Lightspeed Retail (X-Series) MCP by usefulapi
io.usefulapi/lightspeed-x-seriesusefulapi.iostreamable-httpv1.0.0Scanned
Read Lightspeed X-Series products, stock, sales, customers, stock orders; one-call sales reports.
30 tools: 3 can delete or cancel things, 1 do something that can't be undone, 2 change things and 24 only read.
- Reads private data · 5
- Reads text others write · 4
- Can send data out · 1
- 1 finding
Anlyon alternative
6 of these tools change something. Run those as governed actions.
Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.
Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.
Import an OpenAPI spec →Tools
Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.
30 tools
Deletes or cancels 3Claude Code: deny
lightspeedxseries_set_product_stockWRITE: set the stock on hand (current_amount) and/or the reorder point and reorder amount of ONE product at ONE outlet.No findings
Why it is in this group
- The name "lightspeedxseries_set_product_stock" says "set": a word for a change.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it WRITE: set the stock on hand (current_amount) and/or the reorder point and reorder amount of ONE product at ONE outlet. current_amount is the NEW TOTAL on hand, not a change: it overwrites the count, so sales made since you last read it are lost from the count. Read get_inventory_levels first and confirm the number with the user. Other outlets and all other product fields stay as they are. PATCH /products/{product_id} (outlet_inventories).
Annotations the server declares
- title: Set product stock and reorder levels
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
lightspeedxseries_update_customerWRITE: change fields of an existing customer.No findings
Why it is in this group
- The name "lightspeedxseries_update_customer" says "update": a word for a change.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it WRITE: change fields of an existing customer. Only the fields you pass change: the tool first reads the customer and sends the vendor its full record with your changes applied (the vendor's update is a full PUT). Cannot delete a customer or change balances. Lightspeed offers no partial update for customers, so a change made by someone else in the moments between the tool's read and its write can be overwritten. PUT /customers/{customer_id}.
Annotations the server declares
- title: Update customer
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
lightspeedxseries_update_product_pricesWRITE: set the selling price of one product (variant).No findings
Why it is in this group
- The name "lightspeedxseries_update_product_prices" says "update": a word for a change.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it WRITE: set the selling price of one product (variant). Pass price_excluding_tax or price_including_tax as a decimal string such as "24.99" (set one; the store's tax setting decides which the till uses). Nothing else on the product changes. Read the product first and confirm the new price with the user. PATCH /products/{product_id}.
Annotations the server declares
- title: Update product prices
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
Can't be undone 1Claude Code: ask
lightspeedxseries_get_register_payments_summaryPayment totals by payment type for one register since it was opened (the end-of-day / cash-up view).1 finding
Why it is in this group
- The name "lightspeedxseries_get_register_payments_summary" says "get": a word for reading.
- The description's first verb is "payment": a word that usually means money moves, which cannot be taken back.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
The server marks "lightspeedxseries_get_register_payments_summary" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
What this check looks forMatched text
annotations: {"readOnlyHint":true}; The name "lightspeedxseries_get_register_payments_summary" says "get": a word for reading.
Description, as the server wrote it Payment totals by payment type for one register since it was opened (the end-of-day / cash-up view). GET /registers/{register_id}/payments_summary.
Annotations the server declares
- title: Get register payments summary
- readOnlyHint: true
Changes things 2Claude Code: ask
lightspeedxseries_create_customerWRITE: create a new customer.Can send data outNo findings
Why it is in this group
- The name "lightspeedxseries_create_customer" says "create": a word for a change.
What it can reach
- outboundThe input takes a destination (input.phone): what the tool writes goes there.
Description, as the server wrote it WRITE: create a new customer. Give at least a first name, last name or company name. Check search_customers first so you do not create a duplicate. POST /customers.
Annotations the server declares
- title: Create customer
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
lightspeedxseries_sales_summaryTotals for a period computed here from up to max_pages x page_size sales, so a report needs ONE tool call instead of dozens: sale count and net / tax / gross (tax-inclusive) totals…No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Totals for a period computed here from up to max_pages x page_size sales, so a report needs ONE tool call instead of dozens: sale count and net / tax / gross (tax-inclusive) totals, plus breakdowns by state, UTC day, outlet and payment type name, and the top products by quantity. By default only closed sales are counted (states containing 'closed'); set counted_states to change that. Dates are UTC (convert local days with the retailer's time zone). If the reply says truncated, call again with offset = next_offset and add the figures up. Uses GET /search?type=sales.
Annotations the server declares
- title: Sales summary
- readOnlyHint: true
Only reads 24Show 24 read-only tools
lightspeedxseries_get_consignmentOne consignment (stock order, transfer, stocktake or return) by id.No findings
Why it is in this group
- The name "lightspeedxseries_get_consignment" says "get": a word for reading.
Description, as the server wrote it One consignment (stock order, transfer, stocktake or return) by id. GET /consignments/{consignment_id}.
Annotations the server declares
- title: Get consignment
- readOnlyHint: true
lightspeedxseries_get_customerOne customer by id: contact details, addresses, customer group, balance, loyalty balance, year-to-date spend.Reads private dataNo findings
Why it is in this group
- The name "lightspeedxseries_get_customer" says "get": a word for reading.
What it can reach
- private-dataThe description's first sentence says "contact": it reads contacts.
Description, as the server wrote it One customer by id: contact details, addresses, customer group, balance, loyalty balance, year-to-date spend. GET /customers/{customer_id}.
Annotations the server declares
- title: Get customer
- readOnlyHint: true
lightspeedxseries_get_inventory_levelsStock on hand per product per outlet: product_id, location_id (= outlet id), current_inventory_level, reorder threshold/amount, quantity_to_procure, average cost, total cost, suppl…No findings
Why it is in this group
- The name "lightspeedxseries_get_inventory_levels" says "get": a word for reading.
Description, as the server wrote it Stock on hand per product per outlet: product_id, location_id (= outlet id), current_inventory_level, reorder threshold/amount, quantity_to_procure, average cost, total cost, supplier. Filter by outlet_ids, product_ids (or root_product_ids for variant families), supplier_ids; to_be_procured_only keeps products with a positive quantity_to_procure (the vendor's re-order suggestion, which accounts for open orders); for a plain below-reorder-point list, compare current_inventory_level with reorder_threshold yourself. Offset paging: pass next_offset to continue (null = last page). Read-only even though the vendor takes the filter as a POST body. POST /inventory_levels.
Annotations the server declares
- title: Get inventory levels
- readOnlyHint: true
lightspeedxseries_get_outletOne outlet by id.No findings
Why it is in this group
- The name "lightspeedxseries_get_outlet" says "get": a word for reading.
Description, as the server wrote it One outlet by id. GET /outlets/{outlet_id}.
Annotations the server declares
- title: Get outlet
- readOnlyHint: true
lightspeedxseries_get_productOne product (variant) by id, with its prices, codes, suppliers and outlet taxes.No findings
Why it is in this group
- The name "lightspeedxseries_get_product" says "get": a word for reading.
Description, as the server wrote it One product (variant) by id, with its prices, codes, suppliers and outlet taxes. GET /products/{product_id}.
Annotations the server declares
- title: Get product
- readOnlyHint: true
lightspeedxseries_get_retailerThe connected store: id, name, domain prefix, store URL, country, currency, time zone, tax-exclusive setting, loyalty and gift-card settings.Reads text others writeNo findings
Why it is in this group
- The name "lightspeedxseries_get_retailer" says "get": a word for reading.
What it can reach
- untrusted-inputThe description's first sentence says "url": it reads web pages, which anyone can write.
Description, as the server wrote it The connected store: id, name, domain prefix, store URL, country, currency, time zone, tax-exclusive setting, loyalty and gift-card settings. Good first call (use the time zone to turn a local day into UTC for sales searches). GET /retailer.
Annotations the server declares
- title: Get retailer
- readOnlyHint: true
lightspeedxseries_get_saleOne sale by id with its line items, payments, taxes and totals.No findings
Why it is in this group
- The name "lightspeedxseries_get_sale" says "get": a word for reading.
Description, as the server wrote it One sale by id with its line items, payments, taxes and totals. GET /sales/{sale_id}.
Annotations the server declares
- title: Get sale
- readOnlyHint: true
lightspeedxseries_get_user_sale_totalsSales totals for one staff user, as the vendor computes them (no date filter; use sales_summary for a period).No findings
Why it is in this group
- The name "lightspeedxseries_get_user_sale_totals" says "get": a word for reading.
Description, as the server wrote it Sales totals for one staff user, as the vendor computes them (no date filter; use sales_summary for a period). GET /users/{user_id}/sale_totals.
Annotations the server declares
- title: Get user sale totals
- readOnlyHint: true
lightspeedxseries_list_brandsList product brands (id, name).No findings
Why it is in this group
- The name "lightspeedxseries_list_brands" says "list": a word for reading.
Description, as the server wrote it List product brands (id, name). Paginate with next_after. GET /brands.
Annotations the server declares
- title: List brands
- readOnlyHint: true
lightspeedxseries_list_consignment_productsThe product lines of one consignment: product_id, SKU, ordered count, received quantity, cost.No findings
Why it is in this group
- The name "lightspeedxseries_list_consignment_products" says "list": a word for reading.
Description, as the server wrote it The product lines of one consignment: product_id, SKU, ordered count, received quantity, cost. Paginate with next_after (stop when data is empty). GET /consignments/{consignment_id}/products.
Annotations the server declares
- title: List consignment products
- readOnlyHint: true
lightspeedxseries_list_consignmentsList consignments: supplier stock orders (type SUPPLIER), transfers between outlets (OUTLET), stocktakes (STOCKTAKE) and returns (RETURN), with status (OPEN, SENT, DISPATCHED, RECE…No findings
Why it is in this group
- The name "lightspeedxseries_list_consignments" says "list": a word for reading.
Description, as the server wrote it List consignments: supplier stock orders (type SUPPLIER), transfers between outlets (OUTLET), stocktakes (STOCKTAKE) and returns (RETURN), with status (OPEN, SENT, DISPATCHED, RECEIVED, STOCKTAKE_*, CLOSED, CANCELLED), outlet, supplier, due and received dates, totals. Paginate with next_after. GET /consignments.
Annotations the server declares
- title: List consignments
- readOnlyHint: true
lightspeedxseries_list_customer_groupsList customer groups (id, name).No findings
Why it is in this group
- The name "lightspeedxseries_list_customer_groups" says "list": a word for reading.
Description, as the server wrote it List customer groups (id, name). Use the id as customer_group_id when creating or updating a customer. Paginate with next_after. GET /customer_groups.
Annotations the server declares
- title: List customer groups
- readOnlyHint: true
lightspeedxseries_list_customersList customers in version order: id, customer_code, name, email, phone, balance, loyalty_balance, year_to_date, customer group.Reads private dataReads text others writeNo findings
Why it is in this group
- The name "lightspeedxseries_list_customers" says "list": a word for reading.
What it can reach
- private-dataThe description's first sentence says "list" and "email": it reads mail.
- untrusted-inputThe description's first sentence says "list" and "email": it reads inbound email, which other people can write.
Description, as the server wrote it List customers in version order: id, customer_code, name, email, phone, balance, loyalty_balance, year_to_date, customer group. To find one by name or email use search_customers. Paginate with next_after (stop when data is empty). GET /customers.
Annotations the server declares
- title: List customers
- readOnlyHint: true
lightspeedxseries_list_outletsList the store's outlets (locations): id, name, address, currency, time zone, default tax.No findings
Why it is in this group
- The name "lightspeedxseries_list_outlets" says "list": a word for reading.
Description, as the server wrote it List the store's outlets (locations): id, name, address, currency, time zone, default tax. Use the outlet id to filter sales, stock and stock orders. Paginate with next_after. GET /outlets.
Annotations the server declares
- title: List outlets
- readOnlyHint: true
lightspeedxseries_list_productsList products (variants) in the catalog: id, family_id, sku, variant_name, prices (price_excluding_tax / price_including_tax), active flags, codes, suppliers, version.No findings
Why it is in this group
- The name "lightspeedxseries_list_products" says "list": a word for reading.
Description, as the server wrote it List products (variants) in the catalog: id, family_id, sku, variant_name, prices (price_excluding_tax / price_including_tax), active flags, codes, suppliers, version. The product NAME lives on the product family: add includes=["families"] to get it. Paginate with next_after (stop when data is empty). With sku set, only that SKU is looked up and the other filters are ignored. For text/brand/supplier filters use search_products; for stock use get_inventory_levels. GET /products.
Annotations the server declares
- title: List products
- readOnlyHint: true
lightspeedxseries_list_registersList registers (tills): id, name, outlet_id, is_open, open/close times and invoice numbering.No findings
Why it is in this group
- The name "lightspeedxseries_list_registers" says "list": a word for reading.
Description, as the server wrote it List registers (tills): id, name, outlet_id, is_open, open/close times and invoice numbering. Paginate with next_after. GET /registers.
Annotations the server declares
- title: List registers
- readOnlyHint: true
lightspeedxseries_list_salesSales in version order, oldest changes first: the way to sync everything that changed.No findings
Why it is in this group
- The name "lightspeedxseries_list_sales" says "list": a word for reading.
Description, as the server wrote it Sales in version order, oldest changes first: the way to sync everything that changed. It has NO date filter: for a period use search_sales or sales_summary. Each sale: id, date, invoice_number, state, customer_id, source (outlet, register, user), payments, line_items, totals. Paginate with next_after (stop when data is empty). GET /sales.
Annotations the server declares
- title: List sales
- readOnlyHint: true
lightspeedxseries_list_suppliersList suppliers: id, name, default markup and contact details.Reads private dataNo findings
Why it is in this group
- The name "lightspeedxseries_list_suppliers" says "list": a word for reading.
What it can reach
- private-dataThe description's first sentence says "list" and "contact": it reads contacts.
Description, as the server wrote it List suppliers: id, name, default markup and contact details. Paginate with next_after. GET /suppliers.
Annotations the server declares
- title: List suppliers
- readOnlyHint: true
lightspeedxseries_list_tagsList product tags (id, name).No findings
Why it is in this group
- The name "lightspeedxseries_list_tags" says "list": a word for reading.
Description, as the server wrote it List product tags (id, name). Paginate with next_after. GET /tags.
Annotations the server declares
- title: List tags
- readOnlyHint: true
lightspeedxseries_list_taxesList tax groups and their rates (id, name, is_default, rates).No findings
Why it is in this group
- The name "lightspeedxseries_list_taxes" says "list": a word for reading.
Description, as the server wrote it List tax groups and their rates (id, name, is_default, rates). The vendor returns the whole list in one reply (no cursor). GET /taxes.
Annotations the server declares
- title: List taxes
- readOnlyHint: true
lightspeedxseries_list_usersList the store's users (staff): id, username, display name, email, account type (cashier, manager, admin), enabled flag, restricted outlets.Reads private dataReads text others writeNo findings
Why it is in this group
- The name "lightspeedxseries_list_users" says "list": a word for reading.
What it can reach
- private-dataThe description's first sentence says "list" and "email": it reads mail.
- untrusted-inputThe description's first sentence says "list" and "email": it reads inbound email, which other people can write.
Description, as the server wrote it List the store's users (staff): id, username, display name, email, account type (cashier, manager, admin), enabled flag, restricted outlets. Paginate with next_after. GET /users.
Annotations the server declares
- title: List users
- readOnlyHint: true
lightspeedxseries_search_customersFind customers by email, first name, last name, company name, phone, mobile or customer code.Reads private dataReads text others writeNo findings
Why it is in this group
- The name "lightspeedxseries_search_customers" says "search": a word for reading.
What it can reach
- private-dataThe description's first sentence says "find" and "email": it reads mail.
- untrusted-inputThe description's first sentence says "find" and "email": it reads inbound email, which other people can write.
Description, as the server wrote it Find customers by email, first name, last name, company name, phone, mobile or customer code. Uses offset paging: pass next_offset to continue (null = last page). GET /search?type=customers.
Annotations the server declares
- title: Search customers
- readOnlyHint: true
lightspeedxseries_search_productsFilter products by SKU, brand, supplier, tag, product type or variant parent.No findings
Why it is in this group
- The name "lightspeedxseries_search_products" says "search": a word for reading.
Description, as the server wrote it Filter products by SKU, brand, supplier, tag, product type or variant parent. Uses offset paging: pass next_offset to continue (null = last page). GET /search?type=products.
Annotations the server declares
- title: Search products
- readOnlyHint: true
lightspeedxseries_search_salesFind sales by date range (UTC), state, outlet, register, user, customer, payment type, product or invoice number.No findings
Why it is in this group
- The name "lightspeedxseries_search_sales" says "search": a word for reading.
Description, as the server wrote it Find sales by date range (UTC), state, outlet, register, user, customer, payment type, product or invoice number. Uses offset paging: pass next_offset to continue (null = last page). Replies can be large: for totals over a period use sales_summary instead of paging through this. GET /search?type=sales.
Annotations the server declares
- title: Search sales
- readOnlyHint: true
This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.
Exfil surface
Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.
20 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 1 outbound tool breaks every one.
- Reads private data5
- Reads files, mail, messages, databases, secrets, calendars or repositories.
- Reads text others write4
- Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
- Can send data out1
- Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
{
"permissions": {
"deny": [
"mcp__lightspeed-x-series__lightspeedxseries_create_customer"
]
}
}Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.
Findings
Matches of fixed checks, with the text they matched.
The server marks "lightspeedxseries_get_register_payments_summary" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
What this check looks forMatched text
annotations: {"readOnlyHint":true}; The name "lightspeedxseries_get_register_payments_summary" says "get": a word for reading.
History
Changes to its tool definitions and to its remote endpoint, newest first.
No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.
Install
Pinned to version 1.0.0. Values in angle brackets are yours to fill in.
claude mcp add --transport http lightspeed-x-series https://lightspeed-x-series.usefulapi.io/mcpclaude mcp add --transport http lightspeed-x-series https://lightspeed-x-series.usefulapi.io/mcpRun in a terminal.
Claude Code permissions
Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.
{
"permissions": {
"allow": [
"mcp__lightspeed-x-series__lightspeedxseries_get_retailer",
"mcp__lightspeed-x-series__lightspeedxseries_list_outlets",
"mcp__lightspeed-x-series__lightspeedxseries_get_outlet",
"mcp__lightspeed-x-series__lightspeedxseries_list_registers",
"mcp__lightspeed-x-series__lightspeedxseries_list_taxes",
"mcp__lightspeed-x-series__lightspeedxseries_list_users",
"mcp__lightspeed-x-series__lightspeedxseries_get_user_sale_totals",
"mcp__lightspeed-x-series__lightspeedxseries_list_products",
"mcp__lightspeed-x-series__lightspeedxseries_get_product",
"mcp__lightspeed-x-series__lightspeedxseries_search_products",
"mcp__lightspeed-x-series__lightspeedxseries_get_inventory_levels",
"mcp__lightspeed-x-series__lightspeedxseries_list_brands",
"mcp__lightspeed-x-series__lightspeedxseries_list_tags",
"mcp__lightspeed-x-series__lightspeedxseries_list_suppliers",
"mcp__lightspeed-x-series__lightspeedxseries_list_consignments",
"mcp__lightspeed-x-series__lightspeedxseries_get_consignment",
"mcp__lightspeed-x-series__lightspeedxseries_list_consignment_products",
"mcp__lightspeed-x-series__lightspeedxseries_list_sales",
"mcp__lightspeed-x-series__lightspeedxseries_get_sale",
"mcp__lightspeed-x-series__lightspeedxseries_search_sales",
"mcp__lightspeed-x-series__lightspeedxseries_list_customers",
"mcp__lightspeed-x-series__lightspeedxseries_search_customers",
"mcp__lightspeed-x-series__lightspeedxseries_get_customer",
"mcp__lightspeed-x-series__lightspeedxseries_list_customer_groups"
],
"ask": [
"mcp__lightspeed-x-series__lightspeedxseries_get_register_payments_summary",
"mcp__lightspeed-x-series__lightspeedxseries_sales_summary",
"mcp__lightspeed-x-series__lightspeedxseries_create_customer"
],
"deny": [
"mcp__lightspeed-x-series__lightspeedxseries_update_customer",
"mcp__lightspeed-x-series__lightspeedxseries_update_product_prices",
"mcp__lightspeed-x-series__lightspeedxseries_set_product_stock"
]
}
}Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as lightspeed-x-series. Review it before you use it.
Capability tags behind 7 rules
- mcp__lightspeed-x-series__lightspeedxseries_get_retailer untrusted-input
- mcp__lightspeed-x-series__lightspeedxseries_list_users private-data, untrusted-input
- mcp__lightspeed-x-series__lightspeedxseries_list_suppliers private-data
- mcp__lightspeed-x-series__lightspeedxseries_list_customers private-data, untrusted-input
- mcp__lightspeed-x-series__lightspeedxseries_search_customers private-data, untrusted-input
- mcp__lightspeed-x-series__lightspeedxseries_get_customer private-data
- mcp__lightspeed-x-series__lightspeedxseries_create_customer outbound
Pin
Keep the decision: fail CI when the tools change, follow every change, or show a badge.
Pin in CI
Fail a build when the tools you reviewed are not the tools the server serves today.
curl -s "https://anlyon.dev/api/v1/servers/io.usefulapi/lightspeed-x-series/verify?hash=025b64b70e8e406aefa9baa30ca7cb4667ce4e9eee6b57c0a0447e60f4aeb4f4" | jq -e '.changed == false'Pinned hash 025b64b70e8e, from Oct 23, 2026, 12:18 UTC.
Watch
Get told when its tools change: a new tool, a new description, a new class.
https://anlyon.dev/servers/io.usefulapi/lightspeed-x-series/changes.xmlAn Atom feed. Works in any feed reader or Slack's RSS app.
Badge
[](https://anlyon.dev/servers/io.usefulapi/lightspeed-x-series)Source: MCP Registry · repository. Synced Oct 23, 2026, 12:18 UTC.