StarShipIt MCP

StarShipIt MCP Server: shipping orders, labels and tracking for AI agents

[npm] [CI] [License: ISC]

StarShipIt MCP server lets Claude Desktop, Claude Code, Cursor, VS Code and any MCP client manage StarShipIt orders, print labels, track shipments, compare rates and manifest with carriers. It runs with npx on Node.js 22 or later, over stdio or local HTTP, and calls the StarShipIt API with your own keys.

Quickstart

Get your keys in StarShipIt under Settings > API: the API Key and the Subscription key. Then, for Claude Code:

read -rsp 'StarShipIt API key: ' STARSHIPIT_API_KEY; echoread -rsp 'StarShipIt subscription key: ' STARSHIPIT_SUBSCRIPTION_KEY; echoclaude mcp add --scope local starshipit \  -e STARSHIPIT_API_KEY="$STARSHIPIT_API_KEY" \  -e STARSHIPIT_SUBSCRIPTION_KEY="$STARSHIPIT_SUBSCRIPTION_KEY" \  -- npx -y @devkind/starshipit-mcp

read -rsp keeps the keys out of your shell history. --scope local stores them in your user config, outside the repository.

Then ask: "List my unshipped StarShipIt orders."

Install in your client

Requirements:

• Node.js 22 or later (the server runs with npx)
• A StarShipIt API key and subscription key
• Claude Desktop, Claude Code, Cursor, VS Code, Windsurf, or another MCP client

Standard config works in most MCP clients:

{  "mcpServers": {    "starshipit": {      "command": "npx",      "args": ["-y", "@devkind/starshipit-mcp"],      "env": {        "STARSHIPIT_API_KEY": "your-api-key",        "STARSHIPIT_SUBSCRIPTION_KEY": "your-subscription-key"      }    }  }}

Do not put real keys in a project .mcp.json or any other file that you commit.

code --add-mcp '{"name":"starshipit","command":"npx","args":["-y","@devkind/starshipit-mcp"],"env":{"STARSHIPIT_API_KEY":"your-api-key","STARSHIPIT_SUBSCRIPTION_KEY":"your-subscription-key"}}'

Tools

The server has 40 tools. Every tool declares MCP annotations: 15 are read-only and 5 are destructive, so a client can ask before it changes data. 20 list and lookup tools accept response_format (markdown or json). Every tool also returns the full API response as structured content.

Destructive tools: starshipit_delete_order, starshipit_merge_orders, starshipit_replace_shipment, starshipit_delete_addresses, starshipit_delete_products. Archive is reversible with starshipit_restore_order.

Example

{ "tool": "starshipit_track_shipment", "arguments": { "tracking_number": "2XD198209601000935102" } }

Illustrative output (the values are not real):

## Tracking: 2XD198209601000935102
**Status:** InTransit**Order:** 1001 (Shipped)**Carrier:** Australia Post
### Tracking Events
- **2026-10-30T09:12:00Z — InTransit:** Item processed at facility

Other prompts: "Compare rates for a 2 kg parcel from Melbourne 3000 to Paddington 2021", "Which orders can be merged?", "Manifest all unmanifested Australia Post shipments".

Configuration

The server starts and lists its tools without keys. Each tool call without keys returns an error that names the missing variable.

Claude Code plugin

The repository root is a Claude Code plugin. It adds the StarShipIt MCP server, pinned to the release version, and prompts for the two keys when you enable it. Claude Code stores the keys in your system credential store, not in settings.json.

The plugin also ships the starshipit-shipping skill. The skill teaches Claude the fulfilment order: find the order, pick a service, print the label, manifest and track. Claude asks you before it prints a label, manifests or runs a destructive tool.

Install it now (Claude Code 2.1.275 or later):

/plugin install starshipit --marketplace devkindhq/starshipit-mcp

On older Claude Code versions, use the claude mcp add command in the Quickstart. A listing in the Claude plugin directory comes later.

HTTP mode

TRANSPORT=http STARSHIPIT_API_KEY=... STARSHIPIT_SUBSCRIPTION_KEY=... npx -y @devkind/starshipit-mcp# MCP endpoint: http://127.0.0.1:3000/mcp  (stateless Streamable HTTP)# Health check: http://127.0.0.1:3000/health

By default the server listens on 127.0.0.1 only. It rejects requests whose Host header is not localhost, 127.0.0.1 or ::1, which blocks DNS rebinding attacks from web pages. Set MCP_HOST=0.0.0.0 to listen on all interfaces, for example in a container.

Warning: HTTP mode has no authentication, and every request runs with the server's StarShipIt keys. If you set MCP_HOST to anything other than a loopback address, put an authenticating proxy in front of the server.

Development

git clone https://github.com/devkindhq/starshipit-mcp.gitcd starshipit-mcpyarn install --frozen-lockfileyarn buildnode --env-file=.env dist/index.js

Put your keys in .env (STARSHIPIT_API_KEY= and STARSHIPIT_SUBSCRIPTION_KEY=). Git ignores that file. See CONTRIBUTING.md for the checks, commit style and release process.

Built by

Built by Devkind. Maintained by the Devkind team.

License

ISC. See CONTRIBUTING.md and SECURITY.md.

Shipping with StarShipIt?

Devkind builds the store and fulfilment side around it. We work with Shopify, Swell and headless commerce stacks, and build custom MCP servers and AI agent workflows for operations teams. Talk to Devkind or email [email protected].