# Sapo MCP by usefulapi (remote · sapo.usefulapi.io)

Read Sapo store products, orders, customers and stock levels; edit order notes and stock.

- Trust score: 18/100 (low)
- Change this week: −45
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-11-05

## Components

- remote · `sapo.usefulapi.io`: 18/100 (this document), [markdown](https://verifymcp.io/servers/io-usefulapi-sapo/sapo.md), [page](https://verifymcp.io/servers/io-usefulapi-sapo/sapo)

## Channel facts

- Endpoint: `https://sapo.usefulapi.io/mcp`
- Transports: `streamable-http`
- Auth: `none`
- Version: `1.13.3`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-11-05.

- **Endpoint Security**: 46/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - Authorisation not yet verified: we couldn't confirm whether this endpoint requires it.
  - HTTPS enforcement could not be verified: the plaintext port redirected somewhere other than https, so enforcement is unproven.
  - HSTS check failed: the Strict-Transport-Security header is absent.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
- **Transport & Reachability**: 0/100
  - Transport check failed: declared streamable-http, but the endpoint redirected instead of responding directly.
- **Schema Quality & AI Usability**: 0/100
  - Schema not yet verified: we couldn't read the endpoint's schema, or could read only part of its tool list.
- **Stability & Change Management**: 0/100
  - Stability not yet verified: not enough scan history yet (needs a 30-day window).
- **Tool Coverage**: 0/100
  - Tool coverage not yet verified: we couldn't read the endpoint's tools, or could read only part of the list.
- **Tool Safety**: 0/100
  - Tool safety not yet verified: we couldn't read the endpoint's tools, or could read only part of the list.
- **Capabilities**: 0/100
  - Capabilities not yet verified: we couldn't read the endpoint's capabilities.

**Unverified: 5 categories.** Categories scored 0 because we could not verify them: authentication we do not have, an unreachable endpoint, or not enough scan history. We only credit what we can confirm.

## Install

### How do I install the Sapo MCP by usefulapi server?

Sapo MCP by usefulapi is a hosted endpoint at https://sapo.usefulapi.io/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add --transport http io-usefulapi-sapo 'https://sapo.usefulapi.io/mcp'
```

### Cursor

```json
{
  "mcpServers": {
    "io-usefulapi-sapo": {
      "url": "https://sapo.usefulapi.io/mcp"
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "io-usefulapi-sapo": {
      "type": "http",
      "url": "https://sapo.usefulapi.io/mcp"
    }
  }
}
```

### Codex

```toml
[mcp_servers.io-usefulapi-sapo]
url = "https://sapo.usefulapi.io/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "io-usefulapi-sapo": {
      "type": "remote",
      "url": "https://sapo.usefulapi.io/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add io-usefulapi-sapo --url 'https://sapo.usefulapi.io/mcp' --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  io-usefulapi-sapo:
    url: "https://sapo.usefulapi.io/mcp"
```

### Netclaw

```json
{
  "McpServers": {
    "io-usefulapi-sapo": {
      "Transport": "http",
      "Url": "https://sapo.usefulapi.io/mcp"
    }
  }
}
```

### Vellum

```bash
assistant mcp add io-usefulapi-sapo -t streamable-http -u 'https://sapo.usefulapi.io/mcp'
```

### Other

```json
{
  "mcpServers": {
    "io-usefulapi-sapo": {
      "type": "http",
      "url": "https://sapo.usefulapi.io/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-11-02 (score 18, −50)

- [security regression] Endpoint reachability: reachable → not serving MCP
- [security regression] Stability: 0.23 → unverified
- [security regression] Tool safety: pass → unverified
- [security regression] Authorization: pass → unverified
- [functional regression] Schema quality: 100 → unverified
- [functional regression] Capabilities: pass → unverified
- [functional regression] Tool coverage: 100 → unverified

### 2026-11-01 (score 68, +1)

No change was recorded against any check on this day. Stability & Change Management went from 20 to 23. That category is still filling its 30-day observation window: 6 days of observed history at the previous scan, 7 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-31 (score 67, +3)

- [security improvement] Authorization: partial → pass
- [functional improvement] MCP protocol: fail → pass
- [functional] New prompt “browse_products_variants_and_discount_rules”
- [functional] New prompt “change_an_order_s_note_or_tags_or_set_a_stock_quantity”
- [functional] New prompt “find_products_that_are_low_on_stock”
- [functional] New prompt “look_up_customers_and_how_much_they_spent”
- [functional] New prompt “review_orders_and_what_is_unpaid”
- [functional] MCP protocol version: 2025-06-18 → 2025-11-25
- [functional] Server version: 1.9.0 → 1.11.0
- [functional] Server version: 1.8.0 → 1.9.0
- [functional] Server version: 1.7.2 → 1.8.0

### 2026-10-30 (score 64, +1)

- [functional] Server version: 1.7.1 → 1.7.2
- [functional] Server version: 1.7.0 → 1.7.1

### 2026-10-29 (score 63, 0)

- [functional] Server version: 1.6.0 → 1.7.0
- [functional] Server version: 1.5.0 → 1.6.0

### 2026-10-28 (score 63, 0)

- [functional] Server version: 1.3.0 → 1.5.0

### 2026-10-27 (score 63, +1)

- [functional] Server version: 1.2.0 → 1.3.0

### 2026-10-26 (score 62, 0)

- [functional improvement] Stability: unverified → 0.03

## MCP tools (20)

### `sapo_get_store` (~38 tokens)

Get store

The Sapo store this login belongs to: name, domain, currency, timezone, plan and other settings. GET /admin/store.json.

### `sapo_list_products` (~380 tokens)

List products

List products with their variants, prices, SKUs and images. Filter by name, vendor, type, collection or created/modified dates. Paged: pass next_page as page. GET /admin/products.json.

Input parameters:

- `collection_id` (integer): Only products in this collection (see sapo_list_custom_collections).
- `created_on_max` (string): ISO 8601 date or date-time (UTC unless it carries an offset), e.g. 2026-10-01 or 2026-10-01T00:00:00Z.
- `created_on_min` (string): ISO 8601 date or date-time (UTC unless it carries an offset), e.g. 2026-10-01 or 2026-10-01T00:00:00Z.
- `ids` (array): Only these product ids.
- `limit` (integer): Results per page, 1-250 (default 50).
- `modified_on_max` (string): ISO 8601 date or date-time (UTC unless it carries an offset), e.g. 2026-10-01 or 2026-10-01T00:00:00Z.
- `modified_on_min` (string): ISO 8601 date or date-time (UTC unless it carries an offset), e.g. 2026-10-01 or 2026-10-01T00:00:00Z.
- `page` (integer): Page number, from 1 (default 1). Pass the previous reply's next_page.
- `product_type` (string): Exact product type.
- `query` (string): Search by product name.
- `since_id` (integer): Only products with an id greater than this.
- `vendor` (string): Exact vendor (brand) name.

### `sapo_count_products` (~169 tokens)

Count products

Number of products matching the filters. GET /admin/products/count.json.

Input parameters:

- `collection_id` (integer): Only products in this collection (see sapo_list_custom_collections).
- `created_on_max` (string): ISO 8601 date or date-time (UTC unless it carries an offset), e.g. 2026-10-01 or 2026-10-01T00:00:00Z.
- `created_on_min` (string): ISO 8601 date or date-time (UTC unless it carries an offset), e.g. 2026-10-01 or 2026-10-01T00:00:00Z.
- `product_type` (string): Exact product type.
- `vendor` (string): Exact vendor (brand) name.

### `sapo_get_product` (~41 tokens)

Get product

One product by id, with variants and images. GET /admin/products/{id}.json.

Input parameters:

- `product_id` (integer, required): Sapo product id.

### `sapo_list_product_variants` (~99 tokens)

List product variants

The variants (size, color, SKU, barcode, price) of one product. Paged. GET /admin/products/{product_id}/variants.json.

Input parameters:

- `limit` (integer): Results per page, 1-250 (default 50).
- `page` (integer): Page number, from 1 (default 1). Pass the previous reply's next_page.
- `product_id` (integer, required): Sapo product id.

### `sapo_get_product_variant` (~39 tokens)

Get product variant

One product variant by id. GET /admin/variants/{id}.json.

Input parameters:

- `variant_id` (integer, required): Sapo variant id.

### `sapo_list_custom_collections` (~103 tokens)

List collections

List manual product collections (danh mục thủ công). Paged. GET /admin/custom_collections.json.

Input parameters:

- `limit` (integer): Results per page, 1-250 (default 50).
- `name` (string): Filter by collection name.
- `page` (integer): Page number, from 1 (default 1). Pass the previous reply's next_page.
- `product_id` (integer): Only collections that contain this product.

### `sapo_list_orders` (~443 tokens)

List orders

List orders with line items, customer, totals, payment and fulfillment status. Filter by status, tag, customer or dates. Paged: pass next_page as page. GET /admin/orders.json.

Input parameters:

- `created_on_max` (string): ISO 8601 date or date-time (UTC unless it carries an offset), e.g. 2026-10-01 or 2026-10-01T00:00:00Z.
- `created_on_min` (string): ISO 8601 date or date-time (UTC unless it carries an offset), e.g. 2026-10-01 or 2026-10-01T00:00:00Z.
- `customer_id` (integer): Only orders of this customer.
- `financial_status` (string): Payment status: authorized, pending, paid, refunded, voided, or any. Sapo default when omitted: authorized, pending and paid only (refunded and voided are left out).
- `fulfillment_status` (string): Fulfillment status (for example unfulfilled, fulfilled, partial).
- `limit` (integer): Results per page, 1-250 (default 50).
- `modified_on_max` (string): ISO 8601 date or date-time (UTC unless it carries an offset), e.g. 2026-10-01 or 2026-10-01T00:00:00Z.
- `modified_on_min` (string): ISO 8601 date or date-time (UTC unless it carries an offset), e.g. 2026-10-01 or 2026-10-01T00:00:00Z.
- `page` (integer): Page number, from 1 (default 1). Pass the previous reply's next_page.
- `query` (string): Search text (order number, customer name, phone, email).
- `status` (string): Order status: open (Sapo default when omitted, so archived orders are left out), closed, or any (all orders). Pass any for date-range totals.
- `tag` (string): Only orders with this tag.

### `sapo_count_orders` (~329 tokens)

Count orders

Number of orders matching the filters. GET /admin/orders/count.json.

Input parameters:

- `created_on_max` (string): ISO 8601 date or date-time (UTC unless it carries an offset), e.g. 2026-10-01 or 2026-10-01T00:00:00Z.
- `created_on_min` (string): ISO 8601 date or date-time (UTC unless it carries an offset), e.g. 2026-10-01 or 2026-10-01T00:00:00Z.
- `financial_status` (string): Payment status: authorized, pending, paid, refunded, voided, or any. Sapo default when omitted: authorized, pending and paid only (refunded and voided are left out).
- `fulfillment_status` (string): Fulfillment status (for example unfulfilled, fulfilled, partial).
- `modified_on_max` (string): ISO 8601 date or date-time (UTC unless it carries an offset), e.g. 2026-10-01 or 2026-10-01T00:00:00Z.
- `modified_on_min` (string): ISO 8601 date or date-time (UTC unless it carries an offset), e.g. 2026-10-01 or 2026-10-01T00:00:00Z.
- `status` (string): Order status: open (Sapo default when omitted, so archived orders are left out), closed, or any (all orders). Pass any for date-range totals.

### `sapo_get_order` (~47 tokens)

Get order

One order by id with line items, addresses, discounts, payment and shipping. GET /admin/orders/{id}.json.

Input parameters:

- `order_id` (integer, required): Sapo order id.

### `sapo_list_order_transactions` (~42 tokens)

List order transactions

The payment transactions recorded on one order. GET /admin/orders/{order_id}/transactions.json.

Input parameters:

- `order_id` (integer, required): Sapo order id.

### `sapo_list_customers` (~295 tokens)

List customers

List customers with contact details, addresses, order count and total spent. Paged. GET /admin/customers.json.

Input parameters:

- `created_on_max` (string): ISO 8601 date or date-time (UTC unless it carries an offset), e.g. 2026-10-01 or 2026-10-01T00:00:00Z.
- `created_on_min` (string): ISO 8601 date or date-time (UTC unless it carries an offset), e.g. 2026-10-01 or 2026-10-01T00:00:00Z.
- `limit` (integer): Results per page, 1-250 (default 50).
- `modified_on_max` (string): ISO 8601 date or date-time (UTC unless it carries an offset), e.g. 2026-10-01 or 2026-10-01T00:00:00Z.
- `modified_on_min` (string): ISO 8601 date or date-time (UTC unless it carries an offset), e.g. 2026-10-01 or 2026-10-01T00:00:00Z.
- `page` (integer): Page number, from 1 (default 1). Pass the previous reply's next_page.
- `since_id` (integer): Only customers with an id greater than this.

### `sapo_count_customers` (~24 tokens)

Count customers

Total number of customers. GET /admin/customers/count.json.

### `sapo_get_customer` (~37 tokens)

Get customer

One customer by id. GET /admin/customers/{id}.json.

Input parameters:

- `customer_id` (integer, required): Sapo customer id.

### `sapo_list_locations` (~122 tokens)

List locations

List branches, stores and warehouses (id, name, address, whether they track stock). Use the ids for stock levels. Paged. GET /admin/locations.json.

Input parameters:

- `limit` (integer): Results per page, 1-250 (default 50).
- `page` (integer): Page number, from 1 (default 1). Pass the previous reply's next_page.
- `query` (string): Search by name, code or phone.
- `status` (string): Branch status; Sapo spells the inactive value "expried".

### `sapo_list_inventory_items` (~145 tokens)

List inventory items

List inventory items (one per variant) by SKU/barcode search, variant or product ids. The id is what stock levels use as inventory_item_id. Paged. GET /admin/inventory_items.json.

Input parameters:

- `ids` (array): Only these inventory item ids.
- `limit` (integer): Results per page, 1-250 (default 50).
- `page` (integer): Page number, from 1 (default 1). Pass the previous reply's next_page.
- `product_ids` (array): Only these product ids.
- `query` (string): Search by barcode or SKU.
- `variant_ids` (array): Only these variant ids.

### `sapo_list_inventory_levels` (~139 tokens)

List inventory levels

Stock per item and location: on_hand, available, committed, incoming, reserved. Filter by inventory item or location ids, or by a minimum/maximum available quantity. Sapo documents no paging for this list, so narrow it with ids. GET /admin/inventory_levels.json.

Input parameters:

- `available_max` (number): Only levels with at most this much available.
- `available_min` (number): Only levels with at least this much available.
- `inventory_item_ids` (array): Only these inventory item ids (see sapo_list_inventory_items).
- `location_ids` (array): Only these location ids (see sapo_list_locations).

### `sapo_list_price_rules` (~273 tokens)

List price rules

List discount price rules (percentage, fixed amount, fixed price) with validity dates and usage counts. Paged. GET /admin/price_rules.json.

Input parameters:

- `created_on_max` (string): ISO 8601 date or date-time (UTC unless it carries an offset), e.g. 2026-10-01 or 2026-10-01T00:00:00Z.
- `created_on_min` (string): ISO 8601 date or date-time (UTC unless it carries an offset), e.g. 2026-10-01 or 2026-10-01T00:00:00Z.
- `ends_on_max` (string): Only rules that end on or before this date.
- `ends_on_min` (string): Only rules that end on or after this date.
- `limit` (integer): Results per page, 1-250 (default 50).
- `page` (integer): Page number, from 1 (default 1). Pass the previous reply's next_page.
- `starts_on_max` (string): Only rules that start on or before this date.
- `starts_on_min` (string): Only rules that start on or after this date.
- `times_used` (integer): Only rules used exactly this many times.

### `sapo_update_order` (~122 tokens)

Update order note or tags

WRITE: set the note and/or the tags of an order (Sapo only lets an order's items and quantities stay fixed after creation). The value REPLACES the existing note or tags: read the order first to keep what is there. PUT /admin/orders/{id}.json.

Input parameters:

- `note` (string): New order note (replaces the old one; empty string clears it).
- `order_id` (integer, required): Sapo order id.
- `tags` (array): New tag list (replaces all tags; an empty list clears them).

### `sapo_set_inventory_level` (~148 tokens)

Set stock quantity

WRITE: set the physical stock (on_hand) of one inventory item at one location to an exact quantity, with a reason. This OVERWRITES the current number and is recorded as a stock adjustment: read the level first (sapo_list_inventory_levels). PUT /admin/inventory_levels/set.json.

Input parameters:

- `inventory_item_id` (integer, required): Inventory item id (see sapo_list_inventory_items).
- `location_id` (integer, required): Location id (see sapo_list_locations).
- `on_hand` (number, required): Physical on-hand quantity to set (at most 3 decimals are kept).
- `reason` (string): Why the stock changes (default: Sapo's own default).

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/io-usefulapi-sapo/sapo#diagnostics

## Score history

- 2026-11-05: 18
- 2026-11-04: 18
- 2026-11-03: 18
- 2026-11-02: 18
- 2026-11-01: 68
- 2026-10-31: 67
- 2026-10-30: 64
- 2026-10-29: 63
- 2026-10-28: 63
- 2026-10-27: 63
- 2026-10-26: 62
- 2026-10-25: 62

## Common questions

### What is the Sapo MCP by usefulapi server?

Sapo MCP by usefulapi is listed in the public MCP registry as io.usefulapi/sapo. Read Sapo store products, orders, customers and stock levels; edit order notes and stock. This page covers its hosted endpoint (https://sapo.usefulapi.io/mcp).

### Is the Sapo MCP by usefulapi server safe to use?

Sapo MCP by usefulapi scores 18 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the Sapo MCP by usefulapi server expose?

Sapo MCP by usefulapi exposes 20 tools: sapo_get_store, sapo_list_products, sapo_count_products, sapo_get_product, sapo_list_product_variants, and 15 more. Their descriptions and schemas cost roughly 3,035 tokens of context every time the server is loaded.

### Does the Sapo MCP by usefulapi server require authentication?

Its publisher declares no required credentials for Sapo MCP by usefulapi. We have not been able to confirm that against the live endpoint, and a server can require authorisation without declaring it here.

### Is the Sapo MCP by usefulapi server still maintained?

Sapo MCP by usefulapi is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What did VerifyMCP test on the Sapo MCP by usefulapi server?

VerifyMCP ran 4 checks on Sapo MCP by usefulapi, covering TLS certificate, HSTS header, DNSSEC and Transport. 7 items could not be completed, a gap on our side rather than a finding about Sapo MCP by usefulapi: Authorization, HTTPS, Schema quality, Stability and 3 more. 5 categories score 0 for that reason, because we only credit what we can confirm. Supply Chain Security and Provenance & Transparency do not apply to a hosted endpoint, so they were not tested. The score does not measure everything, and the scoring documentation lists what it leaves out.

## Links

- Remote endpoint: https://sapo.usefulapi.io/mcp
- Repository: https://github.com/m190/usefulapi-mcp
- Website: https://usefulapi.io/sapo/
- Changelog RSS feed: https://verifymcp.io/servers/io-usefulapi-sapo/sapo.xml
- Changelog JSON feed: https://verifymcp.io/servers/io-usefulapi-sapo/sapo/changelog.json
- Trust report (JSON): https://verifymcp.io/servers/io-usefulapi-sapo/sapo.json
- HTML version of this page: https://verifymcp.io/servers/io-usefulapi-sapo/sapo