Affiliate Networks MCP

Overview

From the repository's own README, as read at the audited commit.

# affiliate-mcp> Integrate your affiliate networks with Claude or Codex.[![npm version](https://img.shields.io/npm/v/affiliate-networks-mcp?label=release)](https://www.npmjs.com/package/affiliate-networks-mcp) ![networks](https://img.shields.io/badge/networks-72-blue) ![adapters](https://img.shields.io/badge/adapters-86-blue) [![maintained by](https://img.shields.io/badge/maintained%20by-community%20%2F%20networks-orange)](./docs/networks)> **Network operators:** most adapters are community-built and `experimental`. Adoption gives your team ownership and a verification path; promotion to `partial` or `production` still requires current evidence and maintainer review. Find your network's issue under the [`adopt-this-network`](https://github.com/bobberrisford/affiliatemcp/issues?q=is%3Aissue+is%3Aopen+label%3Aadopt-this-network) label.Affiliate networks have two sides — and neither has a first-class AI workspace integration.**Publishers** earn commissions from the programmes they join.**Brands** (and the agencies who manage them) run those programmesand pay the commissions out. I wanted to chat to my own affiliatedata in the AI workspace I already use; none of the networks had shipped anintegration for either side, so I built a broad beta set that covers bothpublisher and advertiser-side work.If you're a **publisher**, you can ask:> *"What did I earn across all networks last month?"*>> *"Which programmes have transactions still pending after 90 days?"*>> *"Compare my earnings month on month."*If you're on the **brand side** — running a programme, or an agencymanaging several — you can ask:> *"How is Acme's programme doing this quarter?"*>> *"Show me revenue across all my clients this week."*>> *"Any anomalies in the affiliate data?"*Your AI workspace figures out which networks to call, fetches the data live fromtheir APIs, and gives you the answer. You can use Claude or Codex to turn itinto a sheet, an artifact, an email to your boss, whatever you want.Free and open s

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude mcp add affiliate-networks-mcp -- npx -y [email protected]

Exposed tools (57) 51 read · 6 write · 0 destructive

Details

Source

bobberrisford/affiliatemcp

npm

affiliate-mcp-waitlist@0.1.0

Transports

stdio · streamable-http

Credentials it reads

HOSTED_AUTH_URL

License

MIT

Stars

6 · pushed 32d ago

Trust audit

Do not install this without reading the findings. The audit found something that could harm you or your machine.

What the source does

Filesystem

declared (5 observation(s))

Network

declared (8 observation(s))

Shell

declared (1 observation(s))

Dependencies

not all pinned

Secrets in source

found

Findings (25)

Credentials are read via `requireCredential` from `src/shared/config.ts`. Never

read `process.env` directly inside an adapter — missing values must surface as

icon.icns

.agents/skills/delivery-steward

.agents/skills/prepare-for-review

.agents/skills/review-pr

authUrl: `http://127.0.0.1:${worker.port}`,

vaultUrl: `http://127.0.0.1:${worker.port}`,

const baseArgs = ['server', '--url', `http://127.0.0.1:${proxy.port}/mcp`, '--spec-version', '2026-07-28'];

const secret = 'AWIN-TOKEN-2f9c-do-not-leak';

formPost('/authorize/consent', { auth_req: reqId, token: 'amcps_not_a_real_token', decision: 'approve' }),

await putCredentials(kv, provider, 'hosted_usr_a', 'awin', { apiKey: 'sekret-plaintext-marker' });

*   secret = "ATj7vd8b7CCjeq9yQUo8cc2w3OThqe2e"

const token = 'amcps_digest.token.e2e';

.eslintrc.cjs

const MARK = '../../design-system/assets/mark.svg';

import { isValidBrandSlug, registerBrand, suggestSlug } from '../../shared/brands.js';

import { assertMultiBrandAdapter } from '../../shared/brand-resolver.js';

import { NotImplementedError } from '../../shared/errors.js';

import type { DiscoveredBrand, NetworkAdapter } from '../../shared/types.js';

# The beacon ships as a placeholder so the repo never carries an

# set, substitute it; if it is not, strip the beacon entirely rather than

- name: Inject or strip the analytics beacon

`cloudflared tunnel --url http://127.0.0.1:<port>`, captures the

const res = await worker.fetch(jsonPost('/register', { redirect_uris: ['http://127.0.0.1:8976/callback'] }), env);

Gates applied: no_behavioural_pass.

Audited 2026-09-13 · audit v0.4.0 · source sha b3a1a386917b · full audit: observations/trust-audit/mcp-server/bobberrisford__affiliate-networks-mcp.json · Report an issue or request a re-scan

Audit history

Also audited

Servers with a similar trust profile.

Questions