Skip to content
anlyon.devby Anlyon

Sellasist MCP by usefulapi

io.usefulapi/sellasistusefulapi.iostreamable-httpv1.0.0Scanned

Read Sellasist orders, products, stock, customers, invoices, returns; add order notes, set status.

27 tools: 1 can delete or cancel things, 1 change things and 25 only read.

Tools: 1 delete, 0 irreversible, 1 write, 25 read.
  • Reads private data · 6
  • Reads text others write · 27
  • Can send data out · 0
  • No findings

Anlyon alternative

2 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →
Compare with similar serversMarkdownJSONReport this listing

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

27 tools

Deletes or cancels 1Claude Code: deny
  • sellasist_update_order_statusWRITE: change the status of one order (PUT /orders/{order_id} with only the status).Reads text others writeNo findings

    Why it is in this group

    • The name "sellasist_update_order_status" says "update": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    WRITE: change the status of one order (PUT /orders/{order_id} with only the status). Sellasist may run the status's automations (emails, stock moves). By default the new status is NOT pushed to the marketplace; set send_status_to_external to true to push it. Find status ids with sellasist_list_order_statuses.

    Annotations the server declares

    • title: Change order status
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: true
Changes things 1Claude Code: ask
  • sellasist_add_order_noteWRITE: add a new note to an order.Reads text others writeNo findings

    Why it is in this group

    • The name "sellasist_add_order_note" says "add": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    WRITE: add a new note to an order. Notes are visible to the account's staff; each call adds another note (nothing is overwritten). POST /notes.

    Annotations the server declares

    • title: Add order note
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
Only reads 25Show 25 read-only tools
  • sellasist_get_categoryOne category: names per language, parent category and status.Reads text others writeNo findings

    Why it is in this group

    • The name "sellasist_get_category" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    One category: names per language, parent category and status. GET /categories/{category_id}.

    Annotations the server declares

    • title: Get category
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • sellasist_get_customerOne customer: email, registration date, billing and delivery address.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "sellasist_get_customer" says "get": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "email": it reads mail.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • untrusted-inputThe description's first sentence says "email": it reads inbound email, which other people can write.
    Description, as the server wrote it
    One customer: email, registration date, billing and delivery address. GET /users/{user_id}.

    Annotations the server declares

    • title: Get customer
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • sellasist_get_invoiceOne invoice: number, dates, seller, buyer, currency, line items (net, gross, VAT), total and paid amount.Reads text others writeNo findings

    Why it is in this group

    • The name "sellasist_get_invoice" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    One invoice: number, dates, seller, buyer, currency, line items (net, gross, VAT), total and paid amount. GET /invoices/{invoice_id}.

    Annotations the server declares

    • title: Get invoice
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • sellasist_get_orderOne order by id: status, buyer and delivery address, payment, shipment method, line items (product ids, EAN, quantities, prices), notes, waybills with tracking numbers, payments an…Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "sellasist_get_order" says "get": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "note": it reads notes.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    One order by id: status, buyer and delivery address, payment, shipment method, line items (product ids, EAN, quantities, prices), notes, waybills with tracking numbers, payments and additional fields. GET /orders/{order_id}.

    Annotations the server declares

    • title: Get order
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • sellasist_get_productOne product by id: title, category, prices, VAT, stock, sold counts, EAN, symbol, location, weight, qualities, availability, manufacturer and more.Reads text others writeNo findings

    Why it is in this group

    • The name "sellasist_get_product" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    One product by id: title, category, prices, VAT, stock, sold counts, EAN, symbol, location, weight, qualities, availability, manufacturer and more. GET /products/{product_id}.

    Annotations the server declares

    • title: Get product
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • sellasist_get_returnOne return document with status, refund and payment details, tracking, courier and the returned items.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "sellasist_get_return" says "get": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "document": it reads documents.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    One return document with status, refund and payment details, tracking, courier and the returned items. GET /returns/{id}.

    Annotations the server declares

    • title: Get return
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • sellasist_get_stockStock quantity of one product, found by id, EAN, symbol or catalog number (the first one given in that order counts); with none of them, a page of stock levels for all products.Reads text others writeNo findings

    Why it is in this group

    • The name "sellasist_get_stock" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Stock quantity of one product, found by id, EAN, symbol or catalog number (the first one given in that order counts); with none of them, a page of stock levels for all products. GET /products_stock.

    Annotations the server declares

    • title: Get stock levels
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • sellasist_list_alertsActive alerts and system messages shown on the Sellasist dashboard (type, severity, title, message).Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "sellasist_list_alerts" says "list": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "message": it reads messages.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • untrusted-inputThe description's first sentence says "message": it reads messages, which other people can write.
    Description, as the server wrote it
    Active alerts and system messages shown on the Sellasist dashboard (type, severity, title, message). GET /alerts.

    Annotations the server declares

    • title: List system alerts
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • sellasist_list_bestsellersProducts ranked by units sold in the last month (sold_last_month), with stock and price.Reads text others writeNo findings

    Why it is in this group

    • The name "sellasist_list_bestsellers" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Products ranked by units sold in the last month (sold_last_month), with stock and price. GET /products_bestsellers.

    Annotations the server declares

    • title: List bestselling products
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • sellasist_list_categoriesProduct categories.Reads text others writeNo findings

    Why it is in this group

    • The name "sellasist_list_categories" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Product categories. GET /categories.

    Annotations the server declares

    • title: List categories
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • sellasist_list_customersRegistered customers (the account's buyers).Reads text others writeNo findings

    Why it is in this group

    • The name "sellasist_list_customers" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Registered customers (the account's buyers). GET /users.

    Annotations the server declares

    • title: List customers
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • sellasist_list_integration_accountsAccounts connected in external services (id, login, type).Reads text others writeNo findings

    Why it is in this group

    • The name "sellasist_list_integration_accounts" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Accounts connected in external services (id, login, type). Only these three fields are returned. GET /external_accounts.

    Annotations the server declares

    • title: List connected marketplace accounts
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • sellasist_list_invoicesInvoices (id, number, date).Reads text others writeNo findings

    Why it is in this group

    • The name "sellasist_list_invoices" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Invoices (id, number, date). Filter by order, document series or issue date. GET /invoices.

    Annotations the server declares

    • title: List invoices
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • sellasist_list_order_logsThe audit log of order actions (create, edit, status change, delete, merge, invoice and receipt actions) with date and user id.Reads text others writeNo findings

    Why it is in this group

    • The name "sellasist_list_order_logs" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    The audit log of order actions (create, edit, status change, delete, merge, invoice and receipt actions) with date and user id. Filter by order ids, action type or date. GET /orders_logs.

    Annotations the server declares

    • title: List order change log
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • sellasist_list_order_notesNotes written on one order (author id, date, text, visibility).Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "sellasist_list_order_notes" says "list": a word for reading.

    What it can reach

    • private-dataThe name "sellasist_list_order_notes" says "list" and "note": it reads notes.
    • private-dataThe description's first sentence says "note": it reads notes.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Notes written on one order (author id, date, text, visibility). GET /notes/{order_id}.

    Annotations the server declares

    • title: List order notes
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • sellasist_list_order_sourcesOrder sources available in the account (id, name, type: Allegro, shop, marketplace...).Reads text others writeNo findings

    Why it is in this group

    • The name "sellasist_list_order_sources" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Order sources available in the account (id, name, type: Allegro, shop, marketplace...). GET /sources.

    Annotations the server declares

    • title: List order sources
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • sellasist_list_order_statusesThe order statuses configured in the account.Reads text others writeNo findings

    Why it is in this group

    • The name "sellasist_list_order_statuses" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    The order statuses configured in the account. Use the ids to filter orders or to change a status. GET /statuses.

    Annotations the server declares

    • title: List order statuses
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • sellasist_list_ordersList orders, newest first, with status, buyer billing address, payment, total, source (Allegro, eBay, Amazon, shop...) and comment.Reads text others writeNo findings

    Why it is in this group

    • The name "sellasist_list_orders" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • untrusted-inputThe description's first sentence says "list" and "comment": it reads comments, which other people can write.
    Description, as the server wrote it
    List orders, newest first, with status, buyer billing address, payment, total, source (Allegro, eBay, Amazon, shop...) and comment. Filter by status, email, name, external id, payment, source or date. Use sellasist_get_order for line items and shipments. GET /orders.

    Annotations the server declares

    • title: List orders
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • sellasist_list_payment_methodsPayment methods (id, title) for filtering orders.Reads text others writeNo findings

    Why it is in this group

    • The name "sellasist_list_payment_methods" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Payment methods (id, title) for filtering orders. GET /payments.

    Annotations the server declares

    • title: List payment methods
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • sellasist_list_productsList products with id, name, EAN, symbol, catalog number, location, price, promo price, stock quantity, reserved quantity and variants.Reads text others writeNo findings

    Why it is in this group

    • The name "sellasist_list_products" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    List products with id, name, EAN, symbol, catalog number, location, price, promo price, stock quantity, reserved quantity and variants. Filter by category, manufacturer, EAN, symbol or catalog number. GET /products.

    Annotations the server declares

    • title: List products
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • sellasist_list_returnsReturn documents (RMZ): number, status, source, linked order, refund value and tracking number.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "sellasist_list_returns" says "list": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "return" and "document": it reads documents.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Return documents (RMZ): number, status, source, linked order, refund value and tracking number. Filter by date, order, status, source or return number. GET /returns.

    Annotations the server declares

    • title: List returns
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • sellasist_list_shipment_methodsDelivery methods (id, title) for filtering orders.Reads text others writeNo findings

    Why it is in this group

    • The name "sellasist_list_shipment_methods" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Delivery methods (id, title) for filtering orders. GET /shipments.

    Annotations the server declares

    • title: List delivery methods
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • sellasist_list_warehousesWarehouses (id, title).Reads text others writeNo findings

    Why it is in this group

    • The name "sellasist_list_warehouses" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Warehouses (id, title). Needs the warehouse-management feature, otherwise Sellasist answers HTTP 406. GET /storages.

    Annotations the server declares

    • title: List warehouses
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • sellasist_list_waybillsWaybills (shipping labels) with order id, tracking number, creation and delivery date.Reads text others writeNo findings

    Why it is in this group

    • The name "sellasist_list_waybills" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Waybills (shipping labels) with order id, tracking number, creation and delivery date. Filter by order or date. Label files are not returned inline. GET /ordersshipments.

    Annotations the server declares

    • title: List waybills
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • sellasist_search_ordersFind up to 100 orders created in a date range and/or in one status (id, date, status).Reads text others writeNo findings

    Why it is in this group

    • The name "sellasist_search_orders" says "search": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Find up to 100 orders created in a date range and/or in one status (id, date, status). Read-only: it uses POST only because the criteria go in the body. POST /orders_search.

    Annotations the server declares

    • title: Search orders
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged outbound.

Reads private data6
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write27
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out0
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Findings

Matches of fixed checks, with the text they matched.

No check matched anything in these tool definitions. That is not a safety guarantee.

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 1.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http sellasist https://sellasist.usefulapi.io/mcp
claude mcp add --transport http sellasist https://sellasist.usefulapi.io/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__sellasist__sellasist_list_orders",
      "mcp__sellasist__sellasist_get_order",
      "mcp__sellasist__sellasist_search_orders",
      "mcp__sellasist__sellasist_list_order_statuses",
      "mcp__sellasist__sellasist_list_order_notes",
      "mcp__sellasist__sellasist_list_order_logs",
      "mcp__sellasist__sellasist_list_waybills",
      "mcp__sellasist__sellasist_list_products",
      "mcp__sellasist__sellasist_get_product",
      "mcp__sellasist__sellasist_get_stock",
      "mcp__sellasist__sellasist_list_bestsellers",
      "mcp__sellasist__sellasist_list_categories",
      "mcp__sellasist__sellasist_get_category",
      "mcp__sellasist__sellasist_list_warehouses",
      "mcp__sellasist__sellasist_list_customers",
      "mcp__sellasist__sellasist_get_customer",
      "mcp__sellasist__sellasist_list_invoices",
      "mcp__sellasist__sellasist_get_invoice",
      "mcp__sellasist__sellasist_list_returns",
      "mcp__sellasist__sellasist_get_return",
      "mcp__sellasist__sellasist_list_payment_methods",
      "mcp__sellasist__sellasist_list_shipment_methods",
      "mcp__sellasist__sellasist_list_order_sources",
      "mcp__sellasist__sellasist_list_integration_accounts",
      "mcp__sellasist__sellasist_list_alerts"
    ],
    "ask": [
      "mcp__sellasist__sellasist_add_order_note"
    ],
    "deny": [
      "mcp__sellasist__sellasist_update_order_status"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as sellasist. Review it before you use it.

Capability tags behind 27 rules
  • mcp__sellasist__sellasist_list_orders untrusted-input
  • mcp__sellasist__sellasist_get_order private-data, untrusted-input
  • mcp__sellasist__sellasist_search_orders untrusted-input
  • mcp__sellasist__sellasist_list_order_statuses untrusted-input
  • mcp__sellasist__sellasist_list_order_notes private-data, untrusted-input
  • mcp__sellasist__sellasist_list_order_logs untrusted-input
  • mcp__sellasist__sellasist_list_waybills untrusted-input
  • mcp__sellasist__sellasist_list_products untrusted-input
  • mcp__sellasist__sellasist_get_product untrusted-input
  • mcp__sellasist__sellasist_get_stock untrusted-input
  • mcp__sellasist__sellasist_list_bestsellers untrusted-input
  • mcp__sellasist__sellasist_list_categories untrusted-input
  • mcp__sellasist__sellasist_get_category untrusted-input
  • mcp__sellasist__sellasist_list_warehouses untrusted-input
  • mcp__sellasist__sellasist_list_customers untrusted-input
  • mcp__sellasist__sellasist_get_customer private-data, untrusted-input
  • mcp__sellasist__sellasist_list_invoices untrusted-input
  • mcp__sellasist__sellasist_get_invoice untrusted-input
  • mcp__sellasist__sellasist_list_returns private-data, untrusted-input
  • mcp__sellasist__sellasist_get_return private-data, untrusted-input
  • mcp__sellasist__sellasist_list_payment_methods untrusted-input
  • mcp__sellasist__sellasist_list_shipment_methods untrusted-input
  • mcp__sellasist__sellasist_list_order_sources untrusted-input
  • mcp__sellasist__sellasist_list_integration_accounts untrusted-input
  • mcp__sellasist__sellasist_list_alerts private-data, untrusted-input
  • mcp__sellasist__sellasist_add_order_note untrusted-input
  • mcp__sellasist__sellasist_update_order_status untrusted-input

Pin

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/io.usefulapi/sellasist/verify?hash=60ca591dbf97a741a637d3d9ab0671631d7793f67c8cb5efce8cf6a7fc3e4952" | jq -e '.changed == false'

Pinned hash 60ca591dbf97, from Oct 26, 2026, 07:18 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/io.usefulapi/sellasist/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

anlyon.dev badge for io.usefulapi/sellasist
[![anlyon.dev](https://anlyon.dev/badge/io.usefulapi/sellasist.svg)](https://anlyon.dev/servers/io.usefulapi/sellasist)

Source: MCP Registry · repository. Synced Oct 26, 2026, 07:18 UTC.