Pirate Ship API and MCP server, self-hosted
A Pirate Ship API and a Pirate Ship MCP server you run on your own computer, in Python, on the session of your own Google Chrome. 51 of the 57 Pirate Ship tools we run in production at Cotlet: USPS and UPS rates, draft labels and batches, label downloads, SCAN Forms, shipments and tracking, reports, store order import, Ship From Addresses, Saved Packages, tracking emails and label settings. The six tools that spend or refund money are not in this version.
Pirate Ship has no public API and no official MCP server. This repo gives you both:
- MCP server for Claude Code, Claude Desktop, Cursor, Codex and any MCP client, over stdio or HTTP. Setup
- REST API on
http://127.0.0.1:8787/api/v1/pirate-ship, with OpenAPI docs at /docs. Setup
- Python:
call("get_rates", to_zip="10001", weight_oz=16), plus 11 ready scripts in examples/.
It is for technical people who want to run it themselves, for noncommercial use only (license). If you want it running 24/7 on a server, kept working when Pirate Ship changes its app, for a team or a business, use the hosted version at cotlet.dev.
[Pirate Ship MCP server]
[Python 3.11+]
[License: PolyForm Noncommercial 1.0.0]
[MCP Badge]
Contents
How it works
- You sign in to Pirate Ship in your own Chrome, the way you always do.
pirate-ship-mcp connect attaches to that Chrome through the Chrome DevTools Protocol, reads the pirateship.com cookies and Chrome's time zone, and saves them to ~/.config/pirate-ship-api-mcp/session.json, readable by your user only. It never sees or stores your password.
- Every tool call is one of the GraphQL operations Pirate Ship's own web app sends to
ship.pirateship.com/api/graphql, with those cookies, sent with curl_cffi, which copies Chrome's TLS fingerprint. No headless browser runs.
Pirate Ship's web app sends each operation as a persisted query: its name and the sha256 of the query text. The tools may send only the operations listed in operations.py, and account, password, payment method and identity operations are not on that list. When Pirate Ship changes one of the listed queries, the tool answers "Pirate Ship changed its app" until we record the new hash.
Pirate Ship's session cookie lives about a day and is renewed by use. When Pirate Ship signs you out, the server reads the cookies from Chrome again, if Chrome is open with remote debugging on. Tick "Stay signed in" when you sign in, so Chrome keeps you signed in between visits.
Requirements
- Python 3.11 or newer.
- Google Chrome 144 or newer, signed in to Pirate Ship. Any Chrome or Chromium works with a debugging port.
- macOS, Linux or Windows.
- A Pirate Ship account with a Ship From Address. Rates, drafts, reports and settings need nothing else. Buying labels needs Account Balance or a payment method, and you buy in Pirate Ship itself.
Install
From PyPI:
MCP clients can also run it with no install: uvx pirate-ship-api-mcp mcp.
From source:
With uv: uv venv && uv pip install -e ., then uv run pirate-ship-mcp ....
Setting it up with an AI agent (Claude Code, Codex, Cursor)? Open it in this folder and ask it to set up the repo: AGENTS.md tells it every step, and it asks you only for the steps in Chrome.
To update: uv tool upgrade pirate-ship-api-mcp (or pip install -U pirate-ship-api-mcp), from source git pull && pip install -e .. We copy every change of the hosted Pirate Ship tools into this repo.
Connect your Chrome
Option A: your everyday Chrome (recommended)
-
Open chrome://inspect/#remote-debugging in Chrome and switch remote debugging on. Chrome then accepts DevTools connections from programs on this computer, and asks you before each one.
-
Make sure you are signed in at ship.pirateship.com.
-
Run:
-
Chrome asks whether to allow the connection. Click Allow.
Leave remote debugging on if you want the server to pick up a new session by itself after Pirate Ship signs you out. With a one-day cookie, that happens more often than with most apps.
connect looks for Chrome's DevToolsActivePort file in the default profile folder. For Chrome Beta, Canary or a custom profile folder, pass --profile-dir "<folder>".
Option B: a Chrome with a debugging port
Chrome does not open a debugging port on your default profile, so start a separate one, sign in to Pirate Ship there once, and connect to it:
--cdp also takes a ws:// DevTools URL, for example of a Chrome on another machine reached over an SSH tunnel.
Option C: paste the cookie by hand
For a server with no Chrome: in Chrome open DevTools on ship.pirateship.com, Application > Cookies > https://ship.pirateship.com, copy the value of pirate_id_f0fecf84, then:
A pasted cookie is not refreshed on its own, and this one lasts about a day without use. Paste a new one when Pirate Ship signs you out.
Check the session at any time:
MCP server
The MCP server lists every tool with its input schema, a description written for agents, and hints: read tools are marked read-only, and tools that delete something or change what your recipients get are marked so your client asks before running them.
Claude Code
Claude Desktop
~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):
Cursor
~/.cursor/mcp.json, the same block as Claude Desktop. A ready copy is in mcp.json.
Codex
~/.codex/config.toml:
Over HTTP
pirate-ship-mcp serve also serves MCP over streamable HTTP at http://127.0.0.1:8787/mcp, for clients that take a URL:
Then ask your agent things like:
What does a 2 lb box, 12x10x6, cost to ZIP 94103 with USPS and UPS? Cheapest first.
Make a draft batch from orders.csv with my "Small box" Saved Package and show me the rates per group.
Which labels from the last 10 days still have no carrier scan?
How much did I spend on labels in October, and what were the carrier adjustments?
REST API
Each tool has its own route under /api/v1/pirate-ship, the same paths as the hosted API at cotlet.dev, so code written against one works with the other. Path parts and the query string are arguments, and a JSON body adds the rest.
Any tool by name, body as its arguments:
GET /api/v1/pirate-ship/tools: every tool with its route, input schema and an example answer.
GET /docs: interactive OpenAPI docs, GET /openapi.json the schema, for n8n, Postman or a generated client.
- Answers are JSON. Report lists take
limit and offset and answer with total.
The server listens on 127.0.0.1 only. To reach it from another device of yours, set a token, and every request then needs Authorization: Bearer <token>:
Python and the example scripts
Straight from Python, no server needed:
Or one tool from the shell: pirate-ship-mcp call list_shipments limit=10, or with a JSON object.
Ready scripts in examples/. Each prints JSON or a short report, takes --out file.csv or --out file.json where it makes sense, and --help:
On a schedule, cron on your own computer works while it is on: 0 18 * * 1-5 cd ~/pirate-ship-api-mcp-server && .venv/bin/python examples/tracking_report.py --days 10 --out late.csv.
All 51 tools
Money is in US dollars, weights in ounces, sizes in inches, dates in Chrome's time zone. pirate-ship-mcp tools prints this list, pirate-ship-mcp tools --json adds the input schemas.
Rates and addresses
Draft labels and batches
Printing and SCAN Forms
Shipments and tracking
Reports, balance and refunds
Pickups
Store orders
Ship From Addresses
Saved Packages
Tracking emails
Label settings
Not in this version
In tool descriptions "buy it with buy_label" means: buy the draft in Pirate Ship's web app. Never built, on purpose: your Pirate Ship sign-in, email, password, security settings, payment methods, billing and identity checks.
Configuration
Security and your Pirate Ship account
- Your password never reaches this code. Only cookies are read, and only those of pirateship.com.
- The session file is yours.
session.json is created with mode 0600. Anyone who has it can act as you on Pirate Ship, so keep it out of git and shared folders.
- Local by default.
serve binds to 127.0.0.1 and refuses another address without PIRATE_SHIP_MCP_TOKEN.
- pirateship.com only. Requests and redirects outside pirateship.com are refused.
- No tool moves money. None buys a label, requests a refund, books a paid pickup or touches your payment methods.
- Read-only mode.
--read-only or PIRATE_SHIP_MCP_READ_ONLY=1 exposes the 29 read tools only.
- Some changes reach your recipients. Tracking email settings and templates change the emails your customers get. MCP clients ask before those tools run; a script does not.
Errors
The REST API answers {"error": "<code>", "message": "..."}. The MCP server returns the same code and message as a tool error.
Self-hosted or hosted
On the hosted version a successful call uses 10 credits, failed calls are free, and the Cloud Browser uses 50 credits a day while it has an app enabled for agents. Full pricing.
FAQ
Does Pirate Ship have an official API?
No. Pirate Ship has no API, no webhooks and no official MCP server (checked 11 Oct 2026). Its help center says so and points to the built-in store integrations and spreadsheet uploads instead. Details: cotlet.dev/integrations/pirate-ship-api-mcp-server.
Is there a Pirate Ship MCP server for Claude, ChatGPT or Cursor?
Yes, this one runs on your machine: pirate-ship-mcp mcp for Claude Code, Claude Desktop, Cursor and Codex. ChatGPT and Claude.ai connectors need a public HTTPS URL, which the hosted Pirate Ship MCP server gives you.
Can I get USPS and UPS rates from a script?
Yes. get_rates returns every service with Pirate Ship's price, the retail price, zone and delivery estimate, cheapest first, and saves nothing: python examples/compare_rates.py --to-zip 10001 --weight-oz 16 --size 10x8x4.
Can it buy labels?
Not this repo. It builds the draft (create_shipment, create_batch, create_batch_from_orders) with the rates of each group, and you click Buy in Pirate Ship. The hosted version has buy_label with a price cap per purchase.
Can I create a batch from a spreadsheet or from my store orders?
Yes. create_batch takes up to 500 recipients per call, create_batch_from_orders takes orders from your connected stores. examples/draft_batch_from_csv.py reads a CSV.
Can I export shipments and tracking to CSV?
Yes: python examples/export_shipments.py --since 2026-10-01 --out october.csv, or export_shipments for Pirate Ship's own spreadsheet with every column.
Why does it need my Chrome?
To read your Pirate Ship session without your password. Pirate Ship's sign-in sits behind a Cloudflare check, so you sign in in the browser and plain requests do the rest. Chrome is used once per sign-in, not for each call.
What happens when Pirate Ship signs me out?
Calls fail with auth_expired. With Chrome remote debugging on, the server reads the new cookies on the next call (click Allow when Chrome asks); otherwise run pirate-ship-mcp connect again.
Can it run on a VPS or in Docker?
Technically yes, with PIRATE_SHIP_AUTH_TOKEN. The cookie lasts about a day without use, Pirate Ship then sees your session from a datacenter IP. For an always-on setup the hosted version keeps your session in your own Cloud Browser.
Will my Pirate Ship account get blocked?
Requests carry Chrome's fingerprint and go out one at a time, as you would click. Nobody can promise a platform never acts. Keep to your normal use.
Can I use it at work or for my clients?
No, the license allows noncommercial use only. For a team, a company or client work, use Cotlet or write to [email protected].
Is it open source?
The source is public, the license is not an open source license: noncommercial use only, no business use.
A tool broke or I need another one.
Open an issue with the tool name and the error message.
License
PolyForm Noncommercial License 1.0.0. In short:
- Allowed: noncommercial use: you, for your own personal purposes with your own Pirate Ship account, or a charity, school, public research or government body. Changing the code, and sharing it under the same license.
- Not allowed: any commercial use, your own business included; client work; selling or offering it, or a service built on it.
[Cotlet]
Maintained by Cotlet (@cotletdev). Pirate Ship is a trademark of its owner. This project is unofficial and not affiliated with, endorsed or sponsored by Pirate Ship.