lemonsqueezy-mcpCAUTION
LemonSqueezy MCP server for managing your store from AI assistants
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://yaw.sh/mcp/install?name=LemonSqueezy&command=npx&args=-y%2C%40yawlabs%2Flemonsqueezy-mcp&description=LemonSqueezy%20store%20management%20-%20products%2C%20orders%2C%20subscriptions%2C%20license%20keys&source=https%3A%2F%2Fgithub.com%2FYawLabs%2Flemonsqueezy-mcp)
One click adds this to your local Yaw MCP config so it's available in every Yaw Terminal session. Or install manually below.
MCP server for the LemonSqueezy API. Manage your store, products, customers, subscriptions, discounts, license keys, and more from any MCP-compatible AI assistant.
Quick start
npx -y @yawlabs/lemonsqueezy-mcp@latest
Requires Node.js 22 or later (engines.node is >=22).
Or one-click install via Smithery:
npx -y @smithery/cli install @yawlabs/lemonsqueezy-mcp --client claude
Smithery prompts for your env vars (API key, optional guardrails) and writes the config into your client for you.
What it looks like
Once configured, you can ask your AI assistant store-management questions in plain English and it routes them through the MCP tools:
You: How much did we make from the "Pro Annual" plan last month? Claude: [calls ls_list_subscriptions, ls_get_variant, ls_list_subscription_invoices] Pro Annual brought in $14,280 across 84 active subscriptions in April. Three of those were upgrades from monthly; none churned. You: Refund order #LS-1234 in full. Claude: [calls ls_get_order to fetch the total, then ls_refund_order with amount = total] Refunded $99.00 against order LS-1234. The customer's card will see the credit in 5-10 business days. You: Disable license key abc-123 for the customer who reported abuse. Claude: [calls ls_list_license_keys to find the ID, then ls_update_license_key with disabled: true] License key disabled. Their existing activations will fail validation on
08bd65a77aa0OBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add lemonsqueezy-mcp -- npx -y @yawlabs/[email protected]
Exposed tools (3)
2 read · 1 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
ls_bad | read | x |
ls_create_checkout | write | test |
ls_test_read | read | test read tool |
Trust audit
CAUTIONgrade B · trust 84/100 Install with care. The audit found things worth knowing before you trust its output.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (1 observation(s))
- Network
- declared (6 observation(s))
- Shell
- declared (3 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (11)
const SSH = 'ssh -i ~/.ssh/gh_woods -o IdentitiesOnly=yes';
const secret = "super-secret-distinguishable-value-12345";
return new Function(`${pieces}\nreturn runtimePlan;`)() as RuntimePlan;return new Function(`${pieces}\nreturn { pickNewest, floor: OAM_MIN };`)() as {new Function("process", `${pieces}\nreturn ${name};`)({- **The sandbox's network grant is port-scoped:** `api.lemonsqueezy.com:443`, and the sink's host on the port its URL names (or 80 / 443 by scheme; an IPv6 literal bracketed). From oam 0.18.0 a `host:
assert.equal(sink("http://127.0.0.1:8080/"), "--allow-net=api.lemonsqueezy.com:443,127.0.0.1:8080");@biomejs/biome, @modelcontextprotocol/sdk, @types/node, @yawlabs/mcp-compliance, esbuild, postject, typescript, zod
- **The bundled MCP SDK moves from 1.30.0 to 1.32.1** (GHSA-6qxp-vccf-f47h, high: the SDK's OAuth client could send credentials to an authorization server chosen by the MCP server; this server does no
- `.github/workflows/release.yml` now publishes to the [Official MCP Registry](https://registry.modelcontextprotocol.io) after the post-publish smoke test passes. Authentication is via GitHub OIDC --
- **Internal modules**: everything in `src/` (`api.ts`, `wrapper.ts`, `guardrails.ts`, `redact.ts`, `audit-buffer.ts`, `effective-price.ts`, `retry.ts`, `secret.ts`, `logger.ts`, and the helpers the t
Gates applied: no_behavioural_pass.
08bd65a77aa0full audit observations/trust-audit/mcp-server/yawlabs__lemonsqueezy-mcp.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 08bd65a77aa0 | CAUTION | B | 84 | first audit |
Questions
What is the lemonsqueezy-mcp MCP server?
LemonSqueezy MCP server for managing your store from AI assistants
What tools does lemonsqueezy-mcp expose?
3 in total: 2 read-only, 1 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is lemonsqueezy-mcp safe to connect to an agent?
With care. The audit graded it B (84/100) and found 11 things worth knowing before you trust this server, listed below with the exact line each was found on.
What credentials does lemonsqueezy-mcp need?
It reads GH_TOKEN, GITHUB_TOKEN, LEMONSQUEEZY_API_KEY, LEMONSQUEEZY_API_KEY_COMMAND, LEMONSQUEEZY_SINK_ADMIN_TOKEN and LEMONSQUEEZY_TEST_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does lemonsqueezy-mcp run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as @yawlabs/lemonsqueezy-mcp at 1.1.0.
How current is this page?
The grade is for one exact copy of the source (08bd65a77aa0), read on 2026-10-11. The repository is watched and re-audited when it changes.