Skip to main content
Glama
EastMG

shopping-mcp

by EastMG

shopping-mcp

一个 MCP server,把淘宝 / 京东 / 拼多多的商品搜索、详情、转链(含优惠券)收成同一套工具,直接接进 DSH。

只调官方开放平台接口。 没有第三方代理、没有远程配置下发、没有凭证转发。

淘宝   淘宝联盟 / 淘宝客  →  https://eco.taobao.com/router/rest
京东   京东联盟            →  https://api.jd.com/routerjson
拼多多 多多进宝            →  https://gw-api.pinduoduo.com/api/router

为什么不用现成的 taoke-mcp

调研过 liuliang520530/taoke-mcp(125 星,功能对口),放弃的原因写在 docs/why-not-taoke-mcp.md。一句话:它的授权走作者的 OAuth 应用,启动时还会从 config.sinataoke.cn 拉配置。本项目把这两条都换成了「你自己的 appkey + 本地 .env」。

Related MCP server: Kettu Marketplace Intelligence

快速开始

# 1. 装依赖
uv sync

# 2. 先看状态(此时三家都是 mock 模式,没有任何凭证也能跑)
uv run shopping-mcp

shopping-mcp 是 stdio 传输的 MCP server,正常用法是被 DSH 拉起来,而不是手动运行。

挂进 DSH

推荐做法:用 DSH 自带的 MCP 管理界面。

如果你装了 dsh-mcp-manager-plus(设置里的「MCP 管理」页),这是最干净的一条路:写入由 DSH 主进程完成,本来就有 profile 目录的写权限;profile 是 patchReload: live,所以约 1 秒热生效,不需要重启,而且是持久化的。

  1. 设置 → MCP 管理 → 添加

  2. 粘贴下面这段(格式自动识别):

{
  "mcpServers": {
    "shopping": {
      "command": "F:/DeepSeek/DeepSeek-Workplace/DSH-Workplace-01/shopping-mcp/.venv/Scripts/python.exe",
      "args": ["-m", "shopping_mcp.server"]
    }
  }
}
  1. 保存后展开 shopping 那一行,应能看到 5 个工具:shopping_status / search_products / get_product / convert_link

凭证不要写在这里——server 自己读项目根目录的 .env。管理器的掩码机制(KEY|SECRET|TOKEN 类值会打码)也说明这类配置本就是给它看的,密钥不该放进去。


以下三条是没有管理器时的备选,需要改文件或换启动参数。注意在 DSH 会话内(沙箱里)写 ~/.dsh 会被拒绝,所以要在这之外执行。

叠加层文件已经写好并做过结构校验:dsh/mcp-shopping.patch.yml。

最省事:双击 scripts/register-mcp.cmd —— 在普通 PowerShell 窗口执行(不要在 DSH 的终端里),会先备份再追加,写完校验 YAML。

或者在 PowerShell 里手动跑(等价):

cd F:\DeepSeek\DeepSeek-Workplace\DSH-Workplace-01\shopping-mcp
$env:UV_CACHE_DIR="$PWD\..\.uv-cache-probe"
uv run --with pyyaml python scripts\register_mcp.py

其它两种姿势:

A. 手动粘贴 — 把 dsh/mcp-shopping.patch.yml 里 - insert: 那一段追加到 C:\Users\<你>\.dsh\profiles\desktop\cordis.patch.yml 末尾,重启 DSH。

B. 临时挂载 — 不写任何配置,每次启动带参数:

dsh --profile desktop --patch "F:\DeepSeek\DeepSeek-Workplace\DSH-Workplace-01\shopping-mcp\dsh\mcp-shopping.patch.yml" web

凭证不写在这些配置里。server 启动时自己读项目根目录的 .env,所以配置文件里看不到密钥,也不会进 config dump。

启动后调用 shopping_status 应能看到 serverName: shopping 下的四个工具。

配置凭证

Copy-Item .env.example .env
# 然后编辑 .env,只填你拿到的那几家

未填的平台会自动降级成 mock 模式:工具照样能用,返回的是 mock.local 域名下的假数据,字段和真实数据完全一致。这样在等审核期间就能把链路和 prompt 调好。

随时调用 shopping_status 看当前哪家是 live、哪家是 mock、缺哪个变量。

填完先自检

拿到 appkey 后别急着让 agent 搜商品,先跑一次凭证自检——它真的发一次请求,很便宜:

uv run python scripts\probe_creds.py              # 验证所有已配置的平台
uv run python scripts\probe_creds.py --platform pdd

它会区分这几类失败(它们的报错长得不一样,脚本会把 code 和原始返回一起打出来):

现象

含义

签名错误

secret 填错,或首尾有多余空格/引号

应用凭证无效 / 应用未上线

key 复制错,或应用还在审核、没发布

权限不足 / 不支持的接口

最常见:多多进宝没绑定、淘宝客权限没批下来

PID / 推广位无效

PID 取错

授权 session 失效

OAuth token 过期,要重新授权

成功时会打印平台真实返回的字段名和我们的归一化结果并排对照,同时把完整原始返回写到 _probe_raw_<platform>.json。把这个输出贴给 agent,就能据此校准字段映射——现在的映射是照文档推的,只有对过真实返回才算数。

拼多多的完整申请流程见 docs/apply-pdd.md(含最容易漏的「多多进宝绑定」那一步)。

三家平台的申请门槛

拼多多多多进宝(门槛最低,建议先做这家)

  1. 注册 拼多多开放平台 应用 → 拿 client_id / client_secret

  2. 登录 多多进宝 → 推广管理 → 创建推广位 → 拿 PID

  3. 给应用申请 pdd.ddk.*(多多进宝)接口权限

个人可注册,需实名。

京东联盟

  1. 京东联盟 注册推广者 → 拿网站 ID(SITE_ID)和推广位 ID(POSITION_ID)

  2. 在京东开放平台创建应用 → 拿 app_key / app_secret → 申请 jd.union.open.* 权限

淘宝联盟(门槛最高)

  1. 阿里妈妈 注册淘宝客 → 实名认证 + 推广媒体备案

  2. 淘宝开放平台 创建应用 → 申请淘宝客 API 权限(审核通常 1-3 工作日)

  3. 通过 oauth.taobao.com 授权拿 session

  4. PID 形如 mm_<memberId>_<siteId>_<adzoneId>,site_id 与 adzone_id 由本程序自动从 PID 解析

三家具体权限目录以平台当期审核为准,本 README 不替代官方文档。

工具

工具

作用

shopping_status

三家凭证状态、当前模式、申请指引

search_products(platform, keyword, ...)

关键词搜索;支持 has_coupon、排序

get_product(platform, item_id)

按 id 查详情

convert_link(platform, item, sub_pid)

商品 id/链接 → 自己的推广链接

platform 取 taobao / jd / pdd。

统一后的商品字段:

{
  "platform": "pdd",
  "item_id": "1234567890",
  "title": "...",
  "price": 179.0,              // 券后价 / 到手价
  "original_price": 259.0,
  "coupon_amount": 80.0,
  "commission_rate": 5.5,      // 百分比
  "commission_amount": 9.85,   // 预估佣金
  "sales": 12000,
  "shop_name": "...",
  "item_url": "...",
  "promotion_url": "...",
  "image_url": "..."
}

单位归一化(踩过的坑)

平台

坑

本项目怎么处理

三大平台通用

commission_rate 历史上有过小数/百分比/万分比几种口径

_normalize_rate() 按量级判断,原始值保留在 raw

拼多多

所有金额单位是分

_cents() 统一除以 100

拼多多

promotion_rate 是千分比(100 = 10%)

_per_mille() 除以 10

京东

业务结果藏在 <method>_response.result 里,而且是 JSON 字符串

二次解析

淘宝

has_coupon 要传字符串 "true" 不是布尔

adapter 内转换

任何平台返回的原始 payload 都在 raw 字段(to_dict() 默认不输出,调试时可用)。归一化一旦有偏差,用 raw 对照官方文档核对——不要直接相信换算结果。

安全边界

  • 凭证只从本地 .env 或进程环境读取,不写进 DSH 配置,所以不会出现在配置 dump 或共享 patch 里

  • 不抓网页、不模拟登录、不碰支付环节

  • 只读性质:搜索、查详情、生成推广链接。没有下单、没有改价、没有动账户设置

  • .env 必须留在本机,不要提交到 git

当前状态

已验证

项

方式

结果

签名算法(三平台共用)

与手算 MD5 对齐

通过

单位归一化(分→元、千分比→百分比、汇率三口径)

单元断言

通过

淘宝 PID 解析 / 拼多多 sales_tip 解析 / goods_sign 判别

单元断言

通过

五个工具的 MCP 协议往返

内存传输握手 + tools/list + tools/call

43/43 通过

商品字段一致性(价格 = 原价 − 券)

断言

通过

has_coupon 确实只返回有券商品

断言

通过

非法 platform 不崩、返回 ok:false

断言

通过

DSH 叠加层结构与 YAML 合法性

结构校验

通过

smoke 的机器无关性

灌入假凭证后重跑

仍 43/43,不依赖本机 .env

拼多多真实接口全链路

真实 appkey + 已完成授权备案

✅ 通过

拼多多 live 实核(2026-10-18):

能力

结果

签名

✅ 真实网关接受(走到业务校验层,不再报签名错)

pdd.ddk.goods.search

✅ 返回真实商品:【原道】弦雪入耳DSP有线耳机 ¥49.99/¥60.99、券 ¥10、佣金率 3.0%、销量 4076

pdd.ddk.goods.detail

✅ 用 goods_sign 查到详情

pdd.ddk.goods.promotion.url.generate

✅ 生成真实推广链接 + 短链 https://p.pinduoduo.com/lL4kjhCQ?sc=EFAC

pdd.ddk.member.authority.query

✅ bind=1(授权备案已完成)

传数字 goods_id

✅ 按预期拒绝,并给出「改用 extra.goods_sign」的指引

跑法:uv run python scripts\smoke.py(43 项,全 mock,无需凭证)

未验证

  • 淘宝 / 京东从未调通 —— 还没申请这两家

  • DSH 里的 stdio 启动 未验证。会话内沙箱禁止创建子进程双向管道(WinError 5),所以协议层是用内存传输测的;真实 stdio 拉起要等你注册并重启 DSH 后确认

  • 拼多多 ddk.goods.search 对新应用有节流,同样关键词有时返回 0 条、有时 3 条。这不是 bug,重试即可

踩过的坑(已修,都是真实接口才暴露的)

坑

表现

修法

commission_rate 走 to_float()

该函数为金额舍入到 2 位,把 0.155 变成 0.15 → 报 15.0% 而非 15.5%

改用原始 float()

Windows 管道 stdout 默认 cp936

中文标题乱码 / UnicodeEncodeError

main() 里 reconfigure(encoding="utf-8")

拼多多响应 key 不总镜像方法名

member.authority.query 实际返回 authority_query_response,被误报 "unexpected response shape"

回退到唯一的 *_response key

pageSize 必须 10-100

传 2 报 50001 / 3000000

adapter 内 clamp

goods_id_list 已下线

转链报 40005,详情报 40004

改用 goods_sign(单数)/ goods_sign_list(转链)

pdd.ddk.rp.prom.url.generate 要 p_id_list

报「请求参数不能为空:p_id_list」

传数组

promotion_url 被误赋成图片地址

归一化结果里推广链接变成了商品图

置 None,只有转链后才有

sales 是字符串 "7万+"

直接 to_int 得到 None

新增 _parse_sales_tip()

拼多多搜索不返回店铺名

mall_name 恒为空字符串

如实返回 null,不用品牌名冒充

开发

uv sync                                              # 装依赖
uv run python scripts\smoke.py                       # 36 项检查,全部走 mock,不需要任何凭证
uv run --with pyyaml python scripts\check_patch.py    # 校验 DSH 叠加层结构
uv run python scripts\probe_creds.py                 # 用真实凭证验证字段映射

scripts/register_mcp.py 负责把服务注册进 DSH profile,幂等、自动备份、写后校验。 scripts/register-mcp.cmd 是它的双击入口。

smoke.py 是 hermetic 的:它会忽略真实 .env 并清掉环境里所有凭证变量,所以无论你机器上配没配 appkey,结果都一样。填了真凭证之后它也不会误报。

License

MIT © 2026 EastMG

本项目只调用各平台官方开放平台 API,不包含任何平台的数据或代码。使用前请自行确认符合各平台的开放平台协议与推广规则。

Available Tools

4 tools
get_productA

按商品 id 查详情。

淘宝传 num_iid,京东传 skuId,拼多多传 goods_sign(搜索结果 item.extra.goods_sign 那一长串 token —— 拼多多已停用数字 goods_id)。

Args: platform: taobao / jd / pdd item_id: 淘宝 num_iid / 京东 skuId / 拼多多 goods_sign

ParametersJSON Schema
NameRequiredDescriptionDefault
item_idYes
platformYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A3.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are supplied, so the description carries the full behavioral burden. It does disclose a genuinely useful behavioral quirk (PDD's numeric goods_id is discontinued, only goods_sign works), but says nothing about permissions, rate limits, or error behavior for a cross-platform fetch.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the core action, then a compact per-platform mapping, then a structured Args block. Every sentence carries information; the parenthetical about goods_sign is long but earns its place by preventing a deprecated-id mistake.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a two-parameter lookup tool with an output schema already covering return values, the description supplies everything needed to call it correctly. It omits only edge behavior (unknown id, platform/id mismatch, errors), a minor gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0% and the schema even lacks an enum for platform, yet the description fully compensates: it enumerates taobao/jd/pdd and maps item_id to num_iid, skuId, and goods_sign respectively, including where the goods_sign token comes from. This prevents the most likely invocation error.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('按商品 id 查详情' – fetch product details by product id), which clearly separates it from the search_products sibling. It does not explicitly name or contrast with any sibling, so it stops short of a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage context is implied rather than stated: the agent can infer this is the follow-up to search_products when it already has an id, but no when-to-use/when-not guidance or named alternative appears. The per-platform id routing hints at how to invoke, not when to choose this tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_productsA

按关键词搜索商品,返回统一字段(价格/券后价/券额/佣金率/销量/店铺/链接)。

Args: platform: taobao / jd / pdd keyword: 搜索关键词,中文即可 page: 页码,从 1 开始 page_size: 每页条数,1-50 has_coupon: 只要带优惠券的商品 sort: default / commission(佣金高)/ sales(销量)/ price_asc / price_desc / coupon_price

ParametersJSON Schema
NameRequiredDescriptionDefault
pageNo
sortNodefault
keywordYes
platformYes
page_sizeNo
has_couponNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden. It discloses the result shape and the sort/range semantics, but says nothing about authentication requirements, rate limits, total result caps, or whether pagination beyond page_size is possible. Useful context, but incomplete for a 6-param search tool with zero annotation coverage.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Purpose is front-loaded in the first clause, followed by a compact Args list with no filler sentences. The only minor redundancy is restating return fields that the output schema already defines, but it is one short parenthetical and does not bloat the definition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a paginated search with an output schema present, the description covers the searchable dimensions and result semantics adequately, so return values need not be explained further. It falls short of 5 only because cross-platform behavioral differences (e.g., whether commission data exists on every platform) are left unstated.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must carry all parameter meaning and it does: platform enumerated as taobao/jd/pdd, keyword noted as Chinese-friendly, page documented as 1-based, page_size bounded 1-50, has_coupon explained, and six sort modes spelled out including the meaning of commission and sales. This fully compensates for the bare schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('按关键词搜索商品') and enumerates the unified return fields (price, coupon price, commission rate, sales, shop, link), so the agent immediately knows what the tool produces. It does not, however, distinguish itself from siblings like get_product or shopping_status, which an agent must infer from names alone.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The Args block gives implicit operational guidance (has_coupon to restrict to coupon items, sort values to shape results), which helps an agent steer the call. There is no explicit statement of when to use this tool versus get_product for a single item, nor any exclusion or prerequisite, so usage remains implied rather than declared.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

shopping_statusA

查看三个平台(taobao / jd / pdd)的凭证配置状态、当前运行模式与申请指引。

返回每个平台的 mode(live=真实数据 / mock=假数据)、缺失的环境变量名、 以及该平台该去哪里申请、需要什么资质。开始任何调用前先看这个。

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does so well: it discloses the exact return contents (per-platform mode with live/mock semantics, missing environment variable names, application location and required qualifications). The word 查看 implies a read-only inspection, though read-only/non-destructive behavior is never stated explicitly, leaving a small gap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three tightly written sentences: what it inspects, what it returns, and when to call it. The purpose is front-loaded and every sentence adds distinct information with no redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, yet the description still usefully summarizes the return shape (mode, missing env vars, application info), which exceeds requirements. For a zero-parameter diagnostic tool, nothing an agent needs to invoke it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, so the baseline of 4 applies. There is nothing for the description to clarify about inputs.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource: viewing credential configuration status, running mode, and application guidance across taobao/jd/pdd. This is unmistakably a diagnostic/status tool, clearly distinguished from siblings like search_products, get_product, and convert_link which all perform shopping operations rather than configuration checks.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

"开始任何调用前先看这个" (check this before making any call) gives an explicit usage directive and priority ordering. It does not name when-not-to-use or explicitly enumerate alternatives, but the sequencing instruction is clear enough that an agent knows exactly when to reach for it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 4 tool updatesv0.1.0
    • First observedconvert_link
    • First observedget_product
    • First observedsearch_products
    • First observedshopping_status

TDQS

A4.1/5.0

Scored across 4 tools

Disambiguation5/5

Each tool has a clearly distinct purpose: status/config check, keyword search, single-item detail lookup, and affiliate-link conversion. The descriptions explicitly differentiate item_id semantics per platform (num_iid vs skuId vs goods_sign), leaving no room for misselection.

Naming Consistency4/5

Three tools follow a clean verb_noun pattern (search_products, get_product, convert_link), but shopping_status uses a domain prefix plus noun rather than a verb, a minor deviation. The set is still highly readable and predictable.

Tool Count4/5

Four tools is a tight but sensible scope for an affiliate-shopping workflow (search, detail, link conversion, plus a setup/status helper). It leans slightly thin — a category or batch-conversion tool could earn its place — but nothing is redundant.

Completeness4/5

The core affiliate lifecycle (discover via search, inspect via get_product, monetize via convert_link, verify setup via status) is fully covered. Minor gaps like batch conversion or order/reporting operations exist but are workable around.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • F
    license
    A
    quality
    B
    maintenance
    Enables unified product search, coupon retrieval, and cross-platform price comparison across Taobao, JD, and Pinduoduo affiliate APIs through MCP.
    5
    1
    -
  • F
    license
    Not graded
    quality
    B
    maintenance
    Enables searching Taobao products, retrieving item details, and turning listings or official campaign pages into affiliate promotion links, Taobao share codes (淘口令), and short URLs. It calls the official Taobao Alliance open API directly with your own AppKey, requiring no third-party wrapper services, so agents can generate commission-earning shopping links on demand.
    1
    -