Mercado Libre MCP Server

Complete MCP server for Mercado Libre seller operations — products, orders, pricing, stock, questions, ads, reputation, competitor analysis

This package appears to implement the Mercado Libre MCP features it claims, but take precautions before installing or running it with real credentials: - The code will perform OAuth refreshes and, if Mercado Libre returns a new refresh_token, the server will set process.env.ML_REFRESH_TOKEN and print the first ~20 characters of the new refresh token to stderr. That log can expose part of your credential to logs/monitoring systems. Consider removing or redacting that console.error line before running, or ensure logs are not stored in an untrusted place. - If you don't need auto-refresh, prefer supplying ML_ACCESS_TOKEN (short-lived) managed by your own scheduler (n8n/cron) instead of giving client_secret + refresh_token to this process. - Run the server in an isolated environment/container, not on a host with other sensitive workloads or shared logging, and rotate credentials after first use if you test it. - Review dependencies (npm modules) and run npm audit / vet the @modelcontextprotocol/sdk package versions you will install. - Check that the ML_CLIENT_ID/ML_CLIENT_SECRET you provide have minimal scopes required for the operations you need. If you want, I can point to the exact lines to change (remove/redact the refresh token log) and show a small patch to avoid printing tokens to stderr.

Package: (mcp) Version: Description: Complete MCP server for Mercado Libre seller operations — 11 tools for products, orders, pricing, stock, questions, ads, reputation, and competitor analysis The package is a legitimate Model Context Protocol (MCP) server for interacting with the Mercado Libre API. It provides tools for managing products, orders, pricing, stock, and customer questions. The code uses standard OAuth2 authentication to communicate with the official Mercado Libre endpoints and does not contain any malicious logic, unauthorized data exfiltration, or unexpected binary execution.