Skip to main content
Glama
alyiox

mcp-walmart-ads

Walmart APIs

CI PyPI Python 3.13+ License: MIT

MCP server for three Walmart Inc. API families, behind one tool surface:

Platform

APIs

Auth

walmart:adsWalmart Connect

Sponsored Products, Display

RSA-SHA256 signature + bearer token

walmart:marketplaceWalmart Marketplace

28 domains (orders, items, feeds, reports, …)

OAuth2 client_credentials

samsclub:adsSam's Club

Sponsored Products

RSA-SHA256 signature + bearer token

Five tools over 31 apis and 424 operations:

walmart:ads:sponsored-products:SBAProfileUpdateV2
└─ retailer ─┘└ line ┘└─── api name ───┘└── operationId ──┘
   └────────── platform ─────────┘  credentials attach here

Spec-driven discovery (list_endpoints, describe_endpoint), a generic API proxy (call_endpoint), a downloader (download_file), and a runtime spec refresher (refresh_specs). The agent discovers endpoints from bundled OpenAPI specs and calls them; the server handles signing, token acquisition, and header construction.

Features

  • Hierarchical api ids<retailer>:<line>:<name>, e.g. walmart:ads:sponsored-products, walmart:marketplace:order-management, samsclub:ads:sponsored-products. An operation id appends :operationId. Credentials attach at the two-segment prefix, so an operation id alone resolves to a host and an auth model without the caller naming either

  • One naming convention, two retailers — apis whose <line>:<name> suffix matches cover the same surface for different retailers (walmart:ads:sponsored-products and samsclub:ads:sponsored-products), so an agent can move what it knows across; the overlap is partial, 13 shared operation ids of 90

  • Spec-driven discovery — list/describe endpoints from 33 bundled OpenAPI specs, refreshable at runtime; describe_endpoint returns an operation plus its full components.schemas closure and strips the headers the server owns

  • Any endpoint — call by operation id or raw method+path; raw paths reach alpha/beta/unpublished endpoints absent from the specs

  • Both auth models — per-request RSA-SHA256 signing for the ads platforms; OAuth2 token acquisition with per-credential caching, single-flight refresh, and one retry after a 401 for Marketplace

  • Per-platform config isolation — a malformed block for one platform does not stop the others loading, and discovery works with no credentials at all

  • Credential-safe cURL — every cached cURL replaces bearer tokens, access tokens, and signatures with placeholders

  • Large responses truncated, with the full body available at an MCP resource URI

Related MCP server: walmart-marketplace-mcp

Requirements

  • Python 3.13+

  • Credentials for whichever platforms you use:

    • Walmart Connect / Sam's Club — consumer ID, RSA key pair, bearer token

    • Walmart Marketplace — client ID + secret, and the advertiser (seller profile) ids they serve

Quick start

Set up your config (see Configuration), then run the server:

# Run directly with uvx (no clone needed)
npx -y @modelcontextprotocol/inspector@latest uvx mcp-walmart-ads
# Or run from source
git clone https://github.com/alyiox/mcp-walmart-ads.git
cd mcp-walmart-ads
uv sync
npx -y @modelcontextprotocol/inspector@latest uv run mcp-walmart-ads

Configuration

The config file lives under your home directory at ~/.config/mcp-walmart-ads/config.json.

Windows note: ~ maps to %USERPROFILE% (typically C:\Users\<you>), so the full path is %USERPROFILE%\.config\mcp-walmart-ads\config.json.

1. Create the config directory and copy the example

# Unix-like (macOS, Linux, WSL, …)
mkdir -p ~/.config/mcp-walmart-ads/keys/walmart-ads
cp config.example.json ~/.config/mcp-walmart-ads/config.json
# Windows (PowerShell)
New-Item -ItemType Directory -Force "$env:USERPROFILE\.config\mcp-walmart-ads\keys\walmart-ads"
Copy-Item config.example.json "$env:USERPROFILE\.config\mcp-walmart-ads\config.json"

2. Fill in your credentials. Configure only the platforms you use — an absent platform is simply unconfigured, and the discovery tools keep working regardless.

Shape

platforms.<platform>.regions.<region>.<environment> = <auth block>

<platform> is the two-segment prefix an api id starts with, so a config key is literally the value you pass as the platform tool parameter — nothing to translate.

The auth block's shape follows the platform's auth model. There is exactly one shape per platform, so no discriminator field is needed.

Signature platforms (walmart:ads, samsclub:ads):

{
  "platforms": {
    "walmart:ads": {
      "regions": {
        "us": {
          "production": {
            "consumer_id": "your-consumer-id",
            "private_key": "./keys/walmart-ads/us-prod.pem",
            "private_key_version": "1",
            "bearer_token": "your-bearer-token",
            "base_urls": {
              "sponsored-products": "https://developer.api.walmart.com/api-proxy/service/WPA/Api/v1",
              "display": "https://developer.api.walmart.com/api-proxy/service/display/api/v1"
            }
          }
        }
      }
    }
  }
}

Field

Notes

consumer_id

Partner Network consumer ID

private_key

Path to the RSA private key (PEM); relative paths resolve against the config directory

private_key_version

Key version string (default "1")

bearer_token

OAuth bearer token

base_urls.<api>

One per api in the platform's discovery surface. Keys may be bare (sponsored-products) or fully qualified (walmart:ads:sponsored-products). Extra keys are allowed for the auxiliary specs reached by raw method+path

Environment names are free-form for these platforms — Walmart may issue a tenant only production, or production + staging.

OAuth2 platform (walmart:marketplace):

{
  "platforms": {
    "walmart:marketplace": {
      "regions": {
        "us": {
          "production": {
            "credentials": [
              {
                "client_id": "your-client-id",
                "client_secret": "your-client-secret",
                "advertisers": [
                  { "id": 7060158, "partner_id": "10001234" },
                  { "id": 7060159 }
                ]
              }
            ]
          }
        }
      }
    }
  }
}

Advertiser ids nest under the credential that serves them, so a secret appears exactly once and a dangling advertiser reference is structurally impossible. partner_id is per-seller because two payments operations require it as WM_PARTNER_ID; an all-zero value is read as absent, since that is what a generated config writes for a seller without one. scripts/backfill_partner_ids.py fills the absent ones from Walmart. Base URLs are fixed by the server and absent from the file; environment must be production or sandbox.

Regions are a namespace, not a route — for walmart:marketplace every region reaches the same hosts. The level exists because advertiser ids are only unique within a region.

Splitting the config

A populated walmart:marketplace block can be tens of kilobytes of credentials — 88% of the file here — and a stray comma while editing it takes down every platform, because a parse failure happens before any per-platform validation. So platforms may live in drop-in files under config.d/, merged over the base:

~/.config/mcp-walmart-ads/
├── config.json                  # server-wide settings, and any platforms you like
├── config.d/
│   ├── walmart-marketplace.json # only a "platforms" object
│   └── samsclub-ads.json
└── keys/
  • A drop-in may declare only platforms; server-wide settings stay in config.json.

  • A platform declared in two files is an error naming both — never silent precedence.

  • Only *.json directly in config.d/ is read, so .bak and editor swap files are ignored.

  • A file that fails to parse costs only its own platforms; the rest keep working.

  • Relative private_key paths resolve against config.json's directory either way, so moving a platform into config.d/ needs no path edits.

  • No config.d/ directory means no change in behavior.

Read wmt://platforms to see which platforms loaded and what regions and environments they declare. A platform that failed to load has no regions; reading one of its environments returns the loader's own message — which file, which fields, and that a fix needs a restart.

The config is read once at startup. A corrected file needs the server restarted.

Top-level options

Field

Default

Notes

response_cache_ttl

3600

Seconds a truncated body or download stays readable at its resource URI

truncate_threshold

2048

Response bytes returned inline before truncating to a preview

Market → tenant (wap-tenant-id)

Pass tenant on call_endpoint / download_file for non-US walmart:ads markets (e.g. WMT_CA, WMT_MX, WBD_OD). Omit for US and for walmart:marketplace.

Tools

list_endpoints

List operations across every api, with optional filters.

Parameter

Notes

query

Case-insensitive substring on operation id, path, or summary

api

Limit to one api, e.g. walmart:marketplace:order-management

platform

Limit to one platform — walmart:ads, walmart:marketplace, samsclub:ads (schema enum)

tag

Filter by OpenAPI tag

method

Filter by HTTP verb — GET, POST, PUT, PATCH, DELETE (schema enum)

Returned operation ids are qualified (api:operationId) and can be passed straight to describe_endpoint or call_endpoint.

describe_endpoint

One operation plus every components.schemas entry reachable from it, so request bodies can be built without the full spec. Server-managed auth and QoS headers are omitted.

Parameter

Notes

operation_id

Qualified (api:operationId) or bare when unambiguous

api

Api to resolve a bare id in, e.g. walmart:ads:sponsored-products

call_endpoint

Execute an authenticated request against any configured platform.

Parameter

Notes

region, environment

Required. Src: config

operation_id

Qualified or bare. Resolves api, platform, method, path, and required headers

api

Required with raw method + path; otherwise inferred from operation_id. Accepts the two auxiliary walmart:ads specs

method, path

Raw route, reaching endpoints absent from the specs

path_params

Values for {placeholders} in the path

params, body

Query string and JSON body

file_path

Send the file as multipart/form-data — Marketplace feed uploads. Pair with the feedType query parameter

advertiser_id

Required on walmart:marketplace, where it selects the credential. Optional on the ads platforms, where it is sent as X-Advertiser-ID

tenant

WAP tenant for non-US walmart:ads regions

download_file

Download a report, label, or snapshot from an authenticated endpoint. Give a full url (e.g. the details URL from a display snapshot poll), or operation_id, or api with method + path.

With dest_path the bytes are written there. Without it they are gunzipped when gzipped and cached, and the result carries cached_at — a binary payload with no dest_path asks for one instead. Redirects are followed, keeping auth headers on a relative or same-host Location and dropping credentials cross-host; the result includes urls, the hop path. platform is required only when downloading from a bare url.

refresh_specs

Re-fetch bundled specs into a user cache that then takes precedence over the bundled copies. Pass api to refresh one — e.g. walmart:marketplace:order-management — or omit to refresh all 33, the two auxiliary walmart:ads specs included.

MCP resources

Resource URI

Description

wmt://platforms

Every platform, its auth model, and the regions and environments it declares

wmt://platforms/{platform}/apis

That platform's api ids

wmt://platforms/{platform}/apis/{name}

One api: title, version, operation count, and its tags with a count each — the legal list_endpoints(tag=…) values

wmt://platforms/walmart:marketplace/regions/{region}/{environment}/advertisers

Advertiser ids mapped to their Walmart Partner ID (null when unset)

wmt://platforms/{platform}/regions/{region}/{environment}/hosts

Api ids mapped to the base URL a call reaches, or * for every api whose host the server owns

wmt://responses/{request_id}

Full body of a truncated response or a cached download (in memory, TTL from config)

wmt://curl/{request_id}

Reproducible cURL for a previous request, credentials replaced with placeholders

MCP host examples

Cursor

Add to .cursor/mcp.json:

{
  "mcpServers": {
    "walmart": {
      "command": "uvx",
      "args": ["mcp-walmart-ads"]
    }
  }
}

Claude Code

Add to your Claude Code MCP config:

{
  "mcpServers": {
    "walmart": {
      "command": "uvx",
      "args": ["mcp-walmart-ads"]
    }
  }
}

Codex

[mcp_servers.walmart]
command = "uvx"
args = ["mcp-walmart-ads"]

OpenCode

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "walmart": {
      "type": "local",
      "enabled": true,
      "command": ["uvx", "mcp-walmart-ads"]
    }
  }
}

GitHub Copilot

{
  "inputs": [],
  "servers": {
    "walmart": {
      "type": "stdio",
      "command": "uvx",
      "args": ["mcp-walmart-ads"]
    }
  }
}

Where the specs come from

Walmart publishes no OpenAPI files, but each ReadMe reference page hydrates its HTML with the registry UUIDs of its documents, and https://dash.readme.com/api/v1/api-registry/<uuid> serves the full spec unauthenticated. That covers Walmart Connect and all 28 Marketplace domains. Sam's Club publishes neither, so its spec is hand-authored from the developer docs; scripts/build_samsclub_spec.py regenerates a candidate from those docs and the scheduled spec drift workflow opens a PR when they change, as a human review gate. The candidate is never shipped and never loaded at runtime.

Specs are stored verbatim as upstream served them, so a refresh diff shows exactly what changed; oversized inline examples and x-readme metadata are stripped on load rather than on disk.

# Rebuild the bundled specs (registry-sourced only, by default)
uv run python scripts/fetch_specs.py
uv run python scripts/fetch_specs.py walmart:ads:sponsored-products walmart:marketplace:order-management

# Regenerate the Sam's Club candidate spec for review
uv run --group spec-build python scripts/build_samsclub_spec.py

Development

uv sync --group dev
uv run ruff check src/ tests/ scripts/
uv run ruff format --check src/ tests/ scripts/
uv run pyright
uv run pytest tests/ -v

Contributing

Issues and pull requests are welcome. Please keep changes focused and make sure ruff check, ruff format --check, pyright, and pytest all pass.

License

MIT — see LICENSE.

Available Tools

5 tools
call_endpointA
Destructive

[Walmart] Execute an authenticated API request. Identify the endpoint by operation_id, or by method + path with an api — a raw path also reaches alpha/beta/unpublished endpoints absent from the bundled specs. Auth, signature, market, and correlation headers are added by the server. A body over the configured threshold is truncated to a preview; read the returned cached_at resource for the whole of it.

ParametersJSON Schema
NameRequiredDescriptionDefault
apiNoApi to call, e.g. walmart:marketplace:order-management. Required with raw method+path; otherwise inferred from operation_id. Src: platforms.
bodyNoJSON request body for POST/PUT/PATCH — an object, or an array of objects where the API takes a batch.
pathNoAPI path after the base URL, e.g. /v3/orders or /api/v1/campaigns. Required unless operation_id is given.
methodNoHTTP method. Required unless operation_id is given.
paramsNoQuery string parameters as a JSON object.
regionYesRegion label, e.g. us. Src: platforms.
tenantNoWAP tenant for non-US walmart:ads regions, e.g. WMT_CA, WMT_MX, WBD_OD. Omit for US and for walmart:marketplace. Sent as wap-tenant-id.
file_pathNoLocal file to send as multipart/form-data instead of a JSON body — Marketplace feed uploads. Pair with the feedType query parameter.
environmentYesTarget environment. walmart:marketplace accepts production or sandbox; the ads platforms accept whatever the config declares, usually production or staging. Src: platforms.
path_paramsNoValues for {placeholders} in the path, e.g. {"purchaseOrderId": "1796277083022"}.
operation_idNoOperation id, qualified as api:operationId (e.g. walmart:ads:sponsored-products:SBAProfileUpdateV2) or bare when unambiguous. Resolves the api, platform, method, path, and required headers. Src: operations.
advertiser_idNoRequired on walmart:marketplace, where it selects the credential to act as. On the ads platforms it is optional and sent as X-Advertiser-ID, which many display/creative/campaign endpoints require. Src: platforms.

Output Schema

ParametersJSON Schema
NameRequiredDescription
bodyNo
curlNo
errorNo
cached_atNo
truncatedNo
status_codeNo

TDQS

A3.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare destructiveHint=true/openWorldHint=true, but the description adds real behavioral context beyond them: the server injects auth, signature, market, and correlation headers, and large bodies are truncated to a preview with the full payload available via the returned cached_at resource. That truncation and header-handling disclosure is genuinely useful and not present in the structured metadata.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Purpose is front-loaded in the first clause, and each subsequent sentence carries distinct information (identification modes, header injection, body truncation). It is dense but earns its length; no filler sentences.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 12-parameter tool with an output schema, the description covers the critical behaviors an agent needs: how to identify the endpoint, that auth is handled server-side, and how oversized bodies are returned. Return values themselves need not be explained given the output schema, though it could say more about the relationship to sibling discovery tools.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3, and each parameter is already documented in the schema. The description still adds meaning on top — the operation_id vs method+path+api interaction and the fact that a raw path reaches endpoints absent from the bundled specs — which goes beyond restating the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description gives a specific verb and resource — 'Execute an authenticated API request' — with the concrete identification modes (operation_id, or method + path with an api). This distinguishes it in practice from list_endpoints/describe_endpoint, though it never names a sibling explicitly, so it stops short of a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explains the two ways to identify an endpoint and notes that a raw path reaches alpha/beta/unpublished endpoints, which is useful context. However, it never states when to prefer this tool over describe_endpoint or list_endpoints, nor any prerequisite workflow (e.g. resolve operation_id first), leaving usage implied rather than explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

describe_endpointA
Read-only

[Walmart] Describe one OpenAPI operation. Returns it with every components.schemas entry reachable from it, so a request body can be built without the full spec.

ParametersJSON Schema
NameRequiredDescriptionDefault
apiNoApi to resolve a bare operation_id in, e.g. walmart:ads:sponsored-products. Src: platforms.
operation_idYesOperation id, qualified as api:operationId (e.g. walmart:marketplace:order-management:getAllOrders) or bare when unambiguous. Src: operations.

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and openWorldHint=false, so safety is covered. The description still adds real behavioral context the annotations cannot: that the result carries the full transitive schema closure rather than a shallow operation record, which is the key trait an agent needs to trust it for request-body construction. It omits error/not-found behavior for an unresolvable operation_id.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, zero filler, and the payload guarantee is front-loaded right after the purpose. Nothing repeats the name or the annotations.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return structure need not be restated, and the description covers purpose, scope and the semantic completeness of the result. The remaining gap is routing guidance against list_endpoints and any failure mode for ambiguous or unknown operation_ids.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%: the schema already explains the qualified vs bare operation_id form and the api fallback for disambiguation. The description adds nothing about either parameter, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

"Describe one OpenAPI operation" states a specific verb and a tightly scoped resource, and the second sentence pins down exactly what the response includes (the operation plus every transitively reachable components.schemas entry). An agent can distinguish this from list_endpoints (enumerate many) and call_endpoint (invoke) without opening any schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase "so a request body can be built without the full spec" implies the workflow position (inspect before composing/calling), but the description never explicitly says when to use this versus list_endpoints or call_endpoint, nor when not to use it. Usage is inferable rather than stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

download_fileA
Idempotent

[Walmart] Download a report, label, or snapshot. Give a full url — such as the details URL from a display snapshot poll, or a Marketplace report url — or an operation_id, or an api with method and path. Written to dest_path when given, otherwise gunzipped and cached. Redirects are followed for you.

ParametersJSON Schema
NameRequiredDescriptionDefault
apiNoApi to call when using method+path. Src: platforms.
urlNoAbsolute URL to fetch, e.g. a snapshot or report URL returned by a previous call.
pathNoAPI path when not using url.
methodNoHTTP method when using path. Defaults to GET.
paramsNoQuery string parameters as a JSON object.
regionYesRegion label, e.g. us. Src: platforms.
tenantNoWAP tenant for non-US walmart:ads regions. Sent as wap-tenant-id.
platformNoPlatform to authenticate as. Required with a bare url; otherwise inferred from operation_id or api. Src: platforms.
dest_pathNoLocal path to write the bytes to. Omit to gunzip and cache the payload instead, readable at the returned cached_at resource.
environmentYesTarget environment. walmart:marketplace accepts production or sandbox; the ads platforms accept whatever the config declares, usually production or staging. Src: platforms.
path_paramsNoValues for {placeholders} in path.
operation_idNoOperation id, qualified or bare. Src: operations.
advertiser_idNoRequired on walmart:marketplace (selects the credential) and by display snapshot downloads, where it is sent as X-Advertiser-ID and as the advertiserId query parameter. Src: platforms.

Output Schema

ParametersJSON Schema
NameRequiredDescription
pathNo
urlsNo
errorNo
cached_atNo
size_bytesNo
status_codeNo
content_typeNo
bytes_writtenNo

TDQS

A3.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations (readOnlyHint=false, idempotentHint=true, destructiveHint=false) leave the mutation oddity unexplained, and the description resolves it by disclosing the actual behavior: bytes are written to dest_path when given, otherwise gunzipped and cached, with redirects followed automatically. It stops short of stating auth/permission requirements, which the schema carries instead.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three tight sentences, front-loaded with the verb and resource, then the input modes, then the output behavior. No filler; only minor loss for packing several clauses into the middle sentence.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 13-parameter tool with an output schema (so return values need no explanation), the description covers the targeting modes and the write-vs-cache outcome adequately. The remaining gap is the absence of sibling routing against call_endpoint.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is already 100%, so the baseline is 3, but the description adds real meaning by showing the three mutually exclusive targeting modes (url vs operation_id vs api+method+path) and giving concrete examples of the URLs that work. It does not add syntax detail for params/tenant/path_params beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: 'Download a report, label, or snapshot', with the scope prefixed by '[Walmart]'. It is clear what the tool fetches, but it never distinguishes itself from the sibling call_endpoint, which likely also retrieves remote data.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explains the three input modes (full url, operation_id, or api with method and path) which implies usage, but gives no explicit when-to-use/when-not guidance and never names call_endpoint or any sibling as the alternative for a given case.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_endpointsA
Read-only

[Walmart] List OpenAPI operations across every api. Returned operation ids can be passed straight to describe_endpoint or call_endpoint.

ParametersJSON Schema
NameRequiredDescriptionDefault
apiNoLimit to one api, e.g. walmart:marketplace:order-management. A platform prefix is not accepted here — use platform for that. Src: platforms.
tagNoFilter to operations whose OpenAPI tags include this value.
limitNoRows to return from offset. The largest single api has 87.
queryNoCase-insensitive substring match on operation id, path, or summary.
methodNoFilter by HTTP verb.
offsetNoRows to skip. Pass next_offset from a prior call.
platformNoLimit to one platform. Src: platforms.

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and openWorldHint=false, so the safety profile is covered. The description adds useful workflow context (ids are reusable downstream) but says nothing about pagination behavior or result shape beyond what the schema/output schema provide, so it adds only modest value over structured data.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences, front-loaded with the resource and scope, followed immediately by the actionable handoff. Zero filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema, full annotation coverage, and 100%-documented parameters, the description only needs to establish purpose and workflow, which it does. A mention of pagination or that filtering is available would make it fully self-sufficient, but nothing critical is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and every parameter (api, tag, limit, offset, query, method, platform) is documented in the schema itself, including the platform-vs-api distinction and offset chaining. The description adds no parameter-level meaning, so the baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('List OpenAPI operations') plus default scope ('across every api'). It names the downstream siblings describe_endpoint and call_endpoint, which helps situate it, though it doesn't contrast against them as alternatives (e.g. vs. refresh_specs or download_file).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Clearly signals the discovery-first workflow: returned operation ids 'can be passed straight to describe_endpoint or call_endpoint.' That gives an agent a concrete reason to call this before those tools, but there are no explicit exclusions or when-not-to-use conditions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

refresh_specsA
Idempotent

[Walmart] Refresh OpenAPI specs into the user cache, which then takes precedence over the bundled copies. Omit api to refresh all 33.

ParametersJSON Schema
NameRequiredDescriptionDefault
apiNoRefresh only this api, e.g. walmart:marketplace:order-management. The two auxiliary walmart:ads specs are valid here. Src: platforms.

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A3.9/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare non-read-only, idempotent, non-destructive, open-world behavior, so the bar is lower. The description still adds genuinely useful context beyond the annotations: the refreshed specs land in a user cache that takes precedence over bundled copies, and the 'all 33' scope signals the blast radius of an unscoped call.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences, front-loaded with the action and destination, followed immediately by the one operational detail an agent needs (the default scope). No filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Output schema exists so return values need not be explained, and the mutation's safety profile is covered by annotations. The description covers cache precedence and default scope well; it could have said where specs are sourced from (network) to justify the openWorldHint, but nothing critical to correct invocation is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and the single param is optional, so the schema already carries the format example. The description's 'Omit api to refresh all 33' adds the default's practical effect (full refresh of 33 specs) which the schema's default=null does not convey.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Refresh OpenAPI specs') plus the destination ('user cache'), which is unambiguous. Sibling tools (list_endpoints, call_endpoint, download_file) serve unrelated functions, so no explicit differentiation is needed, but the description never contrasts itself with them or explains the bundled-vs-cache relationship scope beyond precedence.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'Omit api to refresh all 33' gives a clear default behavior, but there is no explicit guidance on when to use this tool versus, say, just reading bundled specs, nor any prerequisite or caution about when refreshing is unnecessary. Usage is implied rather than stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 5 tool updatesv0.4.0
    • First observedcall_endpoint
    • First observeddescribe_endpoint
    • First observeddownload_file
    • First observedlist_endpoints
    • First observedrefresh_specs

TDQS

A4.2/5.0

Scored across 5 tools

Disambiguation4/5

Each tool has a distinct role: list (enumerate operations), describe (inspect a schema), call (execute JSON requests), download (fetch binary files), refresh (update specs). The only mild overlap is that call_endpoint and download_file both accept operation_id or api+method+path, but their output semantics (JSON response vs. binary file) are clearly separated in the descriptions.

Naming Consistency5/5

All five tools follow a clean verb_noun snake_case pattern (list_endpoints, describe_endpoint, call_endpoint, download_file, refresh_specs). The singular/plural difference between describe_endpoint and list_endpoints is a trivial, intuitive deviation.

Tool Count5/5

Five tools is a well-scoped set for a meta-API wrapper: discovery, inspection, execution, file retrieval, and cache refresh. Nothing feels redundant or missing at the count level.

Completeness5/5

The set covers the full lifecycle of an OpenAPI-driven client: enumerate operations, describe schemas to build bodies, execute authenticated calls, download binary artifacts, and refresh specs including alpha/beta endpoints absent from bundled specs. There are no obvious dead ends for the stated purpose.

Maintenance

ActivityActive
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    D
    maintenance
    An MCP server that lets you manage a Walmart Marketplace seller account in plain language, including orders, inventory, pricing, returns, WFS fulfillment, and reports.
    MIT
  • A
    license
    Not graded
    quality
    C
    maintenance
    A MCP server for Walmart Marketplace and Affiliate APIs, enabling sellers to manage items, inventory, prices, and orders, and consumers to search, lookup products, reviews, and store locations.
    12
    MIT
  • A
    license
    Not graded
    quality
    C
    maintenance
    MCP server for Amazon Selling Partner API and Advertising API, enabling access to orders, inventory, pricing, ads, and reports via natural language.
    1
    MIT