Ecommerce Leads
REMOTE · GETECOMMERCELEADS.COM
Ecommerce store metrics by domain: revenue, ad spend, traffic. Log in to search 600k+ stores.
Available components
Last scanned (6 hours ago)
Scores higher than 53% of remote servers
Reachable. Last reached 5 Nov 2026.
Category E-commerce
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security63
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation check failed: no authorisation is required to call this server, and it exposes a tool marked destructive (revealStores). See how to fix → View diagnostics → Fail
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- The HSTS (Strict-Transport-Security) header is present. View diagnostics → Pass
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability75
- AI-judged instruction clarity (good).Pass
- Tool/resource definitions use about 2181 tokens (~103/item across 21 items; 21 tools + 0 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management3
- Stability observed for 1 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage98
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 94% of tool parameters carry a description.Partial
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 4 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 22 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 5 Nov 26 0
- Stability: unverified → 0.03 ▲ functional
- 4 Nov 26 67
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Probed https://getecommerceleads.com/api/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=getecommerceleads.com | CN=YE2,O=Let's Encrypt,C=US | 3 Nov 2026 | 1 Feb 2027 | ECDSA 256 | ECDSA-SHA384 | 547482de3bb16fd1021424e19671957a0ea |
| SANs: getecommerceleads.com, www.getecommerceleads.com | ||||||
| CN=YE2,O=Let's Encrypt,C=US (CA) | CN=Root YE,O=ISRG,C=US | 3 Sept 2025 | 2 Sept 2028 | ECDSA 384 | ECDSA-SHA384 | 4df3b15dd6c0784c507cd37b58e6f115 |
| CN=Root YE,O=ISRG,C=US (CA) | CN=ISRG Root X2,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | ECDSA 384 | ECDSA-SHA384 | 872165fc34b6e5fba8add5b3705fb53a |
| CN=ISRG Root X2,O=Internet Security Research Group,C=US (CA) | CN=ISRG Root X1,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | ECDSA 384 | SHA256-RSA | 6c8f1dc727c7117f7baf853ac980f9cd |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of getecommerceleads.com. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| com. | present | 19718 | 13 | Verified |
| getecommerceleads.com. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
| Header | Value |
|---|---|
| strict-transport-security | max-age=31536000; includeSubDomains |
| content-security-policy | default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://plausible.io https://www.googletagmanager.com https://www.google.com https://www.gstatic.com https://airtable.com https://www.youtube.com https://cdn.jsdelivr.net https://js.stripe.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://airtable.com https://www.youtube.com; font-src 'self' https://fonts.gstatic.com data:; img-src 'self' data: https://www.google-analytics.com https://plausible.io https://fonts.gstatic.com https://startupfa.me https://www.google.com https://pagead2.googlesyndication.com https://airtable.com https://www.youtube.com; connect-src 'self' https://plausible.io https://www.google.com https://www.gstatic.com https://pagead2.googlesyndication.com https://airtable.com https://www.youtube.com https://cdn.jsdelivr.net; frame-ancestors 'self'; frame-src 'self' https://www.google.com https://www.gstatic.com https://www.googletagmanager.com https://airtable.com https://www.youtube.com https://checko |
| x-content-type-options | nosniff |
| x-frame-options | SAMEORIGIN |
| referrer-policy | strict-origin-when-cross-origin |
| permissions-policy | geolocation=(), microphone=(), camera=() |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://getecommerceleads.com/api/mcp | Verified | 200 | |
| http (plaintext) | http://getecommerceleads.com/api/mcp | HTTPS enforced | 301 | https://getecommerceleads.com/api/mcp.php |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
addToWatchlist Add stores to a watchlist (spends credits) ~144
Add domains to a watchlist (merge, nothing is removed). THIS SPENDS CREDITS: 1 credit per domain that is new to the list. Before you call it, tell the user the cost of 1 credit per store and how many domains you will add, then ask the user to confirm. Never call it without the confirmation. If you have too few credits, the result shows the cost and your balance, and nothing is added. Paid plans only.
| Name | Type | Req | Description |
|---|---|---|---|
| domains | array | yes | The store domains to add, for example example.com. At most 50 per call. |
| listId | integer | yes | The list id from listWatchlists. |
No output schema declared.
No examples provided.
createWatchlist Create a watchlist ~42
Create an empty watchlist. You can have at most 10 lists, including the blacklist. Paid plans only.
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | yes | The list name. |
No output schema declared.
No examples provided.
deleteSignalSet Delete a signal set ~77
Delete one of your signal sets. The set stops matching stores and disappears from listSignalSets and from the dashboard tabs. You cannot undo this. Ask the user to confirm before you call it. Say the name of the set in your question. Paid plans only.
| Name | Type | Req | Description |
|---|---|---|---|
| setId | integer | yes | The set id from listSignalSets. |
No output schema declared.
No examples provided.
deleteWatchlist Delete a watchlist ~55
Delete one of your watchlists with all its domains. The blacklist cannot be deleted. Ask the user to confirm before you call it. Paid plans only.
| Name | Type | Req | Description |
|---|---|---|---|
| listId | integer | yes | The list id from listWatchlists. |
No output schema declared.
No examples provided.
exportStores Export revealed stores ~118
Export revealed stores as CSV text. Stores you have not revealed are skipped. The result holds the header row and at most 200 data rows; it says when it cut the rows. For a larger export, narrow the selection or download the file in the dashboard. Paid plans only.
| Name | Type | Req | Description |
|---|---|---|---|
| selection | object | yes | The stores to price. Pass either "ids", or "tab" with optional "filters" and "deselected". |
| visibleColumns | array | – | Optional. The column names to export. Leave it out for all columns. |
No output schema declared.
No examples provided.
getRevealCost Get reveal cost ~77
Preview the credit cost of a reveal. Nothing is charged and nothing is revealed. Returns the cost of each action (details, ceo, marketing, ecommerce) for the selected stores.
| Name | Type | Req | Description |
|---|---|---|---|
| selection | object | yes | The stores to price. Pass either "ids", or "tab" with optional "filters" and "deselected". |
No output schema declared.
No examples provided.
getRevealStatus Get reveal status ~41
Check the status of contact searches you started in the dashboard, and your credit balance. Read only.
| Name | Type | Req | Description |
|---|---|---|---|
| storeIds | array | yes | Store ids to check. |
No output schema declared.
No examples provided.
getSignalSet Get a signal set ~40
Get one of your signal sets, with its criteria. Paid plans only.
| Name | Type | Req | Description |
|---|---|---|---|
| setId | integer | yes | The signal set id from listSignalSets. |
No output schema declared.
No examples provided.
getStoreChart Get store metric chart ~56
Get the latest 24 points of one metric for a store, for a chart. Values use your currency.
| Name | Type | Req | Description |
|---|---|---|---|
| domain | string | yes | The store domain, for example example.com. |
| metric | string | yes | The metric name. |
No output schema declared.
No examples provided.
getWatchlist Get a watchlist ~78
Get the domains of one watchlist or the blacklist, 100 per page. To see store data for a watchlist, call searchStores with tab "watchlist:{id}". Paid plans only.
| Name | Type | Req | Description |
|---|---|---|---|
| listId | integer | yes | The list id from listWatchlists. |
| page | integer | – | Page number, starting at 1. |
No output schema declared.
No examples provided.
listSignalSets List signal sets ~32
List your signal sets, with the signal catalog and the ICP columns you can use in criteria. Paid plans only.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
listWatchlists List watchlists ~28
List your watchlists and your blacklist, with the domain count of each. Paid plans only.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
lookupStore Look up a store ~175
Look up one ecommerce store by domain. The reply has company data, estimated revenue, marketing budget, traffic, Google and Meta ad spend, ad counts, a Conversion Rate Score, buying signals, the store phone number, and social and ad-library links. Decision-maker contact fields are not in the fields list. With OAuth access, the decisionMakers object shows the contacts that you revealed. When other active stores use the same base domain, the reply has sharedMetrics. Those stores show the same traffic and ad numbers, because the data belongs to the base domain. Limits: anonymous access, 20 lookups per hour per IP. OAuth access, 20 lookups per minute, and the call writes a lookup history row.
| Name | Type | Req | Description |
|---|---|---|---|
| domain | string | yes | The store domain, for example example.com. A full URL also works. |
No output schema declared.
No examples provided.
previewSignalSet Preview a signal set ~177
Check whether candidate signal criteria match enough stores (80 or more). Returns {"enough": true|false}. It does not save anything. Paid plans only.
| Name | Type | Req | Description |
|---|---|---|---|
| criteria | object | yes | Either {"root": node} with a recursive tree, or the flat form {"signalIds": [...], "legacyCategories": [...], "icpFilters": [...]}. A node is {"type":"group","op":"AND"|"OR","children":[...]}, {"type… |
| setId | integer | – | Optional. The id of a set you are editing. |
No output schema declared.
No examples provided.
removeFromWatchlist Remove stores from a watchlist ~57
Remove one domain from a watchlist or from the blacklist. Paid plans only.
| Name | Type | Req | Description |
|---|---|---|---|
| domain | string | yes | The exact domain as getWatchlist shows it. |
| listId | integer | yes | The list id from listWatchlists. |
No output schema declared.
No examples provided.
renameWatchlist Rename a watchlist ~51
Rename one of your watchlists. The blacklist cannot be renamed. Paid plans only.
| Name | Type | Req | Description |
|---|---|---|---|
| listId | integer | yes | The list id from listWatchlists. |
| name | string | yes | The new name. |
No output schema declared.
No examples provided.
revealStores Reveal stores (spends credits) ~188
Reveal data for stores. THIS SPENDS CREDITS. Before you call it, call getRevealCost for the same selection and tell the user the cost, or state the cost of 1 credit per store, then ask the user to confirm. Never call it without the confirmation. details unlocks the profile links, buying signals and phone. ceo, marketing and ecommerce start a decision-maker contact search (1 credit per store, +1 for a store whose details are not revealed yet). A store you already revealed costs 0. If you have too few credits, the result shows the cost and your balance, and nothing is charged. Use getRevealStatus to follow a contact search.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | What to reveal. |
| selection | object | yes | The stores to price. Pass either "ids", or "tab" with optional "filters" and "deselected". |
No output schema declared.
No examples provided.
saveSignalSet Save a signal set ~170
Create a signal set, or replace the criteria of an existing one. Without setId it creates a new set (the plan limit applies). With setId it updates that set and replaces all its signals, legacy categories and ICP filters with the new criteria. Conditions that you did not set (saved custom SQL conditions) stay on the set, joined with AND. Then the reply has preservedConditions, the number of these conditions. Use previewSignalSet first to check that the criteria match enough stores. Paid plans only.
| Name | Type | Req | Description |
|---|---|---|---|
| criteria | object | yes | The criteria, in the same format as previewSignalSet. |
| name | string | – | Optional. The name of a new set. |
| setId | integer | – | Optional. The id of the set to update. Leave it out to create a set. |
No output schema declared.
No examples provided.
searchStores Search stores ~391
Search the store catalog like the Ecommerce Leads dashboard. Returns 30 rows per page. Stores you have not revealed show masked values for the hidden fields; revealed stores show the real values. By default, each row has storeId, 9 key columns (Industry, Country, revenue, Total Traffic, Google and Meta ad spend, Buying Signals, Buying Signals List, Status) and a short "reveal" object (revealed, contactTypes, pendingTypes). Use the columns argument to choose other columns, or ["*"] for all columns and the full reveal object. The result has the column list only when includeColumns is true. The result has the exact total. If the count fails, the result has totalAtLeast (a lower bound that grows on each page) and a note. Use hasMore to decide whether to fetch the next page, and do not report totalAtLeast as the number of matches. When other active stores use the same base domain, the row has sharedMetrics {basedomain, relatedStoreCount}. Those stores show the same traffic and ad numbers, because the data belongs to the base domain.
| Name | Type | Req | Description |
|---|---|---|---|
| columns | array | – | The column keys to return in each row. Use ["*"] for all columns. If you omit it, the default set is returned. An unknown key gives an error that lists the valid keys. |
| filters | array | – | Column filters. All filters must match. |
| includeColumns | boolean | – | Set to true to get the column list (key, label, type) in the result. Default false. |
| page | integer | – | Page number, starting at 1. |
| sort | object | – | – |
| tab | string | – | Which stores to search: all (default), revealed, set:{id} for a signal set, or watchlist:{id} for a watchlist. Free plans can use all and revealed only. |
No output schema declared.
No examples provided.
sendFeedback Send feedback ~36
Send a feedback message to the Ecommerce Leads team. Limit: 5 messages per hour.
| Name | Type | Req | Description |
|---|---|---|---|
| message | string | yes | The feedback text. |
No output schema declared.
No examples provided.
updateOutreachStatus Update outreach status ~91
Set the outreach status of one store that you revealed. Use the storeId from a searchStores row. If you did not reveal the store, the tool returns an error. Use revealStores first. A store in a revealed group is accepted at no credit cost.
| Name | Type | Req | Description |
|---|---|---|---|
| status | string | yes | – |
| storeId | integer | yes | The store id (the storeId field of a searchStores row). |
No output schema declared.
No examples provided.
How do I install the Ecommerce Leads MCP server?
Ecommerce Leads is a hosted endpoint at https://getecommerceleads.com/api/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · getecommerceleads.com
claude mcp add --transport http com-getecommerceleads-ecommerce-leads 'https://getecommerceleads.com/api/mcp'
What is the Ecommerce Leads MCP server?
Ecommerce Leads is an MCP server listed in the public MCP registry as com.getecommerceleads/ecommerce-leads. Ecommerce store metrics by domain: revenue, ad spend, traffic. Log in to search 600k+ stores. This page covers its hosted endpoint (https://getecommerceleads.com/api/mcp).
Is the Ecommerce Leads MCP server safe to use?
Ecommerce Leads scores 67 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Ecommerce Leads MCP server expose?
Ecommerce Leads exposes 21 tools: lookupStore, searchStores, getStoreChart, listSignalSets, getSignalSet, and 16 more. Their descriptions and schemas cost roughly 2,124 tokens of context every time the server is loaded.
Does the Ecommerce Leads MCP server require authentication?
No. We connected to Ecommerce Leads without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.
Is the Ecommerce Leads MCP server still maintained?
Ecommerce Leads is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.