mcp-walmart-ads
An MCP server that gives agents a single tool surface to discover, inspect, and call Walmart Connect, Walmart Marketplace, and Sam's Club advertising APIs with authentication, signing, and token handling managed automatically.
List and filter OpenAPI operations across 33 specs by platform, api, tag, method, or free-text query.
Describe any operation plus all reachable schema definitions, so request bodies can be built without reading full specs.
Execute authenticated API calls by qualified operation id or by raw method+path, including path/query params, JSON bodies, and file uploads.
Select region, environment, advertiser, and non-US WAP tenant per request; marketplace credential selection is enforced.
Auto-sign RSA requests, acquire OAuth tokens, add required headers, retry once after 401, and truncate large responses with a cached full body.
Download reports, labels, or snapshots either to a local file or gunzipped into a cache, with redirect handling that preserves auth only where safe.
Refresh OpenAPI specs into the user cache manually or on a background schedule.
Read MCP resources such as platform/region/environment status, advertiser mappings, host URLs, cached response bodies, and reusable cURL commands.
Provides tools to interact with Walmart Connect Advertising APIs, enabling AI agents to execute any Sponsored Search and Display API endpoint and download display snapshots, with automatic RSA-SHA256 signing and authentication.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@mcp-walmart-adslist my sponsored search campaigns in US production"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Walmart & Sam's Club APIs
MCP server for three Walmart Inc. API families, behind one tool surface:
Platform | APIs | Auth |
| Sponsored Products, Display | RSA-SHA256 signature + bearer token |
| 28 domains (orders, items, feeds, reports, …) | OAuth2 |
| Sponsored Products | RSA-SHA256 signature + bearer token |
Four tools over 31 apis and 424 operations — discovery, a generic proxy, and a downloader. An agent finds endpoints in the bundled OpenAPI specs and calls them; the server signs, acquires tokens, and builds headers.
walmart:ads:sponsored-products:SBAProfileUpdateV2
└─ retailer ─┘└ line ┘└─── api name ───┘└── operationId ──┘
└────────── platform ─────────┘ credentials attach hereAn operation id alone resolves to a host and an auth model. A matching <line>:<name>
suffix means the same surface for another retailer — 13 shared operation ids of 90.
Requirements
Python 3.13+
Credentials for whichever platforms you use. Configure only those — an absent platform is simply unconfigured, and discovery works with no credentials at all.
Walmart Connect / Sam's Club — consumer ID, RSA key pair, bearer token
Walmart Marketplace — client ID + secret, and the advertiser (seller profile) ids they serve
Related MCP server: walmart-marketplace-mcp
Quick start
Set up your config (see Configuration), then run the server:
# Run directly with uvx (no clone needed)
npx -y @modelcontextprotocol/inspector@latest uvx mcp-walmart-ads# Or run from source
git clone https://github.com/alyiox/mcp-walmart-ads.git
cd mcp-walmart-ads
uv sync
npx -y @modelcontextprotocol/inspector@latest uv run mcp-walmart-adsConfiguration
config.json MUST live at ~/.config/mcp-walmart-ads/config.json. The server reads it
once at startup, so a corrected file REQUIRES a restart.
Windows:
~maps to%USERPROFILE%(typicallyC:\Users\<you>), making the full path%USERPROFILE%\.config\mcp-walmart-ads\config.json.
Create the directory and copy the example:
# Unix-like (macOS, Linux, WSL, …)
mkdir -p ~/.config/mcp-walmart-ads/keys/walmart-ads
cp config.example.json ~/.config/mcp-walmart-ads/config.json# Windows (PowerShell)
New-Item -ItemType Directory -Force "$env:USERPROFILE\.config\mcp-walmart-ads\keys\walmart-ads"
Copy-Item config.example.json "$env:USERPROFILE\.config\mcp-walmart-ads\config.json"Shape
platforms.<platform>.regions.<region>.<environment> = <auth block><platform> is the two-segment prefix an api id starts with, so a config key is literally
the value you pass as the platform tool parameter — nothing to translate.
The auth block's shape follows the platform's auth model. There is exactly one shape per platform, so no discriminator field is needed.
Signature platforms (walmart:ads, samsclub:ads):
{
"platforms": {
"walmart:ads": {
"regions": {
"us": {
"production": {
"consumer_id": "your-consumer-id",
"private_key": "./keys/walmart-ads/us-prod.pem",
"private_key_version": "1",
"bearer_token": "your-bearer-token",
"base_urls": {
"sponsored-products": "https://developer.api.walmart.com/api-proxy/service/WPA/Api/v1",
"display": "https://developer.api.walmart.com/api-proxy/service/display/api/v1"
}
}
}
}
}
}
}Field | Notes |
| Partner Network consumer ID |
| Path to the RSA private key (PEM). Relative paths resolve against the config directory |
| Key version string (default |
| OAuth bearer token |
| One per api in the platform's discovery surface. Keys MAY be bare ( |
Environment names are free-form here — Walmart may issue a tenant only production, or
production and staging.
OAuth2 platform (walmart:marketplace):
{
"platforms": {
"walmart:marketplace": {
"regions": {
"us": {
"production": {
"credentials": [
{
"client_id": "your-client-id",
"client_secret": "your-client-secret",
"advertisers": [
{ "id": 7060158, "partner_id": "10001234" },
{ "id": 7060159 }
]
}
]
}
}
}
}
}
}environment MUST be production or sandbox; base URLs are fixed by the server and
absent from the file. Advertiser ids nest under the credential that serves them, so a
secret appears exactly once and a dangling advertiser reference is structurally
impossible. partner_id is per-seller because two payments operations require it as
WM_PARTNER_ID; an all-zero value reads as absent, since that is what a generated config
writes for a seller without one, and scripts/backfill_partner_ids.py fills the gaps from
Walmart.
Regions are a namespace, not a route — every walmart:marketplace region reaches the same
hosts. The level exists because advertiser ids are unique only within a region.
Splitting the config
A populated walmart:marketplace block runs to tens of kilobytes of credentials, 88% of
the file here, and a stray comma while editing it takes down every platform: a parse
failure precedes per-platform validation. Platforms MAY therefore live in drop-in files
under config.d/, merged over the base:
~/.config/mcp-walmart-ads/
├── config.json # server-wide settings, and any platforms you like
├── config.d/
│ ├── walmart-marketplace.json # only a "platforms" object
│ └── samsclub-ads.json
└── keys/A drop-in MUST declare only
platforms; server-wide settings stay inconfig.json.A platform declared in two files is an error naming both — never silent precedence.
Only
*.jsondirectly inconfig.d/is read, so.bakand editor swap files are ignored.A file that fails to parse costs only its own platforms; the rest keep working.
Relative
private_keypaths resolve againstconfig.json's directory either way, so moving a platform intoconfig.d/needs no path edits.No
config.d/directory means no change in behavior.
A malformed block for one platform MUST NOT stop the others loading. Read
wmt://platforms to see which loaded and what regions and environments they declare: one
that failed has no regions, and reading one of its environments returns the loader's own
message — which file, which fields, and that a fix needs a restart.
Top-level options
Field | Default | Notes |
|
| Seconds a truncated body or download stays readable at its resource URI |
|
| Response bytes returned inline before truncating to a preview |
|
| Background spec refresh. |
Market → tenant (wap-tenant-id)
Pass tenant on call_endpoint and download_file for non-US walmart:ads markets
(WMT_CA, WMT_MX, WBD_OD, …). Omit it for US and for walmart:marketplace.
Tools
list_endpoints
List operations across every api, with optional filters.
Parameter | Notes |
| Case-insensitive substring on operation id, path, or summary |
| Limit to one api, e.g. |
| Limit to one platform — |
| Filter by OpenAPI tag |
| Filter by HTTP verb — |
Returned operation ids are qualified (api:operationId) and pass straight to
describe_endpoint or call_endpoint.
describe_endpoint
One operation plus every components.schemas entry reachable from it, so a request body
can be built without the full spec. Server-managed auth and QoS headers are omitted.
Parameter | Notes |
| Qualified ( |
| Api to resolve a bare id in, e.g. |
call_endpoint
Execute an authenticated request against any configured platform. Signing, token acquisition with per-credential caching and single-flight refresh, and one retry after a 401 all happen server-side.
Parameter | Notes |
| Required. Src: config |
| Qualified or bare. Resolves api, platform, method, path, and required headers |
| Required with raw |
| Raw route, reaching alpha/beta/unpublished endpoints absent from the specs |
| Values for |
| Query string and JSON body |
| Send the file as |
| MUST be given on |
| WAP tenant for non-US |
A response larger than truncate_threshold is previewed inline, with the full body at
wmt://responses/{request_id} and a reproducible cURL at wmt://curl/{request_id} —
bearer tokens, access tokens, and signatures replaced with placeholders.
download_file
Download a report, label, or snapshot from an authenticated endpoint. Give a full url
(the details URL from a display snapshot poll, say), or operation_id, or api with
method + path. platform is required only for a bare url.
With dest_path the bytes are written there. Without it they are gunzipped when gzipped
and cached, and the result carries cached_at — a binary payload with no dest_path asks
for one instead. Redirects are followed, keeping auth headers on a relative or same-host
Location and dropping credentials cross-host; the result includes urls, the hop path.
Specs
33 OpenAPI documents ship in the wheel. A refresh writes updated copies to
~/.cache/mcp-walmart-ads/specs/, which outranks the bundle on read. The bundle is never
written at runtime, so it stays the floor a damaged or missing cache falls back to.
Where they come from
Walmart publishes no OpenAPI files, but each ReadMe reference page hydrates its HTML with
the registry UUIDs of its documents, and https://dash.readme.com/api/v1/api-registry/<uuid>
serves the full spec unauthenticated. That covers Walmart Connect and all 28 Marketplace
domains. Sam's Club publishes neither, so its spec is hand-authored from the developer
docs: scripts/build_samsclub_spec.py regenerates a candidate from those docs, and the
scheduled spec drift workflow opens a PR when they change, as a human review gate. The
candidate is never shipped and never loaded at runtime.
Documents are stored verbatim as upstream served them, so a refresh diff shows exactly
what changed. Oversized inline examples and x-readme metadata are stripped on load
rather than on disk, which keeps that reduction retunable without re-downloading anything.
Keeping them current
Specs refresh in the background: once at startup, then every spec_refresh.interval days
(7 by default). Set auto to false to stop the sweep — the interval is remembered for
whenever you turn it back on, and the manual refresh still works.
To refresh now, having hit an endpoint the bundled spec does not have:
# Installed with uvx (no clone)
uvx mcp-walmart-ads --refresh
# Or from a source checkout
uv run mcp-walmart-ads --refreshEither form sweeps every spec regardless of the interval and writes the same user cache,
printing one row per document: written, unchanged, or error.
There is deliberately no tool for this. A stale spec is indistinguishable from a current one from inside a session — it simply lacks an endpoint — so an agent asked to decide would either never refresh or refresh superstitiously after an unrelated failure. The trigger belongs outside the session.
A document MUST yield at least one operation before it is installed, so an upstream
answering 200 with an error body cannot poison the cache, and a byte-identical document
is left alone. A cached file that will not load is discarded and the read falls back to
the bundle. Servers coordinate through spec-state.json at the cache root, which records
when each spec was last tried and holds a lease so one process sweeps at a time — every
client session runs its own server process, and without it each would re-download all 33.
Rebuilding the bundle
A maintainer step, and not the same thing as --refresh: that updates your cache, this
updates the copies that ship in the wheel.
# Registry-sourced specs only, by default
uv run python scripts/fetch_specs.py
uv run python scripts/fetch_specs.py walmart:ads:sponsored-products walmart:marketplace:order-management
# Regenerate the Sam's Club candidate spec for review
uv run --group spec-build python scripts/build_samsclub_spec.pyMCP resources
Resource URI | Description |
| Every platform, its auth model, and the regions and environments it declares |
| That platform's api ids |
| One api: title, version, operation count, and its tags with a count each — the legal |
| Advertiser ids mapped to their Walmart Partner ID ( |
| Api ids mapped to the base URL a call reaches, or |
| Full body of a truncated response or a cached download (in memory, TTL from config) |
| Reproducible cURL for a previous request, credentials replaced with placeholders |
MCP host examples
Add to .cursor/mcp.json:
{
"mcpServers": {
"walmart": {
"command": "uvx",
"args": ["mcp-walmart-ads"]
}
}
}Add to your Claude Code MCP config:
{
"mcpServers": {
"walmart": {
"command": "uvx",
"args": ["mcp-walmart-ads"]
}
}
}[mcp_servers.walmart]
command = "uvx"
args = ["mcp-walmart-ads"]{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"walmart": {
"type": "local",
"enabled": true,
"command": ["uvx", "mcp-walmart-ads"]
}
}
}{
"inputs": [],
"servers": {
"walmart": {
"type": "stdio",
"command": "uvx",
"args": ["mcp-walmart-ads"]
}
}
}Development
uv sync --group dev
uv run ruff check src/ tests/ scripts/
uv run ruff format --check src/ tests/ scripts/
uv run pyright
uv run pytest tests/ -vContributing
Issues and pull requests are welcome. Keep changes focused; ruff check,
ruff format --check, pyright, and pytest MUST all pass.
License
Available Tools
5 toolscall_endpointADestructive
[Walmart] Execute an authenticated API request. Identify the endpoint by operation_id, or by method + path with an api — a raw path also reaches alpha/beta/unpublished endpoints absent from the bundled specs. Auth, signature, market, and correlation headers are added by the server. A body over the configured threshold is truncated to a preview; read the returned cached_at resource for the whole of it.
| Name | Required | Description | Default |
|---|---|---|---|
| api | No | Api to call, e.g. walmart:marketplace:order-management. Required with raw method+path; otherwise inferred from operation_id. Src: platforms. | |
| body | No | JSON request body for POST/PUT/PATCH — an object, or an array of objects where the API takes a batch. | |
| path | No | API path after the base URL, e.g. /v3/orders or /api/v1/campaigns. Required unless operation_id is given. | |
| method | No | HTTP method. Required unless operation_id is given. | |
| params | No | Query string parameters as a JSON object. | |
| region | Yes | Region label, e.g. us. Src: platforms. | |
| tenant | No | WAP tenant for non-US walmart:ads regions, e.g. WMT_CA, WMT_MX, WBD_OD. Omit for US and for walmart:marketplace. Sent as wap-tenant-id. | |
| file_path | No | Local file to send as multipart/form-data instead of a JSON body — Marketplace feed uploads. Pair with the feedType query parameter. | |
| environment | Yes | Target environment. walmart:marketplace accepts production or sandbox; the ads platforms accept whatever the config declares, usually production or staging. Src: platforms. | |
| path_params | No | Values for {placeholders} in the path, e.g. {"purchaseOrderId": "1796277083022"}. | |
| operation_id | No | Operation id, qualified as api:operationId (e.g. walmart:ads:sponsored-products:SBAProfileUpdateV2) or bare when unambiguous. Resolves the api, platform, method, path, and required headers. Src: operations. | |
| advertiser_id | No | Required on walmart:marketplace, where it selects the credential to act as. On the ads platforms it is optional and sent as X-Advertiser-ID, which many display/creative/campaign endpoints require. Src: platforms. |
Output Schema
| Name | Required | Description |
|---|---|---|
| body | No | |
| curl | No | |
| error | No | |
| cached_at | No | |
| truncated | No | |
| status_code | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true/openWorldHint=true, but the description adds real behavioral context beyond them: the server injects auth, signature, market, and correlation headers, and large bodies are truncated to a preview with the full payload available via the returned cached_at resource. That truncation and header-handling disclosure is genuinely useful and not present in the structured metadata.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Purpose is front-loaded in the first clause, and each subsequent sentence carries distinct information (identification modes, header injection, body truncation). It is dense but earns its length; no filler sentences.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 12-parameter tool with an output schema, the description covers the critical behaviors an agent needs: how to identify the endpoint, that auth is handled server-side, and how oversized bodies are returned. Return values themselves need not be explained given the output schema, though it could say more about the relationship to sibling discovery tools.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3, and each parameter is already documented in the schema. The description still adds meaning on top — the operation_id vs method+path+api interaction and the fact that a raw path reaches endpoints absent from the bundled specs — which goes beyond restating the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description gives a specific verb and resource — 'Execute an authenticated API request' — with the concrete identification modes (operation_id, or method + path with an api). This distinguishes it in practice from list_endpoints/describe_endpoint, though it never names a sibling explicitly, so it stops short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explains the two ways to identify an endpoint and notes that a raw path reaches alpha/beta/unpublished endpoints, which is useful context. However, it never states when to prefer this tool over describe_endpoint or list_endpoints, nor any prerequisite workflow (e.g. resolve operation_id first), leaving usage implied rather than explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
describe_endpointARead-only
[Walmart] Describe one OpenAPI operation. Returns it with every components.schemas entry reachable from it, so a request body can be built without the full spec.
| Name | Required | Description | Default |
|---|---|---|---|
| api | No | Api to resolve a bare operation_id in, e.g. walmart:ads:sponsored-products. Src: platforms. | |
| operation_id | Yes | Operation id, qualified as api:operationId (e.g. walmart:marketplace:order-management:getAllOrders) or bare when unambiguous. Src: operations. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and openWorldHint=false, so safety is covered. The description still adds real behavioral context the annotations cannot: that the result carries the full transitive schema closure rather than a shallow operation record, which is the key trait an agent needs to trust it for request-body construction. It omits error/not-found behavior for an unresolvable operation_id.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, zero filler, and the payload guarantee is front-loaded right after the purpose. Nothing repeats the name or the annotations.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return structure need not be restated, and the description covers purpose, scope and the semantic completeness of the result. The remaining gap is routing guidance against list_endpoints and any failure mode for ambiguous or unknown operation_ids.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%: the schema already explains the qualified vs bare operation_id form and the api fallback for disambiguation. The description adds nothing about either parameter, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
"Describe one OpenAPI operation" states a specific verb and a tightly scoped resource, and the second sentence pins down exactly what the response includes (the operation plus every transitively reachable components.schemas entry). An agent can distinguish this from list_endpoints (enumerate many) and call_endpoint (invoke) without opening any schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase "so a request body can be built without the full spec" implies the workflow position (inspect before composing/calling), but the description never explicitly says when to use this versus list_endpoints or call_endpoint, nor when not to use it. Usage is inferable rather than stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
download_fileAIdempotent
[Walmart] Download a report, label, or snapshot. Give a full url — such as the details URL from a display snapshot poll, or a Marketplace report url — or an operation_id, or an api with method and path. Written to dest_path when given, otherwise gunzipped and cached. Redirects are followed for you.
| Name | Required | Description | Default |
|---|---|---|---|
| api | No | Api to call when using method+path. Src: platforms. | |
| url | No | Absolute URL to fetch, e.g. a snapshot or report URL returned by a previous call. | |
| path | No | API path when not using url. | |
| method | No | HTTP method when using path. Defaults to GET. | |
| params | No | Query string parameters as a JSON object. | |
| region | Yes | Region label, e.g. us. Src: platforms. | |
| tenant | No | WAP tenant for non-US walmart:ads regions. Sent as wap-tenant-id. | |
| platform | No | Platform to authenticate as. Required with a bare url; otherwise inferred from operation_id or api. Src: platforms. | |
| dest_path | No | Local path to write the bytes to. Omit to gunzip and cache the payload instead, readable at the returned cached_at resource. | |
| environment | Yes | Target environment. walmart:marketplace accepts production or sandbox; the ads platforms accept whatever the config declares, usually production or staging. Src: platforms. | |
| path_params | No | Values for {placeholders} in path. | |
| operation_id | No | Operation id, qualified or bare. Src: operations. | |
| advertiser_id | No | Required on walmart:marketplace (selects the credential) and by display snapshot downloads, where it is sent as X-Advertiser-ID and as the advertiserId query parameter. Src: platforms. |
Output Schema
| Name | Required | Description |
|---|---|---|
| path | No | |
| urls | No | |
| error | No | |
| cached_at | No | |
| size_bytes | No | |
| status_code | No | |
| content_type | No | |
| bytes_written | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations (readOnlyHint=false, idempotentHint=true, destructiveHint=false) leave the mutation oddity unexplained, and the description resolves it by disclosing the actual behavior: bytes are written to dest_path when given, otherwise gunzipped and cached, with redirects followed automatically. It stops short of stating auth/permission requirements, which the schema carries instead.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three tight sentences, front-loaded with the verb and resource, then the input modes, then the output behavior. No filler; only minor loss for packing several clauses into the middle sentence.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 13-parameter tool with an output schema (so return values need no explanation), the description covers the targeting modes and the write-vs-cache outcome adequately. The remaining gap is the absence of sibling routing against call_endpoint.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is already 100%, so the baseline is 3, but the description adds real meaning by showing the three mutually exclusive targeting modes (url vs operation_id vs api+method+path) and giving concrete examples of the URLs that work. It does not add syntax detail for params/tenant/path_params beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: 'Download a report, label, or snapshot', with the scope prefixed by '[Walmart]'. It is clear what the tool fetches, but it never distinguishes itself from the sibling call_endpoint, which likely also retrieves remote data.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explains the three input modes (full url, operation_id, or api with method and path) which implies usage, but gives no explicit when-to-use/when-not guidance and never names call_endpoint or any sibling as the alternative for a given case.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_endpointsARead-only
[Walmart] List OpenAPI operations across every api. Returned operation ids can be passed straight to describe_endpoint or call_endpoint.
| Name | Required | Description | Default |
|---|---|---|---|
| api | No | Limit to one api, e.g. walmart:marketplace:order-management. A platform prefix is not accepted here — use platform for that. Src: platforms. | |
| tag | No | Filter to operations whose OpenAPI tags include this value. | |
| limit | No | Rows to return from offset. The largest single api has 87. | |
| query | No | Case-insensitive substring match on operation id, path, or summary. | |
| method | No | Filter by HTTP verb. | |
| offset | No | Rows to skip. Pass next_offset from a prior call. | |
| platform | No | Limit to one platform. Src: platforms. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and openWorldHint=false, so the safety profile is covered. The description adds useful workflow context (ids are reusable downstream) but says nothing about pagination behavior or result shape beyond what the schema/output schema provide, so it adds only modest value over structured data.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, front-loaded with the resource and scope, followed immediately by the actionable handoff. Zero filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema, full annotation coverage, and 100%-documented parameters, the description only needs to establish purpose and workflow, which it does. A mention of pagination or that filtering is available would make it fully self-sufficient, but nothing critical is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and every parameter (api, tag, limit, offset, query, method, platform) is documented in the schema itself, including the platform-vs-api distinction and offset chaining. The description adds no parameter-level meaning, so the baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('List OpenAPI operations') plus default scope ('across every api'). It names the downstream siblings describe_endpoint and call_endpoint, which helps situate it, though it doesn't contrast against them as alternatives (e.g. vs. refresh_specs or download_file).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Clearly signals the discovery-first workflow: returned operation ids 'can be passed straight to describe_endpoint or call_endpoint.' That gives an agent a concrete reason to call this before those tools, but there are no explicit exclusions or when-not-to-use conditions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
refresh_specsAIdempotent
[Walmart] Refresh OpenAPI specs into the user cache, which then takes precedence over the bundled copies. Omit api to refresh all 33.
| Name | Required | Description | Default |
|---|---|---|---|
| api | No | Refresh only this api, e.g. walmart:marketplace:order-management. The two auxiliary walmart:ads specs are valid here. Src: platforms. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare non-read-only, idempotent, non-destructive, open-world behavior, so the bar is lower. The description still adds genuinely useful context beyond the annotations: the refreshed specs land in a user cache that takes precedence over bundled copies, and the 'all 33' scope signals the blast radius of an unscoped call.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, front-loaded with the action and destination, followed immediately by the one operational detail an agent needs (the default scope). No filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Output schema exists so return values need not be explained, and the mutation's safety profile is covered by annotations. The description covers cache precedence and default scope well; it could have said where specs are sourced from (network) to justify the openWorldHint, but nothing critical to correct invocation is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and the single param is optional, so the schema already carries the format example. The description's 'Omit api to refresh all 33' adds the default's practical effect (full refresh of 33 specs) which the schema's default=null does not convey.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Refresh OpenAPI specs') plus the destination ('user cache'), which is unambiguous. Sibling tools (list_endpoints, call_endpoint, download_file) serve unrelated functions, so no explicit differentiation is needed, but the description never contrasts itself with them or explains the bundled-vs-cache relationship scope beyond precedence.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'Omit api to refresh all 33' gives a clear default behavior, but there is no explicit guidance on when to use this tool versus, say, just reading bundled specs, nor any prerequisite or caution about when refreshing is unnecessary. Usage is implied rather than stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
5 tool updates
v0.4.0- First observed
call_endpoint - First observed
describe_endpoint - First observed
download_file - First observed
list_endpoints - First observed
refresh_specs
TDQS
Scored across 5 tools
Each tool has a distinct role: list (enumerate operations), describe (inspect a schema), call (execute JSON requests), download (fetch binary files), refresh (update specs). The only mild overlap is that call_endpoint and download_file both accept operation_id or api+method+path, but their output semantics (JSON response vs. binary file) are clearly separated in the descriptions.
All five tools follow a clean verb_noun snake_case pattern (list_endpoints, describe_endpoint, call_endpoint, download_file, refresh_specs). The singular/plural difference between describe_endpoint and list_endpoints is a trivial, intuitive deviation.
Five tools is a well-scoped set for a meta-API wrapper: discovery, inspection, execution, file retrieval, and cache refresh. Nothing feels redundant or missing at the count level.
The set covers the full lifecycle of an OpenAPI-driven client: enumerate operations, describe schemas to build bodies, execute authenticated calls, download binary artifacts, and refresh specs including alpha/beta endpoints absent from bundled specs. There are no obvious dead ends for the stated purpose.
Maintenance
Related MCP Connectors
Hosted Amazon Seller Central and Amazon Ads MCP server for Claude, ChatGPT, Cursor, and agents.
Hosted Amazon Seller and Vendor MCP server for Claude, ChatGPT, Cursor, Codex, Gemini, Copilot.
MCP server for building and testing AI agents with multi-model experimentation and insights.
Discover and call 10,000+ production APIs from one MCP server. Pay-per-call billing for AI agents.
Related MCP Servers
- AlicenseAqualityDmaintenanceMCP server for AI agents to manage ad campaigns across Google, Meta, LinkedIn, Microsoft, Reddit, TikTok, and more2198 npm17MIT
- AlicenseNot gradedqualityDmaintenanceAn MCP server that lets you manage a Walmart Marketplace seller account in plain language, including orders, inventory, pricing, returns, WFS fulfillment, and reports.1MIT
- AlicenseNot gradedqualityCmaintenanceA MCP server for Walmart Marketplace and Affiliate APIs, enabling sellers to manage items, inventory, prices, and orders, and consumers to search, lookup products, reviews, and store locations.18 npmMIT
- AlicenseNot gradedqualityDmaintenanceMCP server for Amazon Selling Partner API and Advertising API, enabling access to orders, inventory, pricing, ads, and reports via natural language.1MIT