Loading…
Analyzes Amazon ASINs for pricing, sales, fees, and profit, resolves barcodes to ASINs, and surfaces deal feeds and price alerts for FBA arbitrage sourcing.
Do not connect
A critical issue was found. Do not connect this server as-is.
Scanned 1 month ago Due for re-check
A server can change after it's graded. Re-run the automated scan to refresh this report.
This grade is deterministic and reproducible: the same server surface always yields the same grade under a given algorithm version. It is a real automated assessment computed by the MCPGrade engine from what the probe actually observed — not a fabricated or opinion score. It is not a manual human pentest, so it can miss context-specific risks.
Every signal below was measured directly by the automated probe. The grade is derived only from evidence like this — nothing is assumed.
The sorsa MCP server exposes 56 tools, focused primarily on general-purpose capabilities. Its published description reads: "Analyzes Amazon ASINs for pricing, sales, fees, and profit, resolves barcodes to ASINs, and surfaces deal feeds and price alerts for FBA arbitrage sourcing". It communicates over Streamable HTTP using the 2025-06-18 protocol revision, and does not require authorization to connect. MCPGrade currently rates sorsa F — a critical issue was found and the server should not be connected as-is. Its most notable findings include "Cross-tool shadowing" and "Cross-tool shadowing". This report is a deterministic, reproducible automated assessment: the same observed surface always yields the same grade under a given algorithm version, and it is refreshed as new scans arrive and free to read — but it is not a substitute for a manual human security review. Always re-check sorsa's advertised tools, transport security, and authorization posture before connecting an autonomous agent or sharing sensitive context with it.
Add sorsa to an MCP client using the endpoint below. Review the grade and findings above before granting an autonomous agent access.
MCP endpoint
https://sorsa.app/mcpStreamable HTTP transport. This is the MCP endpoint, not a website — paste it into your MCP client server list rather than a browser.
Captured passively during the read-only scan. Click any value to find servers that match it.
The tools this server advertises via tools/list — names, purposes, and the parameters each accepts, exactly as enumerated read-only.
Quick analysis of an Amazon product by ASIN: title, brand, current/90-day pricing, sales rank and estimated monthly sales, FBA fees and profit basics. Call this first whenever the user asks about a sp
Full analysis of an Amazon product by ASIN — everything in analyse_product plus seller/stock breakdown, buy-box history and variations. Slower and heavier than analyse_product; use when the user wants
Current sellers and their stock levels for an Amazon ASIN. Call when the user asks who is selling a product, how many sellers there are, or how much stock competitors hold. Costs 1 analyse credit unle
Sorted worst-first. Each finding shows its severity, what it means, its OWASP MCP Top-10 mapping, and a recommended fix — the check id links to the exact methodology row that produced it.
tool: analyse_product_full
A tool description tries to alter the model’s use of another tool.
— everything in analyse_product plus seller/stock breakdown, buy-box historRecommendationDescriptions must describe only their own tool.
tool: lookup_by_ean
A tool description tries to alter the model’s use of another tool.
e instead of an ASIN, then feed the returned ASIN into analyse_productRecommendationDescriptions must describe only their own tool.
tool: get_storefront_stats
A tool description tries to alter the model’s use of another tool.
illing into get_store_results.RecommendationDescriptions must describe only their own tool.
tool: add_to_sourcing_list
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "notes"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: get_fba_shipment_items
A tool description tries to alter the model’s use of another tool.
es). Call after get_fba_shipments when the user asks what was in a specific sRecommendationDescriptions must describe only their own tool.
tool: get_reconciliation_claims
A tool description tries to alter the model’s use of another tool.
why. Call after get_reconciliation_summary to list the actual claims. status: open, diRecommendationDescriptions must describe only their own tool.
tool: get_oa_retailers
A tool description tries to alter the model’s use of another tool.
lid filters for get_oa_deals.RecommendationDescriptions must describe only their own tool.
tool: start_a2a_finder_scan
A tool description tries to alter the model’s use of another tool.
b_id — poll get_a2a_finder_status(job_id) for results. Premium feature.RecommendationDescriptions must describe only their own tool.
tool: get_a2a_finder_status
A tool description tries to alter the model’s use of another tool.
tarted with start_a2a_finder_scan. Returns progress % and, once complete, theRecommendationDescriptions must describe only their own tool.
tool: start_wholesale_scan
A tool description tries to alter the model’s use of another tool.
b_id — poll get_wholesale_status(job_id) for results. Premium feature.RecommendationDescriptions must describe only their own tool.
tool: start_reverse_source_scan
A tool description tries to alter the model’s use of another tool.
a job_id — poll get_reverse_source_status(job_id) for results. Premium feature.RecommendationDescriptions must describe only their own tool.
tool: get_reverse_source_status
A tool description tries to alter the model’s use of another tool.
tarted with start_reverse_source_scan. Returns progress % and, once complete, theRecommendationDescriptions must describe only their own tool.
tool: (server instructions)
A tool description tries to alter the model’s use of another tool.
e free) — check get_credits if the user asks about limits.RecommendationDescriptions must describe only their own tool.
The server accepts tool enumeration (and likely invocation) with no authentication.
RecommendationRequire OAuth 2.1 authorization for any server exposing non-public tools.
tool: create_price_monitor
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "create_price_monitor"RecommendationScope tools to the minimum needed.
tool: get_deal_tasks
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "get_deal_tasks"RecommendationScope tools to the minimum needed.
tool: create_deal_task
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "create_deal_task"RecommendationScope tools to the minimum needed.
tool: get_repricer_stats
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "get_repricer_stats"RecommendationScope tools to the minimum needed.
Vantaj uptime monitoring via MCP — manage monitors, heartbeats, incidents, and status pages.
Unified gateway to Algeria's TKAWEN ecosystem: commerce, certification, and AI tools.
Provides access to the Cohereon Doctrine AI safety framework with governance components, tiered access, and agent onboarding.
Agentic rails for complex workflows with receipts, fees, and MCP tool access.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
Prices for the same ASIN across international Amazon marketplaces. Call when the user asks about cross-market price differences or EU arbitrage opportunities for a product. Costs 1 analyse credit unle
Calculate Amazon FBA profit and ROI for given sell/cost prices using the full fee engine (tiered referral fees, digital services tax, VAT on fees). Call for what-if questions like 'what would I make s
Resolve a barcode (EAN/UPC, 8-14 digits) to an Amazon ASIN. Call when the user gives a barcode instead of an ASIN, then feed the returned ASIN into analyse_product.
Search Amazon by product title via Keepa and return the top matching ASINs with thumbnails. Call when the user names a product without an ASIN or barcode; present the candidates and let them pick befo
The user's remaining monthly analyse and AI credits and the reset date. Call when the user asks about their usage limits, or after a credit-limit error from an analysis tool.
Search Sorsa's Amazon-to-Amazon (A2A) deal database — products found by the deal monitors with profit, ROI, sales rank and pricing. Call when the user asks for current deals, e.g. 'show me deals over
The user's price-alert notifications from their A2A monitor tasks, grouped by task. Call when the user asks what alerts or notifications they have. show_checked: 'unchecked' (default), 'checked' or 'a
Mark one of the user's notifications as checked (reviewed) or unchecked. Call after the user says they've dealt with an alert, or to un-mark one.
Profitable online-arbitrage (OA) deals: retail products matched to Amazon listings with profit and ROI. Call when the user asks about OA or retail sourcing opportunities. sort: roi, profit, price, new
Products found by the user's storefront monitors (tracking other sellers' Amazon storefronts), newest first. Call when the user asks what their storefront monitors have found; optionally filter to one
The user's Sorsa dashboard summary — headline stats across their monitors and results. Call for a general 'how's it looking' overview before drilling into specific feeds.
List the user's ASIN price monitors (watched products with target prices). Call before creating one to avoid duplicates, or when the user asks what they're watching.
Watch an ASIN and alert the user when its price drops to the target. Call when the user says things like 'watch this' or 'alert me if it goes below £20'. source is the marketplace: Amazon UK, Amazon D
List the user's A2A deal-monitor tasks (saved filters that generate notifications). Call before creating one, or when the user asks what monitors they have set up.
Create an A2A deal-monitor task: the user gets notified whenever the deal feed finds products matching these filters. Call when the user says e.g. 'notify me about deals over £5 profit and 40% ROI in
List the Amazon storefronts (competitor sellers) the user is monitoring. Call before adding one, or when the user asks which storefronts they track.
Start monitoring another Amazon seller's storefront — new products they list will appear in the user's store results. storefront_id is the Amazon seller ID (e.g. A1B2C3D4E5F6G7, found in the seller pa
Summary stats for the user's storefront monitors (stores tracked, result counts). Call for an overview before drilling into get_store_results.
The user's sourcing list — products they've found and are considering buying, with cost/profit projections and status. Call when the user asks about their buy list or sourcing pipeline.
Add a product to the user's sourcing list (their buy list). Call when the user says 'add this to my buy list' — typically after analysing a product, passing through the numbers from the analysis. sour
Items the user has actually purchased from their sourcing list, including listing status (SKU, listing errors). Call when the user asks what they've bought or about listing progress.
The user's logged purchase history. timeframe: all, day, week, month or year. Call when the user asks what they've bought recently.
Purchase statistics: total spent, projected profit, items bought and ROI, broken down daily/monthly/yearly and by category and source. Call for questions like 'how much have I spent this month?'.
The user's live FBA inventory: SKUs, quantities, conditions. Call when the user asks what stock they have or about a specific SKU/product they sell. Requires their Amazon account to be connected (clos
The user's Amazon orders with fees and COGS-based profit. Call for questions like 'how are sales today?' or 'show orders for this SKU'. timeframe: today, yesterday, week, month; or use date_from/date_
The user's inbound FBA shipments with summary stats. Call when the user asks about shipments they've sent to Amazon. Requires a connected Amazon account (closed beta).
The line items inside one FBA shipment (expected vs received quantities). Call after get_fba_shipments when the user asks what was in a specific shipment or whether everything was received.
The user's FBA customer returns with dispositions (sellable, damaged, etc). Call when the user asks about returns. Requires a connected Amazon account (closed beta).
Refunds issued to the user's customers. Call when the user asks about refunds or money returned to buyers. Requires a connected Amazon account (closed beta).
Reimbursements Amazon has paid the user (lost/damaged stock etc). Call when the user asks what Amazon has paid them back. Requires a connected Amazon account (closed beta).
Totals of reclaimable money Sorsa has detected the user is owed by Amazon, broken down by claim type (shipment shortages, lost inventory, unreturned refunds...). Call for 'how much does Amazon owe me?
Individual reclaim opportunities with evidence — what to claim from Amazon and why. Call after get_reconciliation_summary to list the actual claims. status: open, dismissed, filed or all. Requires a c
The user's recent product analyses (ASIN, title, when). Call when the user asks what they looked at recently, or to re-find a product they mention having analysed. limit max 50.
List the retailers available in the OA deals feed. Call to know which retailer names are valid filters for get_oa_deals.
What the user should reorder now. Per-SKU sales velocity vs stock on hand -> days of cover left, a suggested reorder quantity and its potential profit. Call for 'what should I restock?' or 'what's run
Age profile of the user's on-hand FBA stock, bucketed by days on shelf (0-30, 31-90, 91-180, 181-365, 365+), with capital tied up and how much is aged 90+ days (long-term storage-fee risk). Call for '
Per-SKU profit & loss for one calendar month: revenue, Amazon fees, COGS, refunds and net profit, plus account totals. Call for 'what was my profit in <month>?' or 'break down last month's P&L'. month
Per-SKU profitability over the last N days: units, revenue, profit, ROI, return rate, current price vs break-even and a selling-at-a-loss flag. Call for 'which products make or lose me money?' or 'wha
The user's own top-selling ASINs by net profit for each of the last N months, derived from their sales. Call for 'what are my best sellers?' or 'top products this year'. months up to 24, top_n up to 5
Check whether the user is allowed to sell (ungated for) one or more ASINs on their Amazon account. Call for 'am I ungated for this?' or 'can I sell these ASINs?'. Returns per-ASIN {state, gated, apply
Start an A2A Finder scan: check a list of ASINs for profitable Amazon-to-Amazon flips across marketplaces (buy on one Amazon country, sell on another). Up to 100 ASINs. Optional `countries` = list of
Status and results of an A2A Finder scan started with start_a2a_finder_scan. Returns progress % and, once complete, the profitable cross-marketplace flips found (per ASIN, per country).
List the user's recent A2A Finder scan jobs and their status. Call to find a job_id whose results to fetch.
Start a Wholesale Scanner run against a supplier price list. Each item in `products` is a dict with 'title', 'price' (cost per unit), and 'ean' (barcode — needed to match, the default scan is EAN-base
Status and results of a Wholesale Scanner run. Returns progress % and, once complete, each supplier product matched to Amazon with sell price, profit and ROI.
List the user's recent Wholesale Scanner jobs and their status. Call to find a job_id whose results to fetch.
Start a Reverse Source scan: for each ASIN, search Google Shopping for a cheaper source than Amazon — i.e. where to buy the product to flip it. Up to 250 ASINs. Uses the shared Keepa scan key (counts
Status and results of a Reverse Source scan started with start_reverse_source_scan. Returns progress % and, once complete, the cheapest Google Shopping source found per ASIN (retailer, price, link).
List the user's recent Reverse Source scan jobs and their status. Call to find a job_id whose results to fetch.
The user's repricer SKUs with live pricing state: current price, Buy Box price, lowest FBA price, cost/min/max, strategy, computed profit/ROI at the current price, floor price and stock. Call when the
Recent repricer price changes, newest first: SKU, old → new price, the reason, the reference price it repriced against (Buy Box / lowest FBA) and whether the floor or ceiling capped the move. Call whe
Repricer dashboard summary: total/active SKU counts, per-status breakdown, Buy Box wins and win %, items matching the Buy Box exactly, units actively repricing and the last update time. Call first for
The user's global repricer settings: whether repricing is globally enabled, seller ID, default strategy, default minimum ROI, allowed strategies and VAT registration. Read-only — changing settings is