Skip to main content
Glama
NordicsSys

pinterest-business-mcp

by NordicsSys
OverviewSchemaSourceRelated ServersDiscussionsAdmin
TypeScript
Local

Pinterest Business MCP

Local Model Context Protocol server for Pinterest Business workflows. This repository includes a stdio MCP server, Pinterest OAuth connection tools, encrypted local token storage, and server status reporting.

Requirements

  • Node.js 22+

  • pnpm 11+

  • A Pinterest developer app with the redirect URI below

Related MCP server: LinkedIn MCP Server

Pinterest developer dashboard setup

  1. Sign in at Pinterest Developers.

  2. Create or open your app.

  3. Under Configure, add this exact redirect URI:

    http://127.0.0.1:3333/oauth/callback

  4. Copy your App ID and App secret key.

  5. Request the scopes your workflow needs. At minimum, connection testing commonly uses read scopes such as boards:read, pins:read, and user_accounts:read.

  6. For sandbox testing, keep PINTEREST_ENVIRONMENT=sandbox. Pinterest uses the same OAuth authorize page for both environments; token exchange uses the sandbox API host when sandbox is selected.

Local setup

pnpm install
cp .env.example .env

Edit .env and set at minimum:

PINTEREST_ENVIRONMENT=sandbox
PINTEREST_APP_ID=your-app-id
PINTEREST_APP_SECRET=your-app-secret
PINTEREST_TOKEN_ENCRYPTION_KEY=your-base64-key
PINTEREST_OAUTH_SCOPES=boards:read,pins:read,user_accounts:read

Generate an encryption key:

openssl rand -base64 32

Development

pnpm dev          # watch mode (tsx)
pnpm build        # compile to dist/
pnpm start        # run compiled server
pnpm verify       # typecheck, lint, test, build

MCP client configuration (Cursor)

Add a project-scoped MCP server entry in .cursor/mcp.json (recommended) or your user MCP settings. Do not commit real secrets.

{
  "mcpServers": {
    "pinterest-business": {
      "command": "node",
      "args": ["/absolute/path/to/pinterest-business-mcp/dist/index.js"],
      "env": {
        "PINTEREST_ENVIRONMENT": "sandbox",
        "PINTEREST_APP_ID": "your-app-id",
        "PINTEREST_APP_SECRET": "your-app-secret",
        "PINTEREST_TOKEN_ENCRYPTION_KEY": "your-base64-key",
        "PINTEREST_OAUTH_SCOPES": "boards:read,pins:read,user_accounts:read",
        "PINTEREST_WRITES_ENABLED": "false",
        "LOG_LEVEL": "info"
      }
    }
  }
}

Restart Cursor after changing MCP configuration.

Connecting your Pinterest Business account

  1. Start the MCP server in Cursor.

  2. Call pinterest_get_authorization_url.

  3. Open the returned authorization URL in your browser.

  4. Approve the Pinterest app when prompted.

  5. Wait for the local callback page at http://127.0.0.1:3333/oauth/callback to report success.

  6. Call pinterest_connection_status to confirm the connection.

The MCP server never asks for your Pinterest password. Authentication happens only on Pinterest's official OAuth page.

Sandbox setup

  • Set PINTEREST_ENVIRONMENT=sandbox.

  • Use the same redirect URI: http://127.0.0.1:3333/oauth/callback.

  • OAuth authorization still starts at https://www.pinterest.com/oauth/.

  • Token exchange and refresh use https://api-sandbox.pinterest.com/v5/oauth/token.

Tools

pinterest_server_status

Returns server metadata and configuration flags only — never credential values.

pinterest_get_authorization_url

Starts the local callback listener on 127.0.0.1:3333, creates a single-use OAuth state value, and returns the Pinterest authorization URL plus safe instructions. Tokens are never returned by this tool.

Optional input:

  • scopes: array of official Pinterest scopes. If omitted, PINTEREST_OAUTH_SCOPES is used.

pinterest_connection_status

Reports whether a Pinterest account is connected locally, including scope and expiry metadata. Tokens are never returned. Expired access tokens are refreshed automatically when a valid refresh token is available.

pinterest_disconnect

Securely removes locally stored OAuth authorization data. To revoke access on Pinterest itself, remove the app from Pinterest settings under Security and logins → Apps.

Environment variables

See .env.example for the full list.

Variable

Required

Description

PINTEREST_ENVIRONMENT

Yes

sandbox or production

PINTEREST_APP_ID

OAuth

Pinterest app ID

PINTEREST_APP_SECRET

OAuth

Pinterest app secret

PINTEREST_TOKEN_ENCRYPTION_KEY

OAuth

Base64 or passphrase used for AES-256-GCM token encryption

PINTEREST_TOKEN_STORE_PATH

No

Encrypted token file path (default: .tokens/pinterest-oauth.enc)

PINTEREST_OAUTH_SCOPES

OAuth

Default scopes unless overridden by the authorization tool

PINTEREST_WRITES_ENABLED

No

true or false (default: false)

LOG_LEVEL

No

debug, info, warn, or error

Troubleshooting

Problem

What to check

Callback port already in use

Another OAuth attempt or process is using 127.0.0.1:3333. Wait for it to finish or stop the other process.

Redirect URI mismatch

The Pinterest app must contain the exact URI http://127.0.0.1:3333/oauth/callback.

Missing scopes

Set PINTEREST_OAUTH_SCOPES or pass scopes to pinterest_get_authorization_url.

Connection not stored

Confirm PINTEREST_TOKEN_ENCRYPTION_KEY is set and writable, then repeat the OAuth flow.

Sandbox token exchange failed

Keep PINTEREST_ENVIRONMENT=sandbox so token exchange uses the sandbox API host.

Refresh failed

Reconnect with pinterest_get_authorization_url if the refresh token expired or was revoked.

Token revocation and disconnect

  • Local disconnect: call pinterest_disconnect.

  • Pinterest-side revocation: open Pinterest settings → Security and logins → Apps and remove this app.

  • Pinterest's remote revocation endpoint is unreliable in some app states, so local disconnect plus manual app removal is the supported recovery path.

Security

See SECURITY.md for credential handling and threat boundaries.

License

MIT

Available Tools

4 tools
pinterest_connection_statusA

Returns whether a Pinterest account is connected locally without exposing tokens.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It discloses that the check is local and that tokens are not exposed, which is a useful privacy behavior. However, it doesn't state whether this is a safe read-only operation, whether it can error, or what happens if no account is configured.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, concise sentence that conveys all essential information without redundancy. It front-loads the purpose and includes a security caveat, making every word earn its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (0 params, no output schema), the description is largely sufficient for an agent to understand what it does and when to call it. The absence of a stated return format (boolean vs text) is a minor gap, but 'Returns whether' strongly implies a boolean. The sibling context is handled fairly well with the 'locally' qualifier, though an explicit alternative reference would improve completeness.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters and an empty schema. The description doesn't need to explain parameters, and it adds value by clarifying the nature of the returned status. With 0 params, the baseline is 4, and the description introduces no parameter-related confusion.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb 'Returns' and identifies the resource (whether a Pinterest account is connected locally). It differentiates from siblings like pinterest_server_status by specifying 'locally' and adds the important security context of not exposing tokens.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit when-to-use or alternatives are mentioned. The description implies the tool is for checking local connection status, but it doesn't compare with pinterest_server_status or explain when to prefer this over the authorization or disconnect sibling tools. It is clear enough but lacks explicit usage guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

pinterest_disconnectA

Securely removes locally stored Pinterest OAuth authorization data without returning tokens.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses that the tool securely removes locally stored authorization data and explicitly states that tokens are not returned. However, it does not address whether server-side tokens are revoked or what happens if no connection exists, though the focus on 'locally stored' implies a local-only operation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, concise sentence of about 12 words. It is front-loaded with the action ('removes') and includes the key scope ('locally stored') and a behavioral caveat ('without returning tokens') without any waste.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (no parameters, no output schema), the description covers the essential behavior. It could be enhanced by noting whether the server-side token remains valid, but it gives sufficient context for the agent to understand the tool's purpose and scope.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

This tool has zero parameters, and the input schema is empty. Therefore, there are no parameter semantics to explain, and the description does not need to add any parameter-related information.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses the specific verb 'removes' and clearly identifies the resource as 'locally stored Pinterest OAuth authorization data'. It also clarifies that it does not return tokens, distinguishing it from sibling tools like pinterest_get_authorization_url.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description does not provide any guidance on when to use this tool versus its siblings. There is no mention of alternatives or conditions for use, leaving the agent to infer usage solely from the tool name and context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

pinterest_get_authorization_urlA

Starts the local Pinterest OAuth callback listener and returns the authorization URL plus safe connection instructions.

ParametersJSON Schema
NameRequiredDescriptionDefault
scopesNoOptional OAuth scopes override. Otherwise PINTEREST_OAUTH_SCOPES is used.

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden. It does disclose a side effect (starting a local listener) and that it returns URL plus instructions, but it does not detail blocking behavior, timeout, or what 'safe connection instructions' entail. This is helpful but incomplete.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, well-front-loaded sentence that conveys the core action, side effect, and output without waste.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple one-parameter tool with no annotations or output schema, the description provides sufficient context to use it: it starts a listener and returns a URL with instructions. It does not explicitly mention user interaction or return format, but these are somewhat implied by 'safe connection instructions.'

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The single parameter 'scopes' is fully described in the schema (100% coverage) with 'Optional OAuth scopes override. Otherwise PINTEREST_OAUTH_SCOPES is used.' The description adds no additional parameter context, so a baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's action ('Starts the local Pinterest OAuth callback listener') and its output ('returns the authorization URL plus safe connection instructions'). This distinguishes it from siblings (server_status, connection_status, disconnect) which are status/disconnect tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies this is the tool to initiate OAuth authorization by starting a callback listener, and it is distinct from the sibling status/disconnect tools. However, there is no explicit statement about when to use it versus alternatives or any prerequisites (e.g., needing PINTEREST_OAUTH_SCOPES).

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

pinterest_server_statusA

Returns Pinterest Business MCP server configuration status without exposing secrets.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.1/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the burden of disclosing behavior. It does add a useful guarantee ('without exposing secrets'), which implies a security-conscious read operation. However, it does not mention whether authentication is required, return format, or any rate limits. For a zero-parameter status tool, this is acceptable but minimal.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence that is concise and front-loaded. It states the core purpose and the key security caveat without wasted words. Every part earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the simplicity of the tool (zero parameters, no output schema, no annotations), the description is sufficiently complete. It tells the agent what the tool does and the main behavioral concern (secret exposure). No additional context seems necessary for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, and schema coverage is 100% (empty schema). The description correctly adds no parameter details, as there are none. Per the rubric, a baseline of 4 is appropriate for tools with no parameters, and the description does not introduce confusion.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Returns') and clearly identifies the resource ('Pinterest Business MCP server configuration status'). It distinguishes itself from sibling tools like pinterest_connection_status by focusing on configuration status rather than connection health, and adds a security qualifier ('without exposing secrets').

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for checking server configuration status, and the name differentiates it from sibling tools. However, it provides no explicit when-to-use guidance or mentions alternatives (e.g., 'use pinterest_connection_status for connection checks'). This is clear context but lacks explicit exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 4 tool updatesv0.1.0
    • First observedpinterest_connection_status
    • First observedpinterest_disconnect
    • First observedpinterest_get_authorization_url
    • First observedpinterest_server_status
Deploy Server
RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

TDQS

A4/5.0

Scored across 4 tools

Disambiguation5/5

Each tool addresses a distinct aspect of OAuth lifecycle: server config status, authorization URL retrieval, connection status, and disconnection. There is no overlap in their purposes, making misselection unlikely.

Naming Consistency3/5

All tools share the 'pinterest_' prefix and use lowercase with underscores, but verb usage is inconsistent. 'server_status' and 'connection_status' are noun phrases, while 'get_authorization_url' uses a verb and 'disconnect' is a bare verb. This mixed convention is readable but not fully predictable.

Tool Count5/5

With 4 tools, the server is tightly scoped to OAuth connection management. Each tool is essential and there is no bloat, making the count ideal for the apparent purpose.

Completeness4/5

The tool set covers the main lifecycle: check server config, initiate authorization, verify connection, and disconnect. A minor gap is the absence of an explicit token refresh or explicit callback handling, but these are likely handled implicitly or are beyond the server's intended scope.

Maintenance

ActivitySlowing
ResponsivenessNo issues

Resources

Related MCP Connectors

Related MCP Servers

  • ebay-mcp

    taka392
    A
    license
    A
    quality
    D
    maintenance
    Enables interaction with eBay APIs for account verification, item search, and browsing via OAuth 2.0 authentication, with support for token refresh and sandbox/production environments.
    4
    MIT