This server does not currently have a deployable release on Glama. Follow the repository's setup instructions to install and configure it for your MCP client, including any required credentials and local dependencies.
把 16688 数字卡密交易平台的开放 API（网关 https://www.16688.com.cn/openApi）包成一个 MCP 服务，让 Claude 等 AI 助手可以管理店铺：商品、店内分类、卡密库存、货源采购、店铺订单、投诉和钱包余额。
工具 | 作用 |
| 列出 43 个接口的路径、说明、参数（ |
| 对一个接口发起已签名的 POST 请求，返回平台原始 JSON |
app_id、timestamp、nonce、sign 由服务端自动补上，调用方只传业务参数。签名按官方文档：
HMAC-SHA256(secret, "POST\n<控制器小写>\n<动作小写>\n<按键名排序的 k=v&...>")，结果为小写十六进制。测试里用官方 PHP 示例逐字节对拍。
Related MCP server: Shopify Store MCP Server
默认拒绝 5 个会花钱、退款或删除的接口：purchase/create（扣运营钱包采购）、order/refund、complaint/refund、goods/delete、stockSecret/invalidateAll。要放开，在 .env 里设 OPEN16688_ALLOW_DANGEROUS（逗号分隔路径，或 *）。
OPEN16688_READ_ONLY=1：只放行查询类接口。
其余接口（建商品、改加价、上下架、上传卡密、人工发货标记、投诉留言等）默认放行。
HTTP 层要求 Authorization: Bearer <MCP_BEARER_TOKEN>；MCP_ALLOWED_HOSTS 固定 Host 头。
用 root 在服务器上执行 deploy/install.sh。脚本会依次提示输入：
GitHub 只读令牌（仓库是私有的才需要；只用于本次 clone/pull，不写盘）。用 fine-grained token，只选本仓库，权限只给 Contents: Read-only。
首次安装时的 app_id 和 secret（secret 输入时不回显，只写进 /opt/16688-mcp/.env，权限 600）。
脚本放到服务器上的办法：把 deploy/install.sh 内容粘贴成 /root/install-16688-mcp.sh，然后 bash /root/install-16688-mcp.sh。以后更新重跑同一条命令即可。
容器只监听 127.0.0.1:3320，只读根文件系统、去掉全部 capability。前面用 Cloudflare Tunnel + Access 暴露给 MCP Portal。
pip install -e '.[test]'
pytest -q # 签名对拍需要本机有 php接口目录 src/open16688_mcp/endpoints.json 由官方文档整理而来（2026-10-18 版，43 个接口）。
MIT
This server cannot be deployed
Manage your NanoCart store from any AI agent: products, orders, coupons, subscribers, reports.
Directory of APIs, merchants, and tools AI agents can actually use.
AI-powered commerce API for luxury skincare shopping. Enables AI agents to search products, browse collections, manage shopping carts, and generate checkout URLs for the Regenique Elegance Shopify store.
SuperCatch connects your AI assistant to a trading-card and collectibles marketplace and your own SuperCatch account or approved stores. Search public cards and collectibles, inspect current offers and seller storefronts, and find cited setup and help documentation without signing in. Connect through SuperCatch OAuth to read your purchases, watchlist membership, saved searches, recorded collection items and support cases. Approved sellers can inspect their listings, stock, low-stock items, orders, sales activity, imports and integration health, subject to current permissions. For supported changes, request the exact action you intend. Depending on consent, permissions and native readiness, tools can manage account watchlist membership and saved searches or prepare supported pricing, inventory, stock-receipt, photo-draft, listing-submission, marketplace-publication, first-shipment, tracking-correction, import-resume and support workflows. Preparation does not execute a change. Actions requiring native approval provide a SuperCatch review link and execute only the approved frozen scope. Price changes require exact confirmation or bound native approval according to the selected tool. A shipment or tracking action does not authorize a label purchase, payment or refund. Private results stay within the connected account and approved-store access. A tool appearing in discovery does not grant permission to call it. After an uncertain response, inspect the original operation and reuse its original idempotency key where documented; do not create a replacement intent to bypass recovery. Preview tools do not activate recurring automation. Connect using Streamable HTTP at https://supercatch.com/api/mcp. Setup: https://supercatch.com/ai. Help: https://supercatch.com/help. Support: support@supercatch.com. Review or revoke OAuth access in SuperCatch Account Settings > Connected Apps. Prices and availability can change; inspect the linked source before acting. Official connector repository: https://github.com/empline/supercatch-mcp.
