An AI assistant can only reason over the context it receives. If your competitor research lives in browser tabs, spreadsheets, ad libraries, and screenshots, the model cannot reliably use it. You can paste records manually, but that workflow becomes slow and stale as soon as the market changes.
The Model Context Protocol, or MCP, gives AI clients a standard way to call external tools. For ecommerce research, an MCP server can let Claude, ChatGPT, Cursor, or another compatible client retrieve current ads, traffic, products, shops, and organic posts when a question requires them.
This guide explains what an ecommerce MCP server does, how to evaluate one, and how to connect the WhatWins MCP endpoint securely.
What is an ecommerce MCP server?
An ecommerce MCP server is a service that exposes commerce or market-intelligence functions as structured tools an AI client can discover and call.
Instead of pasting a CSV into a chat, you can ask:
Compare the six-month traffic of @gymshark and @aloyoga, then show their top visitor markets.
The client can call a traffic-comparison tool with the resolved store IDs and requested range. It receives structured results, then uses those results to write the answer.
The MCP server is not the model. It is the controlled data and action layer between the model and the underlying application.
Why MCP is useful for ecommerce research
Ecommerce questions often cross several datasets.
- Which competitor ads have run the longest?
- Which organic videos outperform an account's baseline?
- Is a shop's traffic rising or falling?
- Which countries supply most of its visitors?
- What products were added recently?
- Which specialist shops sell a specific product?
A normal chatbot must guess or rely on a static web search. An MCP-connected client can select a purpose-built tool, pass validated parameters, and receive current structured records.
The eight WhatWins MCP tools
The WhatWins MCP server exposes the same bounded research tools used by WhatWins AI.
| Tool | What it retrieves |
|---|---|
search_ads | Verified Meta or Google ad creatives ranked by requested filters |
get_top_organic_posts | Organic posts ranked by views, likes, shares, saves, engagement, or outlier score |
compare_shop_traffic | Current and historical monthly traffic for selected shops |
compare_live_ads | Observed Meta or Google live-ad history |
get_shop_products | Verified products and catalog summaries for selected shops |
discover_products | Products matching a query across the indexed catalog |
discover_shops | Relevant specialist shops outside the organization's tracked list |
get_shop_overview | Brand, market, pricing, review, catalog, and technology context |
The distinction between tool scopes matters. search_ads covers verified Meta and Google creatives. Organic TikTok, Instagram, and YouTube posts are queried through get_top_organic_posts. The server does not silently substitute one source for another.
How a real MCP request works
A typical request has five stages.
1. The client lists available tools
The MCP client connects to the server and retrieves tool names, descriptions, and JSON input schemas. The schema tells the model which parameters are accepted and which are required.
2. The model chooses a tool
For "top organic videos ranked by shares," the client should choose get_top_organic_posts, not search_ads. For "traffic over six months," it should choose compare_shop_traffic.
3. The server validates input
Every call passes through a concrete schema. Unknown fields, invalid limits, unsupported sources, and malformed identifiers are rejected rather than forwarded to the database.
4. Authorization is enforced server-side
An MCP key belongs to one WhatWins organization. Access to tracked private store IDs is checked on the server. Hiding a store in the interface is not treated as authorization.
5. The client receives structured content
The result is returned as JSON-RPC structured content. The AI client can summarize it, compare it, or feed it into another step without scraping text from a webpage.
Connecting the WhatWins MCP server
MCP access starts on the WhatWins Pro plan. Organization owners and admins can connect remote apps with OAuth or manage static keys for CLI clients from the organization settings.
Step 1: connect the Claude app
Keep Claude app selected in WhatWins and click Connect to Claude. The button opens Claude's custom-connector dialog with WhatWins and the server URL prefilled. Add the connector, sign in to WhatWins, choose one organization, and allow access. OAuth Client ID and Secret stay empty; no API key or request header needs to be copied.
Step 2: connect ChatGPT
On ChatGPT web, open Settings → Apps → Advanced settings, enable Developer mode, and choose Create app. Set the name to WhatWins, use https://whatwins.io/api/mcp as the server URL, choose OAuth, and scan the tools. The Open ChatGPT & copy URL button in WhatWins opens the right settings surface and copies the URL for you.
Custom MCP apps are available on ChatGPT Business and Enterprise/Edu on the web. If Developer mode is missing, ask the workspace owner to enable it.
Step 3: connect Claude Code CLI
Claude Code and raw HTTP clients use a static organization key. Create a key in WhatWins and copy it immediately. The raw token is shown once; WhatWins stores only its SHA-256 hash. Then run:
Run this command with the key you just created:
claude mcp add --transport http --scope user whatwins https://whatwins.io/api/mcp \
--header "Authorization: Bearer ww_mcp_your_token"Verify it with claude mcp list, then open Claude Code and run /mcp.
Step 4: verify the connection
Ask the client to list the WhatWins tools. You should see the eight tools above. Start with a bounded request such as:
Use WhatWins to compare current monthly traffic for @gymshark and @aloyoga.
Step 5: inspect usage
Tool results include WhatWins usage metadata. WhatWins AI and MCP share the organization's monthly AI data-credit allowance, so usage remains visible in one billing view.
How WhatWins data credits work
Credits represent verified data returned, not raw HTTP requests.
- Six returned ads use six credits.
- Eight returned organic posts use eight credits.
- A two-shop metric comparison uses two row credits for that metric set.
- A tool call that returns no records does not pretend that missing data is a result.
Starter includes 2,500 monthly AI data credits for in-app WhatWins AI. Pro includes 10,000 credits and MCP access. Business includes 30,000 credits and MCP access. See the current pricing page for full plan limits.
This unit is easier to reason about than an arbitrary API-request count. A request for 40 ads consumes more useful data than a request for two shop summaries, and the credit model reflects that difference.
Security checklist for any MCP data provider
MCP gives an AI client access to tools, so the security model matters as much as the tool list.
Organization scope
Every key should belong to exactly one organization. Avoid global user tokens that can cross workspaces implicitly.
OAuth for remote apps and hashed keys for CLI clients
OAuth keeps long-lived WhatWins secrets out of Claude and ChatGPT setup forms. For clients that still use static keys, the server should store only a cryptographic hash of the raw token. If a database snapshot leaks, attackers should not receive working API keys.
Server-side authorization
Every call that accepts a store ID, organization ID, or saved-record ID must verify membership and plan access on the server. Client-side visibility is not security.
Bounded inputs
Limits should have hard maximums. WhatWins caps returned ad, organic, product, and shop results so one prompt cannot create an unbounded database scan or credit surprise.
Rate limits and revocation
Keys need per-key and per-organization rate limits. Owners should be able to revoke a key immediately and see when it was last used.
Missing-data semantics
Unavailable history should remain unavailable. Converting a gap into zero can produce a false trend and a confident but incorrect AI answer.
Useful ecommerce MCP prompts
Competitor ad research
Find the ten longest-running active Meta ads from @gymshark in the US. Return the creatives and group their opening hooks.
Organic research
Show the top six TikTok posts from @trenchies over the last 90 days, ranked by shares.
Traffic comparison
Compare monthly traffic for @trendtrack and @wetracked over the last six months. Include current visitor-market mix.
Product discovery
Find men's scrub products and name the specialist shops that sell them. Exclude shops already tracked by my organization.
Store analysis
Summarize @aloyoga's positioning, price range, catalog depth, top markets, current traffic, and paid-ad activity.
Precise prompts help the client select the right tool, but the server schemas still enforce valid sources, ranges, and limits.
MCP versus a traditional ecommerce API
A traditional API is ideal when engineers know the endpoint and build a deterministic integration. MCP is useful when an AI client needs to discover tools and select among them based on natural language.
They can coexist:
- Use an API for scheduled ETL, dashboards, and fixed backend jobs.
- Use MCP for interactive research, analysis, and agent workflows.
- Use the WhatWins app when a human needs visual ads, playable videos, charts, and tracking controls.
MCP does not remove the need for a product interface. It lets the same verified data participate in a different workflow.
Common mistakes
Giving the model one broad database tool
A generic SQL-like tool increases risk and makes authorization harder. Narrow tools with explicit schemas are easier to validate, meter, and audit.
Returning too much context
More rows do not automatically produce a better answer. Bounded, ranked results reduce latency, token use, and irrelevant reasoning.
Ignoring conversation state
Follow-up requests must be able to change the source, metric, time range, or shop. "Now rank by likes" should reuse the selected shop but replace the prior ranking metric.
Treating all platforms as interchangeable
Meta ads, Google ads, organic TikTok posts, and YouTube videos expose different signals. The server should preserve the requested platform rather than return the nearest available content.
The bottom line
An ecommerce MCP server is valuable when it exposes narrow, verified, authorized tools instead of a giant unstructured data dump. Evaluate the data coverage, schemas, organization scope, usage model, and missing-data behavior before connecting it to an AI client.
Explore the WhatWins MCP feature, read how the same data powers WhatWins AI, or compare access by plan on the pricing page.