generated: '2026-08-12'
method: derived
source: openapi/thrivecart-api-openapi.yml
status: candidate
summary: >-
  ThriveCart operates no first-party Model Context Protocol server. Probes on 2026-08-12 found no
  /.well-known/mcp.json, no MCP endpoint on thrivecart.com or developers.thrivecart.com, and no
  mention of MCP anywhere on developers.thrivecart.com or in the API reference. Every ThriveCart
  "MCP server" currently discoverable is a third-party gateway wrapping the REST API - Zapier MCP,
  Pipedream MCP, viaSocket, mcpforclaude - none of them ThriveCart-operated. The tool set below is
  DERIVED by API Evangelist from the 33 operations of the ThriveCart API as a proposal for an
  agent-facing surface. It is not published by ThriveCart.
server: null
transport: null
url: null
auth:
  type: http
  scheme: bearer
  note: >-
    Any MCP server over this API would inherit ThriveCart's single account-wide bearer token. There
    is no scope model, so an MCP server cannot be granted read-only access - a token that can list
    products can also issue refunds and cancel subscriptions. That is the central design problem
    for an agent surface here, and it is ThriveCart's to fix.
third_party_servers:
- name: Zapier MCP
  url: https://zapier.com/mcp/thrivecart
  operator: Zapier
  first_party: false
- name: Pipedream MCP
  url: https://mcp.pipedream.com/app/thrivecart
  operator: Pipedream
  first_party: false
- name: viaSocket MCP
  url: https://viasocket.com/mcp/thrivecart
  operator: viaSocket
  first_party: false
candidate_tools:
- name: get_account
  maps_to: GET /ping
  category: read
  description: Read the account and user a token resolves to, and validate the token.
- name: list_products
  maps_to: GET /products
  category: read
  description: List every product in the account with status and type.
- name: get_product
  maps_to: GET /products/{product_id}
  category: read
  description: Read one product by numeric id.
- name: get_product_pricing
  maps_to: GET /products/{product_id}/pricing_options
  category: read
  description: Read a product's pricing options, optionally with commissions for a given affiliate.
- name: list_bumps
  maps_to: GET /bumps
  category: read
- name: get_bump
  maps_to: GET /bumps/{bump_id}
  category: read
- name: get_bump_pricing
  maps_to: GET /bumps/{bump_id}/pricing_options
  category: read
- name: list_upsells
  maps_to: GET /upsells
  category: read
- name: get_upsell
  maps_to: GET /upsells/{upsell_id}
  category: read
- name: get_upsell_pricing
  maps_to: GET /upsells/{upsell_id}/pricing_options
  category: read
- name: list_downsells
  maps_to: GET /downsells
  category: read
- name: get_downsell
  maps_to: GET /downsells/{downsell_id}
  category: read
- name: get_downsell_pricing
  maps_to: GET /downsells/{downsell_id}/pricing_options
  category: read
- name: search_transactions
  maps_to: GET /transactions
  category: read
  description: Page through transactions filtered by query, type (any/charge/rebill/refund/cancel)
    and currency. perPage max 100.
- name: get_customer
  maps_to: POST /customer
  category: read
  description: Read a customer record by email address.
- name: update_customer_email
  maps_to: POST /customerEmailUpdate
  category: write
  description: Change a customer's email address, optionally merging records.
- name: refund_transaction
  maps_to: POST /refund
  category: write
  consequence: irreversible - moves money
  description: Refund an item on an order, identified by order_id and a composite reference such
    as "product-299".
- name: cancel_subscription
  maps_to: POST /cancelSubscription
  category: write
  consequence: irreversible - ends recurring revenue
- name: pause_subscription
  maps_to: POST /pauseSubscription
  category: write
  description: Pause a subscription, optionally with an auto_resume Unix timestamp at least 24
    hours in the future.
- name: resume_subscription
  maps_to: POST /resumeSubscription
  category: write
- name: search_affiliates
  maps_to: GET /affiliates
  category: read
  description: perPage max 25.
- name: get_affiliate
  maps_to: POST /affiliate
  category: read
  description: Read an affiliate by affiliate_id, affiliate_user_id or email.
- name: create_affiliate
  maps_to: POST /affiliates
  category: write
- name: register_affiliate_for_products
  maps_to: POST /affiliates/{affiliate_id}/register
  category: write
- name: approve_affiliate
  maps_to: POST /affiliates/{affiliate_id}/approve
  category: write
- name: reject_affiliate
  maps_to: POST /affiliates/{affiliate_id}/reject
  category: write
- name: favorite_affiliate
  maps_to: POST /affiliates/{affiliate_id}/favorite
  category: write
- name: unfavorite_affiliate
  maps_to: POST /affiliates/{affiliate_id}/unfavorite
  category: write
- name: set_affiliate_custom_commissions
  maps_to: POST /affiliates/{affiliate_id}/custom_commissions
  category: write
  consequence: changes payout economics
- name: delete_affiliate
  maps_to: POST /affiliates/{affiliate_id}/delete
  category: write
  consequence: destructive
- name: create_student
  maps_to: POST /students
  category: write
  description: Grant a student access to a course, optionally associated with a ThriveCart order.
- name: create_event_subscription
  maps_to: POST /subscribe
  category: write
  description: Subscribe an HTTPS endpoint to one event key or to "*", with optional trigger_fields.
- name: delete_event_subscription
  maps_to: POST /unsubscribe
  category: write
candidate_tool_count: 33
notes:
- >-
  Nine of the 33 candidate tools are consequential writes (refund, cancel, pause, resume, custom
  commissions, delete affiliate, create student, subscribe, unsubscribe) and the API offers no
  idempotency key on any of them, so an MCP client that retries after a timeout can double-refund.
  Any real server built on this should carry its own idempotency layer.
- >-
  Because test and live share one credential (see sandbox/thrivecart-sandbox.yml), an MCP server
  cannot be pointed at a safe environment for evaluation.