alexa-mcp

This project was developed and is maintained by AI (Claude Code). Use at your own discretion.

An MCP server for Amazon Alexa: list and control Echo speakers, Echo Shows and Fire TVs, make Alexa speak or announce, run routines, read and control the smart-home devices Alexa knows about (thermostats, lights, plugs, locks, garage doors, robot vacuums, scenes), read and edit shopping/to-do lists, and set or cancel alarms, timers and reminders.

It talks to Amazon's private Alexa web API — the one the Alexa app uses — through alexa-remote2. There is no public API for any of this, so expect occasional breakage when Amazon changes things.

Sign in once

You sign in to Amazon in your own browser; this server never sees your password.

• In a chat: ask Claude to sign in to Alexa. It calls alexa_begin_login and gives you an amazon.com link. Sign in there (password, two-step code, whatever Amazon asks), and you land on a blank www.amazon.com/ap/maplanding page. Paste that page's address back and Claude calls alexa_finish_login.

• Hosted connector: the sign-in page shows a Sign in to Amazon button and a box for that same address.

• Terminal: npx @chrischall/alexa-mcp login prints the link and reads the pasted address (--print also writes the registration as one base64 line for ALEXA_REGISTRATION; treat it as a credential).

Under the hood this is the Alexa iOS app's OAuth sign-in with PKCE. The link carries only a challenge, the matching secret stays on the server, and the code in the pasted address is single-use and expires in minutes. Finishing registers a virtual device named alexa-mcp on your account and saves the registration (refresh token plus session cookies) to ~/.alexa-mcp/registration.json (mode 0600). After that no browser is needed: cookies are re-minted from the refresh token every few days. To revoke access, remove the alexa-mcp device from your Amazon account (Manage Your Content and Devices → Devices).

Related MCP server: alexa-mcp

Tools

✋ = confirmation-gated. A client that supports prompts asks you first; elsewhere (claude.ai, Claude Desktop) the first call sends nothing and returns a preview plus a confirmToken, and only a repeat call with that token acts.

Deliberately left out:

• Free-text voice commands ("Alexa, …", the library's textCommand). They can buy things and unlock doors without going through a specific, confirm-gated tool, so no tool sends one.

Unlocking a door and opening a garage door are possible, but only through alexa_lock and alexa_garage_door, which are marked destructive and always confirmation-gated.

Vacation mode is an emulation. The Alexa app's own thermostat Vacation Mode is not reachable through the API this server uses (its thermostat modes are only HEAT / COOL / AUTO / OFF), so this does not flip the app's toggle. Instead alexa_set_vacation_mode saves each thermostat's mode and setpoints to ~/.alexa-mcp/vacation.json (mode 0600) before it changes anything, then sets heat-to 55° / cool-to 85° (or what you ask for). Thermostats that are OFF stay OFF. Turning it off restores the saved settings. Turning it on twice is refused, so the originals are never overwritten.

Configuration

When both ALEXA_REGISTRATION and the state file are present, whichever has the newer tokenDate wins, whatever device it belongs to (a tie goes to the state file, the refreshed copy). So a re-login through alexa_finish_login survives a restart even with an older ALEXA_REGISTRATION still set, and a freshly pasted ALEXA_REGISTRATION beats an old state file.

Upgrading from 0.1

0.2.0 changed how the connector signs in. The pasted ALEXA_REGISTRATION field is replaced by the browser sign-in flow (auth.flow in mint.yaml: a Sign in to Amazon link, then paste the address you land on). Existing hosted registrations must switch to the new flow: sign in once more through it. alexa-mcp login --port <n> is no longer needed: the flag is ignored with a notice, since the sign-in now happens in your own browser.

Hosting

mint.yaml describes the server to mcp-host: one child per user (identity.perUserChild), a two-step auth.flow (begin → sign in on amazon.com → paste the address), and the registration persists in each user's data dir.

Development

npm install
npm test          # typecheck + vitest (no network)
npm run build     # tsc + esbuild bundle (dist/bundle.js is the .mcpb entry)

See docs/ALEXA-API.md for the verified response shapes and hosts.