How to connect Claude or ChatGPT to Amazon Seller Central with an SP-API MCP server

Connecting an AI assistant to an Amazon seller account now takes minutes. Making that connection safe to leave running takes engineering: the right SP-API roles, pacing against Amazon's rate limits, buyer data kept out of the chat, and a person approving anything that changes prices, stock or listings. This guide covers each part, with a table of which SP-API operations to expose, which to gate behind an approval, and which to keep away from the model, including their roles and default rate limits.

What is an SP-API MCP server?

The Model Context Protocol (MCP) is an open-source standard for connecting AI applications to outside systems. An MCP server publishes tools, each with a name, a description and an input schema. An MCP client such as Claude, ChatGPT or Cursor lets the model call those tools and reads back the results. Anthropic donated MCP to the Agentic AI Foundation, a directed fund under the Linux Foundation, on December 9, 2025.

An SP-API MCP server is an MCP server whose tools wrap operations of Amazon's Selling Partner API. A "check FBA stock" tool calls getInventorySummaries; an "update price" tool calls patchListingsItem. The server sits between the model and Amazon: it stores the seller's authorization, requests access tokens, paces calls and decides which operations the model may reach at all. The current specification is version 2026-07-28, which made MCP a stateless request and response protocol with no protocol-level session (checked September 25, 2026). Anything that must survive between calls, such as a pending price change, needs its own ID that the server stores.

Advertising is a separate API. Campaigns, bids and budgets live in the Amazon Ads API, not in SP-API, and Amazon Ads runs its own MCP server for that side. A server that answers "which SKUs are close to a stockout while we keep bidding on them" needs both connections, both sets of credentials and both sets of limits.

Which options exist today: Amazon's own tools, hosted MCP, open source or custom?

There are now six ways to put Seller Central data in front of a model. They differ in three ways that matter: who runs the server, whether it can change data, and whose rules decide what it may do. Facts below come from each provider's own pages, checked September 25, 2026.

Amazon announced the Selling Partner plugin on September 23, 2026, in beta for sellers in its US stores, with international expansion to follow; sellers review and approve actions before they run. The Claude plugin files Amazon published in its selling-partner-agentic-toolkit repository register the Amazon Selling Partner Connector at sellingpartner-ai.amazon.com/mcp. You authorize it through Seller Central OAuth consent, it can use only the tools your Seller Central roles allow, and writes are drafted for your approval (both checked September 25, 2026). Amazon decides which tools it offers and documents no other channels. Our plugin explainer covers what it reads and changes.

Amazon's Local MCP for SP-API, posted May 28, 2026 by its Selling Partner Developer Services team, is an npm package with two servers: a developer assistant (documentation search, code samples, an Orders v0 to v2026-01-01 migration helper) and a workflow builder. Most tools run without credentials; live calls need yours. It sits in Amazon's samples repository, whose README calls the samples "educational examples", not supported products, to be tested and secured before production. The Amazon Ads MCP Server has been in open beta since February 2, 2026, globally, for Amazon Ads partners with active API credentials (checked September 25, 2026).

Hosted services differ in how they treat writes. Agent Central says all writes preview before submission and it logs every change with before and after values, with plans from $39 a month for up to 1,000 orders a month. AnythingMCP says its v1 is "read-focused for safety" and leaves buyer PII out by design (both checked September 25, 2026). If you sell only on Amazon and your questions fit their tools, one of these, or Amazon's own plugin, is faster and cheaper than a build. Our comparison of agent platforms and custom agents goes further.

How does authorization work?

There are two hops, each with its own credentials. Between the AI client and your server, the MCP authorization spec applies: a remote server over HTTP that requires authorization acts as an OAuth 2.1 resource server and must check that each token was issued for it, while a local server over stdio should read credentials from its environment instead. The spec's security best practices rule out "token passthrough": a server must not accept tokens that were not issued for it. Never let an AI client hand your server a seller's Amazon token to forward.

Between your server and Amazon, SP-API uses Login with Amazon. The server exchanges a stored refresh token for an access token that lasts 3,600 seconds, and must send a user-agent header with at least the app's name, version and language on every request (Amazon's connection guide, checked September 25, 2026). Client secrets must be rotated every 180 days, or the app gets errors when it calls SP-API. Amazon sends a notice 90 days before the deadline; route it to your alerting, not to one person's inbox.

For one brand, a private application is usually right: the brand's Primary User self-authorizes it, and Amazon limits private applications to a single organization, so the server serves only that brand's accounts, up to the 10 self-authorizations Amazon allows. An agency or software vendor connecting other companies' accounts needs a public app, which each seller must reauthorize every 365 days. Registration steps are in how to register for Amazon SP-API. Request only the roles your tools need: each one widens what a confused model or a leaked token can reach.

How do you handle rate limits and restricted data?

SP-API usage plans are token buckets. Each operation has a rate (tokens added per second) and a burst (the bucket's size), most limits apply per selling partner and application pair, and an empty bucket returns HTTP 429, which is retryable with back-off. A chat model knows none of this. Ask it for "every order this quarter" and it will page through searchOrders, whose default is 0.0056 requests per second with a burst of 20: twenty quick calls, then about 20 an hour.

Sustained calls per hour = rate per second × 3,600 (after the burst is spent)

The MCP tools specification says servers must rate limit tool invocations. In practice that means a cache of recent reads, a queue that paces each operation against its own bucket, and tool results that tell the model when data is cached or queued, instead of a raw 429 it will retry. When Amazon returns the x-amzn-RateLimit-Limit header, pace against that value rather than the published default, because some usage plans are adjusted per seller. Route big questions to reports: createReport allows about 60 requests an hour and runs asynchronously, so the tool should return a job ID the model can check later.

Buyer names, addresses, emails and phone numbers are PII. In Orders API v0, restricted operations need a Restricted Data Token, and Amazon's reference example shows one lasting 3,600 seconds. The Orders API v2026-01-01 drops the RDT: buyer and recipient fields come back only when you request them with includedData=BUYER or RECIPIENT and hold a role that allows them, such as Direct-to-Consumer Shipping (Restricted). Orders v0 calls such as getOrders are scheduled for removal on March 27, 2027, so build new order tools on v2026-01-01.

The rule for MCP is simple: PII never enters the model's context. Leave BUYER and RECIPIENT out of every order tool, never expose the token call as a tool, and when a workflow needs an address, pass an order ID to a server-side step that reads it there. Whatever a tool returns can end up in the AI client's conversation history.

Which write actions are safe to expose, and how do you gate them?

An MCP server can expose any operation the API offers. The useful question is which calls a model may make alone, which need a person, and which should never be tools. This is how we sort them. Rates are Amazon's published defaults, checked September 25, 2026; your account's plan can be higher, and roles come from Amazon's role mappings.

Expose as tools: reads, paced and logged

Expose only behind an approval step

Never expose to the model

The MCP tools spec says there should always be a human in the loop with the ability to deny tool invocations, and that clients must treat tool annotations as untrusted unless they come from trusted servers. So do not rely on a client's confirm button to protect a seller account. Put the gate in the server: a write tool returns a proposal (Amazon's validation preview, before and after values, limit checks) plus an ID, and a separate approval step, in your app or Slack, executes it.

Two details keep that approval honest. The MCP security best practices say possession of such an ID must never count as authentication, so tie each proposal to the user who created it and check the approver's rights before the call runs. Attach an idempotency key so a retried call cannot apply the same change twice, and log who approved the change, when, and what Amazon returned.

Price tools are where limits matter most. The repricer we built is rule-based automation, not an agent: it reprices against the Buy Box or the lowest price within rules the seller sets, such as staying above a set price. An MCP price tool needs the same floor and ceiling in the server, so a suggestion outside them is refused before anyone is asked to approve it.

How do you stay within Amazon's Agent Policy and Data Protection Policy?

Amazon announced on February 17, 2026 a Business Solutions Agreement update with a new Agent Policy, effective March 4, 2026. AI agents must identify themselves as automated systems, follow the Agent Policy at all times and stop accessing Amazon's services if Amazon asks. The same update restricts using Amazon materials or services for AI development. Our reading for an MCP server: a named app and user-agent on every call, a stop switch that disables write tools and revokes the refresh token at once, a log of every tool call, and no model training on SP-API data. Our Agent Policy guide covers the policy in full; this is not legal advice, and the text in Seller Central governs.

Amazon's security control guidance for its Data Protection Policy (updated September 2026) sets hard numbers. Delete PII within 30 days after order delivery, unless the law requires you to keep it longer. Encrypt PII with AES-128 or RSA-2048 keys or stronger, and use TLS 1.2 or higher in transit. Encrypt SP-API keys and credentials and never expose them in plain text. Keep security logs for at least 12 months where PII is stored or processed. Notify security@amazon.com within 24 hours of detecting a security incident. MCP adds one more place data can leak, the chat transcript, which is the practical reason to keep PII out of tool results.

Build, host or buy?

A custom server is a small SP-API project with an AI front end, so the usual cost drivers apply; our SP-API development cost guide breaks them down, and hiring an SP-API developer covers what to look for if you staff it yourself. If your team is prototyping with an AI coding assistant, read what breaks when you build Amazon seller tools with AI before you ship. Once the server exists, AI agents can run routine work on top of it within the rules you approve.

Ecomsellertool has built on Amazon's seller APIs since 2017 and shipped 50+ tools. Through our SP-API development work, we build MCP servers on the brand's own SP-API application and cloud, scope the tools and approval gates with the team, and connect Walmart, Shopify and 3PL data through Growth OS. You keep your accounts, your data and the custom code we build; the Growth OS base is licensed to you.

To see what a connected assistant would flag first, start with the free 24-hour diagnostic: connect Amazon with Login with Amazon, no password shared, and get the report within 24 hours of connecting, on business days. We only read data; we never change listings, prices, stock or ads. To scope a server, schedule a call.