
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
@striderlabs/mcp-amazon
Advanced tools
MCP server for Amazon shopping - let AI agents search products, manage cart, and place orders on Amazon via browser automation
Amazon MCP Server by Strider Labs — give AI agents the ability to search products, manage your cart, place orders, and track shipments on Amazon via browser automation.
~/.strider/amazon/ across sessionsnpm install -g @striderlabs/mcp-amazon
# Install Playwright browsers (required)
npx playwright install chromium
~/.claude/claude_desktop_config.json){
"mcpServers": {
"amazon": {
"command": "striderlabs-mcp-amazon"
}
}
}
{
"mcpServers": {
"amazon": {
"command": "npx",
"args": ["-y", "@striderlabs/mcp-amazon"]
}
}
}
| Tool | Description |
|---|---|
amazon_status | Check login status and session info |
amazon_login | Initiate login flow (returns URL + instructions) |
amazon_logout | Clear session and cookies |
amazon_search | Search products by keyword |
amazon_get_product | Get product details by ASIN or URL |
amazon_add_to_cart | Add product to cart (ASIN, URL, or query) |
amazon_view_cart | View cart contents and subtotal |
amazon_clear_cart | Remove all items from cart |
amazon_preview_order | Preview order before placing |
amazon_place_order | Place order (requires confirm=true) |
amazon_track_order | Track order by ID |
amazon_get_orders | Get order history |
amazon_prime_check | Check Prime membership status |
amazon_set_address | Set delivery address |
Search for "AirPods Pro" on Amazon
→ amazon_search({ query: "AirPods Pro", maxResults: 5 })
Add the first result to cart
→ amazon_add_to_cart({ asinOrQuery: "B0BDHWDR12", quantity: 1 })
Preview my order before placing
→ amazon_preview_order()
Place the order (user must confirm first)
→ amazon_place_order({ confirm: true })
Track order 123-4567890-1234567
→ amazon_track_order({ orderId: "123-4567890-1234567" })
Amazon requires manual login (headless browsers cannot complete Amazon's full auth flow including 2FA):
amazon_login — it returns https://www.amazon.com/ap/signinamazon_status to verify the session is detected~/.strider/amazon/cookies.json for future sessionsSession data is stored in:
~/.strider/amazon/
├── cookies.json # Browser session cookies
└── session.json # Cached session metadata
To reset: run amazon_logout or delete the ~/.strider/amazon/ directory.
amazon_place_order requires confirm: true to actually place an order:
confirm: true — returns a preview (same as amazon_preview_order)confirm: true — places the order immediatelyNever set confirm: true without explicit user consent.
Amazon has aggressive bot detection. This server includes:
If you receive a CAPTCHA error: visit amazon.com in your regular browser, complete the CAPTCHA, then retry. Cookies will be re-used in subsequent calls.
~/.strider/amazon/"CAPTCHA detected" Visit amazon.com in your browser, complete the CAPTCHA, then retry.
"Not logged in"
Run amazon_login, open the URL, log in, then run amazon_status.
"Add to Cart button not found"
The item may be sold by a third-party seller requiring seller selection, or it may be unavailable. Try amazon_get_product first to verify availability.
"Page load timed out" Check your internet connection. Amazon pages can be slow on first load.
git clone https://github.com/striderlabs/mcp-amazon
cd mcp-amazon
npm install
npx playwright install chromium
npm run build
npm start
MIT — see LICENSE
Built by Strider Labs
FAQs
MCP server for Amazon shopping - let AI agents search products, manage cart, and place orders on Amazon via browser automation
The npm package @striderlabs/mcp-amazon receives a total of 4 weekly downloads. As such, @striderlabs/mcp-amazon popularity was classified as not popular.
We found that @striderlabs/mcp-amazon demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.