ShipStation MCP server for your AI

You paste two values, API Key and API Secret, which ShipStation shows together on one screen under Settings → Account → API Settings. There is no OAuth popup, no redirect URL and no token refresh to keep alive. PopMCP authenticates server-side over HTTPS using HTTP Basic, and the key pair is scoped to a single ShipStation account, so the MCP server is locked to that account.

Yes. shipstation_create_label_for_order buys a real label against an existing order and marks that order shipped, and shipstation_create_shipment_label buys one with no order behind it when you supply shipFrom and shipTo directly. Both spend against the connected carrier account, which is a good reason to require approval for writes on this connection. A purchased label can be voided with shipstation_void_label using its shipmentId.

shipstation_mark_order_shipped records the order as shipped without buying a ShipStation label, for parcels that went out some other way. shipstation_create_label_for_order does both at once: it buys the label and flips the order to shipped. One costs money and one does not, so it is worth telling your agent which of the two you expect it to use before you enable write access.

shipstation_get_rates quotes one carrier at a time, so comparing two carriers means two calls. It also needs a serviceCode from shipstation_list_carrier_services and a Ship From Location, which shipstation_list_warehouses returns with its warehouseId, originAddress, returnAddress and isDefault flag — the API still uses the older name warehouses for what the UI calls Ship From Locations. shipstation_list_carriers shows which carriers are connected, their account balance, and whether a carrier needs a funded account.

Yes. shipstation_list_stores returns every connected store with its storeId and marketplace, whether that is Shopify, Amazon, WooCommerce or a manual store, and shipstation_list_marketplaces reports what each channel supports through flags like canRefresh and canConfirmShipments. When the last sync is too old to answer a question, shipstation_refresh_store pulls new orders from the channel immediately and shipstation_get_store_refresh_status says whether that import is still running.

The server covers V1 with 48 operations across 11 API modules, 22 read and 26 write, plus 17 events PopMCP can watch. 31 of those operations load into your AI client by default and the rest stay searchable, so a long tool list does not crowd the context window. Orders is the largest module at 14 operations, followed by Stores at 8.

No. PopMCP hosts it and gives you a Streamable HTTP MCP URL. There is nothing to deploy, no callback URL to register, and no infrastructure to keep running or patch.

Any client that supports a remote Streamable HTTP MCP server — Claude Desktop, Claude Web, ChatGPT custom connectors, Codex and the Codex CLI, OpenCode and Z.ai's ZCode, as well as editors such as Cursor, Windsurf and Zed. Your client signs in to PopMCP with OAuth; the provider credential never leaves the server.

Loading 48 tool definitions into every conversation burns context before the work starts. PopMCP loads a curated 31-tool set covering the everyday workflows and keeps the rest searchable, so your AI pulls a specialist tool only when a task needs it. You can switch a connection to the full catalog at any time.

A tool is something your AI calls — there are 48 here. A trigger is something PopMCP watches for you: 17 ShipStation events that can start work on the PopMCP side. Triggers never enter your AI client's context, and none of them ask you to paste a callback URL into ShipStation.