MLB (Brazil), MLC (Chile), MLM (Mexico), MCO (Colombia), and more.

Features

• OAuth2 auto-refresh — Token renews automatically every 6 hours
• Rate limiting — Automatic retry with backoff when hitting API limits
• Multi-get batching — Fetches multiple items in batches of 20
• Zod validation — All inputs validated before calling the API
• Clear error messages — Human-readable errors in Spanish, not raw JSON

Example prompts

• "List my active products"
• "Show me today's orders"
• "Update the price of MLA123456 to $5000"
• "What unanswered questions do I have?"
• "Search competitors for brake pads Toyota"
• "What category should I use for motorcycle parts?"
• "Activate ads on MLA123456 with $500/day budget"
• "How is my seller reputation?"

License

MIT — by TRAID