Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

Ecommerce Leads

REMOTE · GETECOMMERCELEADS.COM

Ecommerce store metrics by domain: revenue, ad spend, traffic. Log in to search 600k+ stores.

67 Trust /100

Last scanned (6 hours ago)

Scores higher than 53% of remote servers

Reachable. Last reached 5 Nov 2026.

Category E-commerce

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →

Endpoint Security63
Transport & Reachability100
Schema Quality & AI Usability75
  • AI-judged instruction clarity (good).Pass
  • Tool/resource definitions use about 2181 tokens (~103/item across 21 items; 21 tools + 0 resources), lean.Pass
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management3
  • Stability observed for 1 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage98
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 94% of tool parameters carry a description.Partial
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • All 4 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
  • An AI judge read all 22 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 5 Nov 26 0
    • Stability: unverified → 0.03 ▲ functional
  • 4 Nov 26 67

    First indexed and scored.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 5 Nov 2026 · Probed https://getecommerceleads.com/api/mcp

TLS valid

Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .

Subject Issuer Valid from Valid until Key Signature Serial
CN=getecommerceleads.com CN=YE2,O=Let's Encrypt,C=US 3 Nov 2026 1 Feb 2027 ECDSA 256 ECDSA-SHA384 547482de3bb16fd1021424e19671957a0ea
SANs: getecommerceleads.com, www.getecommerceleads.com
CN=YE2,O=Let's Encrypt,C=US (CA) CN=Root YE,O=ISRG,C=US 3 Sept 2025 2 Sept 2028 ECDSA 384 ECDSA-SHA384 4df3b15dd6c0784c507cd37b58e6f115
CN=Root YE,O=ISRG,C=US (CA) CN=ISRG Root X2,O=Internet Security Research Group,C=US 13 May 2026 2 Sept 2032 ECDSA 384 ECDSA-SHA384 872165fc34b6e5fba8add5b3705fb53a
CN=ISRG Root X2,O=Internet Security Research Group,C=US (CA) CN=ISRG Root X1,O=Internet Security Research Group,C=US 13 May 2026 2 Sept 2032 ECDSA 384 SHA256-RSA 6c8f1dc727c7117f7baf853ac980f9cd

Background: What to check on a remote MCP endpoint →

DNSSEC insecure

Validation of getecommerceleads.com. — Not signed

Zone DS Keys Algorithms Outcome
. trust_anchor 20326, 38696 8, 8 Verified
com. present 19718 13 Verified
getecommerceleads.com. absent Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation
Authentication No authorisation required

The endpoint answered without asking for a token. Anyone who knows the URL can reach it.

Result No authorisation required
HTTP status 200
Header Value
strict-transport-security max-age=31536000; includeSubDomains
content-security-policy default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://plausible.io https://www.googletagmanager.com https://www.google.com https://www.gstatic.com https://airtable.com https://www.youtube.com https://cdn.jsdelivr.net https://js.stripe.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://airtable.com https://www.youtube.com; font-src 'self' https://fonts.gstatic.com data:; img-src 'self' data: https://www.google-analytics.com https://plausible.io https://fonts.gstatic.com https://startupfa.me https://www.google.com https://pagead2.googlesyndication.com https://airtable.com https://www.youtube.com; connect-src 'self' https://plausible.io https://www.google.com https://www.gstatic.com https://pagead2.googlesyndication.com https://airtable.com https://www.youtube.com https://cdn.jsdelivr.net; frame-ancestors 'self'; frame-src 'self' https://www.google.com https://www.gstatic.com https://www.googletagmanager.com https://airtable.com https://www.youtube.com https://checko
x-content-type-options nosniff
x-frame-options SAMEORIGIN
referrer-policy strict-origin-when-cross-origin
permissions-policy geolocation=(), microphone=(), camera=()

Background: How OAuth 2.1 works in the 2026 MCP spec →

Transports 2 probes
Transport URL Outcome Status Location
streamable-http https://getecommerceleads.com/api/mcp Verified 200
http (plaintext) http://getecommerceleads.com/api/mcp HTTPS enforced 301 https://getecommerceleads.com/api/mcp.php
MCP tools · 21 exposed · ~2,124 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
addToWatchlist ~144

Add domains to a watchlist (merge, nothing is removed). THIS SPENDS CREDITS: 1 credit per domain that is new to the list. Before you call it, tell the user the cost of 1 credit per store and how many domains you will add, then ask the user to confirm. Never call it without the confirmation. If you have too few credits, the result shows the cost and your balance, and nothing is added. Paid plans only.

NameTypeReqDescription
domainsarrayyesThe store domains to add, for example example.com. At most 50 per call.
listIdintegeryesThe list id from listWatchlists.

No output schema declared.

No examples provided.

createWatchlist ~42

Create an empty watchlist. You can have at most 10 lists, including the blacklist. Paid plans only.

NameTypeReqDescription
namestringyesThe list name.

No output schema declared.

No examples provided.

deleteSignalSet ~77

Delete one of your signal sets. The set stops matching stores and disappears from listSignalSets and from the dashboard tabs. You cannot undo this. Ask the user to confirm before you call it. Say the name of the set in your question. Paid plans only.

NameTypeReqDescription
setIdintegeryesThe set id from listSignalSets.

No output schema declared.

No examples provided.

deleteWatchlist ~55

Delete one of your watchlists with all its domains. The blacklist cannot be deleted. Ask the user to confirm before you call it. Paid plans only.

NameTypeReqDescription
listIdintegeryesThe list id from listWatchlists.

No output schema declared.

No examples provided.

exportStores ~118

Export revealed stores as CSV text. Stores you have not revealed are skipped. The result holds the header row and at most 200 data rows; it says when it cut the rows. For a larger export, narrow the selection or download the file in the dashboard. Paid plans only.

NameTypeReqDescription
selectionobjectyesThe stores to price. Pass either "ids", or "tab" with optional "filters" and "deselected".
visibleColumnsarray–Optional. The column names to export. Leave it out for all columns.

No output schema declared.

No examples provided.

getRevealCost ~77

Preview the credit cost of a reveal. Nothing is charged and nothing is revealed. Returns the cost of each action (details, ceo, marketing, ecommerce) for the selected stores.

NameTypeReqDescription
selectionobjectyesThe stores to price. Pass either "ids", or "tab" with optional "filters" and "deselected".

No output schema declared.

No examples provided.

getRevealStatus ~41

Check the status of contact searches you started in the dashboard, and your credit balance. Read only.

NameTypeReqDescription
storeIdsarrayyesStore ids to check.

No output schema declared.

No examples provided.

getSignalSet ~40

Get one of your signal sets, with its criteria. Paid plans only.

NameTypeReqDescription
setIdintegeryesThe signal set id from listSignalSets.

No output schema declared.

No examples provided.

getStoreChart ~56

Get the latest 24 points of one metric for a store, for a chart. Values use your currency.

NameTypeReqDescription
domainstringyesThe store domain, for example example.com.
metricstringyesThe metric name.

No output schema declared.

No examples provided.

getWatchlist ~78

Get the domains of one watchlist or the blacklist, 100 per page. To see store data for a watchlist, call searchStores with tab "watchlist:{id}". Paid plans only.

NameTypeReqDescription
listIdintegeryesThe list id from listWatchlists.
pageinteger–Page number, starting at 1.

No output schema declared.

No examples provided.

listSignalSets ~32

List your signal sets, with the signal catalog and the ICP columns you can use in criteria. Paid plans only.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

listWatchlists ~28

List your watchlists and your blacklist, with the domain count of each. Paid plans only.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

lookupStore ~175

Look up one ecommerce store by domain. The reply has company data, estimated revenue, marketing budget, traffic, Google and Meta ad spend, ad counts, a Conversion Rate Score, buying signals, the store phone number, and social and ad-library links. Decision-maker contact fields are not in the fields list. With OAuth access, the decisionMakers object shows the contacts that you revealed. When other active stores use the same base domain, the reply has sharedMetrics. Those stores show the same traffic and ad numbers, because the data belongs to the base domain. Limits: anonymous access, 20 lookups per hour per IP. OAuth access, 20 lookups per minute, and the call writes a lookup history row.

NameTypeReqDescription
domainstringyesThe store domain, for example example.com. A full URL also works.

No output schema declared.

No examples provided.

previewSignalSet ~177

Check whether candidate signal criteria match enough stores (80 or more). Returns {"enough": true|false}. It does not save anything. Paid plans only.

NameTypeReqDescription
criteriaobjectyesEither {"root": node} with a recursive tree, or the flat form {"signalIds": [...], "legacyCategories": [...], "icpFilters": [...]}. A node is {"type":"group","op":"AND"|"OR","children":[...]}, {"type…
setIdinteger–Optional. The id of a set you are editing.

No output schema declared.

No examples provided.

removeFromWatchlist ~57

Remove one domain from a watchlist or from the blacklist. Paid plans only.

NameTypeReqDescription
domainstringyesThe exact domain as getWatchlist shows it.
listIdintegeryesThe list id from listWatchlists.

No output schema declared.

No examples provided.

renameWatchlist ~51

Rename one of your watchlists. The blacklist cannot be renamed. Paid plans only.

NameTypeReqDescription
listIdintegeryesThe list id from listWatchlists.
namestringyesThe new name.

No output schema declared.

No examples provided.

revealStores ~188

Reveal data for stores. THIS SPENDS CREDITS. Before you call it, call getRevealCost for the same selection and tell the user the cost, or state the cost of 1 credit per store, then ask the user to confirm. Never call it without the confirmation. details unlocks the profile links, buying signals and phone. ceo, marketing and ecommerce start a decision-maker contact search (1 credit per store, +1 for a store whose details are not revealed yet). A store you already revealed costs 0. If you have too few credits, the result shows the cost and your balance, and nothing is charged. Use getRevealStatus to follow a contact search.

NameTypeReqDescription
actionstringyesWhat to reveal.
selectionobjectyesThe stores to price. Pass either "ids", or "tab" with optional "filters" and "deselected".

No output schema declared.

No examples provided.

saveSignalSet ~170

Create a signal set, or replace the criteria of an existing one. Without setId it creates a new set (the plan limit applies). With setId it updates that set and replaces all its signals, legacy categories and ICP filters with the new criteria. Conditions that you did not set (saved custom SQL conditions) stay on the set, joined with AND. Then the reply has preservedConditions, the number of these conditions. Use previewSignalSet first to check that the criteria match enough stores. Paid plans only.

NameTypeReqDescription
criteriaobjectyesThe criteria, in the same format as previewSignalSet.
namestring–Optional. The name of a new set.
setIdinteger–Optional. The id of the set to update. Leave it out to create a set.

No output schema declared.

No examples provided.

searchStores ~391

Search the store catalog like the Ecommerce Leads dashboard. Returns 30 rows per page. Stores you have not revealed show masked values for the hidden fields; revealed stores show the real values. By default, each row has storeId, 9 key columns (Industry, Country, revenue, Total Traffic, Google and Meta ad spend, Buying Signals, Buying Signals List, Status) and a short "reveal" object (revealed, contactTypes, pendingTypes). Use the columns argument to choose other columns, or ["*"] for all columns and the full reveal object. The result has the column list only when includeColumns is true. The result has the exact total. If the count fails, the result has totalAtLeast (a lower bound that grows on each page) and a note. Use hasMore to decide whether to fetch the next page, and do not report totalAtLeast as the number of matches. When other active stores use the same base domain, the row has sharedMetrics {basedomain, relatedStoreCount}. Those stores show the same traffic and ad numbers, because the data belongs to the base domain.

NameTypeReqDescription
columnsarray–The column keys to return in each row. Use ["*"] for all columns. If you omit it, the default set is returned. An unknown key gives an error that lists the valid keys.
filtersarray–Column filters. All filters must match.
includeColumnsboolean–Set to true to get the column list (key, label, type) in the result. Default false.
pageinteger–Page number, starting at 1.
sortobject––
tabstring–Which stores to search: all (default), revealed, set:{id} for a signal set, or watchlist:{id} for a watchlist. Free plans can use all and revealed only.

No output schema declared.

No examples provided.

sendFeedback ~36

Send a feedback message to the Ecommerce Leads team. Limit: 5 messages per hour.

NameTypeReqDescription
messagestringyesThe feedback text.

No output schema declared.

No examples provided.

updateOutreachStatus ~91

Set the outreach status of one store that you revealed. Use the storeId from a searchStores row. If you did not reveal the store, the tool returns an error. Use revealStores first. A store in a revealed group is accepted at no credit cost.

NameTypeReqDescription
statusstringyes–
storeIdintegeryesThe store id (the storeId field of a searchStores row).

No output schema declared.

No examples provided.

Install

How do I install the Ecommerce Leads MCP server?

Ecommerce Leads is a hosted endpoint at https://getecommerceleads.com/api/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

remote · getecommerceleads.com

# add to Claude Code
claude mcp add --transport http com-getecommerceleads-ecommerce-leads 'https://getecommerceleads.com/api/mcp'
Common questions

What is the Ecommerce Leads MCP server?

Ecommerce Leads is an MCP server listed in the public MCP registry as com.getecommerceleads/ecommerce-leads. Ecommerce store metrics by domain: revenue, ad spend, traffic. Log in to search 600k+ stores. This page covers its hosted endpoint (https://getecommerceleads.com/api/mcp).

Is the Ecommerce Leads MCP server safe to use?

Ecommerce Leads scores 67 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the Ecommerce Leads MCP server expose?

Ecommerce Leads exposes 21 tools: lookupStore, searchStores, getStoreChart, listSignalSets, getSignalSet, and 16 more. Their descriptions and schemas cost roughly 2,124 tokens of context every time the server is loaded.

Does the Ecommerce Leads MCP server require authentication?

No. We connected to Ecommerce Leads without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.

Is the Ecommerce Leads MCP server still maintained?

Ecommerce Leads is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.