wb-mcp-armine: a read-only Wildberries MCP bridge
WB Readonly MCP
A small Python MCP server gives an agent seven official Wildberries API methods and refuses to work with a token that has write rights
- 0 ★ on the repository
- Last commit
Extended access
Why this level
- A Wildberries token opens store cards, the funnel, orders and sales, though the server accepts it read-only
- A server on a public Hugging Face Space depends on platform secrets and availability
Install
- Works in
- Services
Manual install
Upload `Dockerfile`, `server.py` and `README.md` to a new Docker Space on Hugging Face, set the `WB_API_TOKEN` and `MCP_ACCESS_TOKEN` secrets and connect the `https://<address>.hf.space/mcp` address to a client with the header `Authorization: Bearer <MCP_ACCESS_TOKEN>`.
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- A Wildberries token opens store cards, the funnel, orders and sales, though the server accepts it read-only
- A server on a public Hugging Face Space depends on platform secrets and availability
This is third-party code. Review the repository files before installing.
What it does
The stateless server accepts MCP requests at `/mcp` and calls three groups of the official Wildberries API: content, analytics and statistics. There are seven tools: three availability checks (`wb_content_ping`, `wb_analytics_ping`, `wb_statistics_ping`), the card list `wb_cards_list`, the sales funnel `wb_sales_funnel`, orders `wb_orders` and sales with returns `wb_sales_returns`. Requests with a body need a `body` object per the Wildberries schema, and orders and sales need a `dateFrom` parameter. On start the server decodes the token and accepts it only if it is valid, has the read-only right and exactly the "Content", "Analytics" and "Statistics" categories. This is a local preflight and the signature is verified by Wildberries itself. Access to `/mcp` is guarded by a separate `MCP_ACCESS_TOKEN` secret of at least 32 characters. Redirects are disabled and call frequency is limited locally. The repository has instructions for running on Hugging Face Spaces through Docker.
Who it is for. Wildberries sellers who want to connect read-only access to cards, the funnel and orders to ChatGPT or another Streamable HTTP client.
Good fit when
- You need the store card list through the official API with no write rights
- The sales funnel per product is requested with a body per the Wildberries schema
- Orders and sales with returns are pulled starting from the `dateFrom` date
- You want the server running without Python on your computer, on Hugging Face Spaces
Not a fit when
- You need prices, stock, advertising, reviews or writing: only seven read routes exist
- The client supports OAuth only: the server needs a Bearer header with `MCP_ACCESS_TOKEN`
- You need reliable permanent hosting: the author calls Spaces a first-launch method with no 24/7 guarantee
Example request
Show Wildberries orders since November 1 and sales with returns for the same dateMCP
- Transport
- http
- Authentication
- API key
Environment variables
WB_API_TOKENrequired, secret- Read-only Wildberries token with the Content, Analytics and Statistics categories
MCP_ACCESS_TOKENrequired, secret- Separate /mcp access secret of at least 32 characters
PORT- Server port, 7860 by default
Limitations
The code has only seven routes, and the token must have no write rights and three exact categories, otherwise the server will not start. Two secrets are needed: the Wildberries token and a separate `MCP_ACCESS_TOKEN` password. A public Hugging Face space shows code and a status page, and store data is protected by the second secret. The status page does not confirm the Wildberries link. No license is stated in the repository. Four files, one author, the last commit in October 2026, no stars.
How to disable. Delete the Hugging Face Space or stop the container, remove the server from client settings and revoke the Wildberries token in the "API integrations" section.
FAQ
Which Wildberries token will work?
A valid read-only token with the "Content", "Analytics" and "Statistics" categories and no others. Otherwise the server will not start.
How is the `/mcp` address protected?
By a separate `MCP_ACCESS_TOKEN` secret of at least 32 characters, passed in the `Authorization: Bearer` header. It is not the Wildberries token.
Which tools exist?
Seven: three `*_ping`, `wb_cards_list`, `wb_sales_funnel`, `wb_orders` and `wb_sales_returns`. All are marked read-only.
What if /mcp shows 404 or 501 in a browser?
This is normal: the address is meant for MCP client POST requests with no page behind it. The root page shows that the server is alive.
Is there a call rate limit?
Yes, the server limits calls locally per route and on excess returns `local_rate_limit` with the seconds until a retry.
Discussion
No questions or reviews yet.
Related
All Wildberries toolsRead-only Wildberries dashboard MCP
WB Readonly MCP
A read-only Wildberries MCP server: products, ads, orders, stock, finance and reviews, with writes blocked in code, not just prompts
rf-marketplaces-mcp: Wildberries analytics and a seller cabinet
rf-marketplaces-mcp
An MCP server gives an agent Wildberries data by article without a token and, with a token, seller sales, stock and review replies
OpenAPI-driven Wildberries MCP server
Wildberries MCP Server
A local Wildberries Seller API MCP server built from a 279-method OpenAPI catalog, with calls defaulting to dry-run
Wildberries MCP
wildberries-mcp
MCP server for the Wildberries seller API: products, prices, stock, orders, FBS supplies, analytics, reviews and ads
Wildberries Seller API MCP server
wildberries-mcp-ru
An MCP server covering all seventeen Wildberries Seller API hosts: sales, stock, product cards, prices, financial reports and reviews
Wildberries MCP search server
Wildberries MCP Server
A lightweight MCP server for searching Wildberries products via its public JSON API: product card, price, reviews with no browser
README in short
The README in Hugging Face format sets the Space parameters and briefly describes the read-only mode and the `/mcp` address. Launch details are in `START_RU.txt` and the behaviour is in `server.py`.