limonene-mcp

# Limonene connector — v0.1.0 pilot

Read-only Amazon seller investigations through ChatGPT, Claude and compatible MCP clients.

Endpoint: `https://limonene.app/api/mcp`
Setup and permissions: https://limonene.app/connect-ai
Revoke connections: https://limonene.app/api/mcp/connections
Privacy: https://limonene.app/privacy

This is a direct-install pilot, not a claim of approval or listing in either platform's directory.

## Connection

1. Sign in to Limonene and connect an Amazon store. Complete its initial sync.
2. Add the endpoint as a custom remote connector in your AI client (account/workspace support varies).
3. Authenticate in the browser. Read the client name and callback origin, select a store and grant read-only access.
4. Ask: “Review my last seven days. What deserves investigation? Cite sources, dates, and limitations.”

Claude Code: `claude mcp add --transport http limonene https://limonene.app/api/mcp`, then use `/mcp` to authenticate.
The package includes separate OpenAI and Claude manifests referring to the same remote server; there is no local executable and no credential embedded in the package.

## Tools

- `get_store_overview`: bounded marketplace-local sales window.
- `get_open_insights`: dated existing alerts, capped at 25.
- `get_pricing_and_buybox`: cached observations for up to 20 SKUs; no price edits.
- `get_inventory_health`: FBA-only inventory, optional SKU.
- `get_sales_trend`: SKU history for 1–60 days.
- `get_profit_breakdown`: revenue/fees and available cost-coverage information; do not label fees-only figures net profit.

Buyer contacts, arbitrary API/SQL access, price/ads/listing writes and scheduled execution are not exposed.
Each grant is bound to one store and its active marketplace; reads fail closed while a different marketplace is active. To read that marketplace, reconnect.
Results use the existing capability caches and may trigger their normal background refresh. The external AI generates the answer; this connector does not run a second Limonene model call or debit chat credits.
First-party telemetry records connection, revocation, tool name, success and duration; it does not log prompts, arguments, tokens or tool results. Existing billing remains advisory under the current app policy. This release does not introduce a paid gate or promise unlimited access. Limits: 60 MCP requests/minute/store plus the existing IP ceiling.

## Privacy and security

OAuth authorization code flow with mandatory S256 PKCE and resource binding. Public clients register with `token_endpoint_auth_method: none`. Access tokens expire after one hour; refresh tokens rotate and expire after 30 days. Tokens/codes/browser nonces are stored hashed. Consent requests expire after ten minutes and codes after one minute. Ownership, connection health, revocation and marketplace are rechecked on access. Product and alert text are untrusted data.

The AI service receives the requested store results under the seller's authorization. Its own data policies apply. Revocation blocks subsequent reads, not copies already retained by that service. Account deletion removes grants and their token/code records.

## GitHub Copilot in VS Code

Copy `vscode.mcp.json` to your workspace as `.vscode/mcp.json`, then start the server from VS Code and complete the browser authorization. Your editor must support remote HTTP MCP and OAuth. This configuration is for GitHub Copilot in VS Code; it is not a Microsoft 365 Copilot marketplace listing.

## Installation package

This repository contains public connector configuration and documentation only. The hosted Limonene service is separate. No API key is required in these files; each user signs in and grants access to their own store.

A Limonene account and a connected, synchronized Amazon store are required. Availability and pricing: https://limonene.app/pricing. Do not connect a customer store for platform review; use a dedicated review account.

## Pilot status

The remote endpoint is live. SDK integration tests cover initialize, tool discovery and a read against a local test server. Full end-to-end testing inside each AI product and directory approvals are still pending. Installing this package does not imply endorsement by OpenAI, Anthropic, GitHub or Microsoft.

Support: hello@limonene.app
Setup: https://limonene.app/connect-ai
Terms: https://limonene.app/terms
Privacy: https://limonene.app/privacy

The MIT license applies only to files in this public connector package, not to the hosted service or its backend.