ShipSaving
NPM · SHIPSAVING-MCP
MCP server for ShipSaving — shipping rates, labels, orders, tracking
Available components
Last scanned (18 hours ago)
Scores higher than 51% of npm servers
Category E-commerce
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security81
- No malware found by supply-chain analysis.Pass
- CVE check failed: a known high-severity CVE affects zod 3.25.76, a direct dependency. A fixed version is available. View diagnostics → Fail
- No install/post-install scripts declared.Pass
- 30 of 93 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 197 days ago).Pass
- Security-disclosure policy not yet verified: we couldn't inspect the source repository.Unverified
Schema Quality & AI Usability80
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 3399 tokens (~113/item across 30 items; 30 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management93
- Stability observed for 28 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage73
- 60% of tools have a non-trivial description (not blank, and not just the tool's name).Partial
- 100% of tool parameters carry a description.Pass
Tool Safety75
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 0 of 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "pay_shipment" implies "pay" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
- An AI judge read all 31 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 4 Nov 26 0
- Security disclosure: fail → unverified ▼ functional
- 3 Nov 26 −1
- Stability: pass → 0.90 functional
- 2 Nov 26 0
- Security disclosure: unverified → fail ▼ functional
- 1 Nov 26 0
- Security disclosure: fail → unverified ▼ functional
- 28 Oct 26 0
- Stability: 0.97 → pass security
- Security disclosure: unverified → fail ▼ functional
- 27 Oct 26 0
- Stability: pass → 0.97 functional
- 25 Oct 26 0
- Security disclosure: fail → unverified ▼ functional
- 24 Oct 26 −5
- CVE-2023-54404 affects this package: high ▼ security
- Known CVEs: pass → fail ▼ security
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 4 Nov 2026 · Analysed npm/shipsaving-mcp@1.0.4
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Vulnerabilities 1 finding
| ID | CVE | Severity | Vector | Fix available |
|---|---|---|---|---|
| GHSA-mrhx-c7xc-m3w5 | CVE-2023-54404 | high | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | yes |
Background: What a vulnerability scan can and cannot prove →
Dependencies 93 packages
| Packages resolved | 93 |
|---|---|
| Stale | 30 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
buy_label_from_order ~199
通过已有订单打单（购买面单）。当用户要对订单打单时，必须使用此工具，不得使用 create_draft_shipment + pay_shipment 流程。需要先通过 get_shipping_rates 获取 rate_id。
| Name | Type | Req | Description |
|---|---|---|---|
| from_address_data | object | yes | 寄件地址 |
| international | boolean | – | 是否为国际件 |
| label_print_type | string | – | 面单打印格式 |
| option_data | object | – | 运单附加选项 |
| order_id | number | yes | 订单ID |
| package_data | object | yes | 包裹信息 |
| rate_id | string | yes | 报价ID，从 get_shipping_rates 获取 |
| ship_date | string | – | 发货日期，ISO 8601 格式，如 2026-03-31T13:37:24+08:00 |
| to_address_data | object | yes | 收件地址 |
No output schema declared.
No examples provided.
cancel_order ~23
取消订单
| Name | Type | Req | Description |
|---|---|---|---|
| order_id | number | yes | 订单ID |
No output schema declared.
No examples provided.
create_address ~175
在地址簿中新建地址
| Name | Type | Req | Description |
|---|---|---|---|
| address_category | string | yes | 地址分类：ship_from（发件地址）/ ship_to（收件地址） |
| address_type | string | yes | 地址类型：residential(居住区) / commercial(商业区) |
| city | string | yes | 城市 |
| company_name | string | – | 公司名 |
| country | string | – | 国家代码 |
| string | – | 邮箱 | |
| first_name | string | yes | 名 |
| last_name | string | yes | 姓 |
| phone | string | yes | 电话（必填，不能为空） |
| state | string | yes | 州/省 |
| street | string | yes | 地址行1 |
| street2 | string | – | 地址行2 |
| zip_code | string | yes | 邮编 |
No output schema declared.
No examples provided.
create_draft_shipment ~145
标准下单流程第二步：创建运单草稿（不立即付款）。在 get_shipping_rates 之后、pay_shipment 之前调用。保存地址和包裹信息，等用户确认后再付款。
| Name | Type | Req | Description |
|---|---|---|---|
| cheapest_rate_id | string | – | 最便宜报价的 rate_id（可从 get_shipping_rates 获取） |
| from_address_data | object | yes | 寄件地址 |
| label_print_type | string | – | 面单打印格式 |
| option_data | object | – | 运单附加选项 |
| package_data | object | yes | 包裹信息 |
| to_address_data | object | yes | 收件地址 |
No output schema declared.
No examples provided.
create_order ~221
手动创建订单。【重要】调用此接口前必须先准备好所有信息：1) 如果用户指定了地址簿ID，先调用 list_addresses 获取该地址的完整信息；2) 确认订单号、商品信息（名称、数量、单价）齐全；3) 缺少任何必填信息时必须先向用户询问，不得传空值调用接口。
| Name | Type | Req | Description |
|---|---|---|---|
| amount | number | – | 订单总金额 |
| currency | string | – | 币种，如 USD |
| order_date | string | – | 订单日期，ISO 8601 格式，如 2026-04-11T09:36:01Z |
| order_items | array | yes | 订单商品列表 |
| order_number | string | yes | 订单号 |
| timezone | string | – | 时区ID，如 Asia/Shanghai，为空则默认 UTC |
| to_address | object | yes | 收件地址（必须传完整地址信息，即使引用地址簿也需要填入所有字段） |
No output schema declared.
No examples provided.
create_package ~147
创建包裹模板，方便下次快速使用
| Name | Type | Req | Description |
|---|---|---|---|
| dimension_unit | string | – | 长度单位，默认 in |
| height | number | yes | 高度 |
| length | number | yes | 长度 |
| nick_name | string | yes | 模板名称 |
| package_category | string | yes | 包裹类别：box_or_thick_parcel（箱子/厚包裹）或 poly_mailer（塑料袋） |
| package_type | string | – | 包裹类型，默认 custom |
| weight | number | yes | 重量 |
| weight_unit | string | – | 重量单位，默认 oz |
| width | number | yes | 宽度 |
No output schema declared.
No examples provided.
get_insurance_rates ~66
查询保险价格。根据保额和服务等级返回保险费率信息。
| Name | Type | Req | Description |
|---|---|---|---|
| declared_value | number | yes | 保额（投保金额） |
| service_level | string | yes | 服务等级代码，从 get_shipping_rates 返回结果中获取，如 USPS_GROUND_ADVANTAGE |
No output schema declared.
No examples provided.
get_order_detail ~25
查看订单详细信息
| Name | Type | Req | Description |
|---|---|---|---|
| order_id | number | yes | 订单ID |
No output schema declared.
No examples provided.
get_order_tags ~14
查询所有订单标签
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_service_levels ~21
查询客户生效中的承运商服务级别
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_shipment_detail ~27
查看运单详细信息
| Name | Type | Req | Description |
|---|---|---|---|
| shipment_no | string | yes | 运单号 |
No output schema declared.
No examples provided.
get_shipping_analysis ~109
按时间维度分析运费数据。调用前必须先询问用户选择时间范围，可选值：the_last_7_days（近7天）、the_last_30_days（近30天）、this_month（本月）、last_month（上月）、current_year（今年）、last_year（去年）。
| Name | Type | Req | Description |
|---|---|---|---|
| date_range | string | yes | 时间范围：the_last_7_days / the_last_30_days / this_month / last_month / current_year / last_year |
No output schema declared.
No examples provided.
get_shipping_rates ~129
获取多承运商运费报价比价。需提供寄件地址、收件地址、包裹信息和 ship_date。返回所有可用运费方案，标记最便宜和最快选项。
| Name | Type | Req | Description |
|---|---|---|---|
| from_address_data | object | yes | 寄件地址 |
| package_data | object | yes | 包裹信息 |
| ship_date | string | – | 发货日期，ISO 8601 格式，如 2025-12-14T00:00:00+08:00 |
| to_address_data | object | yes | 收件地址 |
No output schema declared.
No examples provided.
get_total_savings ~21
查看使用 ShipSaving 节省的总金额
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_transaction_history ~95
查询交易记录
| Name | Type | Req | Description |
|---|---|---|---|
| end_day | string | – | 结束日期，UTC 格式 |
| page | number | – | 页码 |
| page_size | number | – | 每页数量 |
| source_id | number | – | 来源ID |
| source_type | string | – | 来源类型 |
| start_day | string | – | 开始日期，UTC 格式 |
| tracking_number | string | – | 追踪号 |
No output schema declared.
No examples provided.
get_wallet_info ~14
查询钱包余额信息
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_addresses ~130
查询地址簿中的地址列表
| Name | Type | Req | Description |
|---|---|---|---|
| address_category | string | – | 地址类型：ship_from / ship_to |
| address_type | string | – | 地址类型：residential / commercial |
| name | string | – | 收件人姓名（first name 或 last name） |
| order_by_direction | string | – | 排序方向：asc / desc |
| page | number | – | 页码 |
| page_size | number | – | 每页数量 |
| phone | string | – | 电话号码 |
| sort_field | string | – | 排序字段 |
| verified | boolean | – | 是否已验证 |
No output schema declared.
No examples provided.
list_carriers ~19
查询已连接的承运商账户列表
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_packages ~49
查询已保存的包裹模板列表
| Name | Type | Req | Description |
|---|---|---|---|
| page | number | – | 页码 |
| page_size | number | – | 每页数量 |
| sort_field | string | – | 排序字段 |
No output schema declared.
No examples provided.
list_predefined_packages ~65
查询承运商预定义包裹列表。返回按承运商分组的预定义包裹，包含尺寸和重量信息。用户发货时可通过 carrier_package_id 直接引用预定义包裹，无需手动填写尺寸。
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_stores ~19
查询已连接的电商店铺列表
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
mark_order_shipped ~30
标记订单为已发货状态
| Name | Type | Req | Description |
|---|---|---|---|
| order_id | number | yes | 订单ID |
No output schema declared.
No examples provided.
pay_shipment ~74
对已选报价的运单进行支付，生成面单。可选附带保险信息。
| Name | Type | Req | Description |
|---|---|---|---|
| insurance_data | object | – | 保险信息（可选） |
| label_print_type | string | – | 面单打印格式 |
| rate_id | string | yes | 报价ID，从 get_shipping_rates 获取 |
No output schema declared.
No examples provided.
search_orders ~346
搜索订单列表，支持按状态、店铺、日期、关键词等筛选。当用户提供了类似 ID 的内容（如订单号、追踪号、订单ID等），必须通过 hybrid 参数传入进行搜索。
| Name | Type | Req | Description |
|---|---|---|---|
| carrier_code | string | – | 承运商代码（已发货订单） |
| destination_type | string | – | 收件地址类型：DOMESTIC / INTERNATIONAL |
| filter_combined | boolean | – | 筛选合并订单 |
| filter_split | boolean | – | 筛选拆分订单 |
| from_order_date | string | – | 订单开始日期，如 2024-11-10T00:00:00Z |
| has_order_note | boolean | – | 是否有订单备注 |
| hybrid | string | – | 混合搜索：当用户提供任何类似 ID 的内容（订单号、追踪号、订单ID等）时，通过此参数传入。支持追踪号/订单号精确搜索、收件人姓名模糊搜索 |
| item_name | string | – | 商品名称 |
| item_sku | string | – | 商品SKU |
| page_no | number | – | 页码 |
| page_size | number | – | 每页数量，最大200 |
| status | string | – | 订单状态：AWAITING / SHIPPED / CANCEL |
| store_id | number | – | 店铺ID |
| tag_ids | array | – | 标签ID列表 |
| to_city | string | – | 收件城市 |
| to_order_date | string | – | 订单结束日期，如 2024-11-10T00:00:00Z |
No output schema declared.
No examples provided.
search_shipments ~349
搜索运单列表，支持多种条件筛选
| Name | Type | Req | Description |
|---|---|---|---|
| account_id | number | – | 承运商账户 ID |
| carrier_code | string | – | 承运商代码，如 USPS / UPS |
| destination_type | string | – | 收件地址类型：DOMESTIC / INTERNATIONAL |
| first_name | string | – | 收件人名 |
| label_print_type | string | – | label打印方式：label / qr_code / bar_code |
| last_name | string | – | 收件人姓 |
| page | number | – | 页码 |
| page_size | number | – | 每页数量 |
| provider_id | string | – | Provider ID |
| recipient_city | string | – | 收件人城市 |
| recipient_name | string | – | 收件人姓名 |
| search_end_date | string | – | 创建结束日期，如 2024-11-10T00:00:00Z |
| search_key | string | – | 搜索关键字：支持 shipment id 精确搜索、tracking number 精确搜索、收件人姓名模糊搜索 |
| search_start_date | string | – | 创建开始日期，如 2024-11-10T00:00:00Z |
| shipment_no | string | – | 运单号 |
| shipment_status | string | – | 运单状态 |
| shipment_status_list | string | – | 运单状态（多选，逗号分隔） |
| store_id | number | – | 店铺 ID |
| store_name | string | – | 店铺名字 |
| tracking_no | string | – | 追踪号 |
| tracking_status | string | – | 承运商运单状态 |
No output schema declared.
No examples provided.
sync_store_orders ~80
手动触发店铺订单同步。同步成功后，必须立即调用 search_orders（传入相同的 store_id，status 为 AWAITING）查询刚同步过来的订单并展示给用户。
| Name | Type | Req | Description |
|---|---|---|---|
| platform | string | yes | 平台名称，如 shopify / ecwid |
| store_id | number | yes | 店铺ID |
No output schema declared.
No examples provided.
track_shipment ~31
通过追踪号查询物流状态
| Name | Type | Req | Description |
|---|---|---|---|
| trackingNo | string | yes | 快递追踪号 |
No output schema declared.
No examples provided.
update_address ~216
编辑/更新地址簿中已有的地址
| Name | Type | Req | Description |
|---|---|---|---|
| address_type | string | yes | 地址类型：residential(居住区) / commercial(商业区) |
| city | string | yes | 城市 |
| company_name | string | – | 公司名称 |
| country | string | yes | 国家代码 |
| string | – | 邮箱 | |
| first_name | string | yes | 名 |
| force_create | boolean | – | 客户强制保存地址（二次确认使用） |
| id | number | yes | 要更新的地址ID |
| is_default | boolean | – | 是否设为默认地址 |
| last_name | string | yes | 姓 |
| latitude | number | – | 地址纬度 |
| longitude | number | – | 地址经度 |
| phone | string | yes | 电话（必填，不能为空） |
| state | string | yes | 州/省 |
| street | string | yes | 地址行1 |
| street2 | string | – | 地址行2 |
| zip_code | string | yes | 邮编 |
No output schema declared.
No examples provided.
validate_address ~77
验证地址是否合法、可达
| Name | Type | Req | Description |
|---|---|---|---|
| city | string | yes | 城市 |
| country | string | – | 国家代码 |
| state | string | yes | 州/省 |
| street | string | yes | 地址行1 |
| street2 | string | – | 地址行2 |
| zip_code | string | yes | 邮编 |
No output schema declared.
No examples provided.
void_label ~30
退款/作废未使用的面单
| Name | Type | Req | Description |
|---|---|---|---|
| shipment_no | string | yes | 运单号 |
No output schema declared.
No examples provided.
How do I install the ShipSaving MCP server?
ShipSaving runs locally as an npm package, launched with npx -y shipsaving-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · shipsaving-mcp
claude mcp add waka4674-shipsaving-mcp -- npx -y shipsaving-mcp
What is the ShipSaving MCP server?
ShipSaving is an MCP server listed in the public MCP registry as io.github.waka4674/shipsaving-mcp. MCP server for ShipSaving, shipping rates, labels, orders, tracking. This page covers its npm package (shipsaving-mcp).
Is the ShipSaving MCP server safe to use?
ShipSaving scores 75 out of 100 on VerifyMCP. We recorded 1 known advisory against it as of 4 November 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the ShipSaving MCP server expose?
ShipSaving exposes 30 tools: get_shipping_rates, search_shipments, get_shipment_detail, track_shipment, get_insurance_rates, and 25 more. Their descriptions and schemas cost roughly 2,946 tokens of context every time the server is loaded.
Is the ShipSaving MCP server still maintained?
ShipSaving is still listed as active in the MCP registry. We last reached this channel on 4 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the ShipSaving MCP server under?
ShipSaving declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.