Dicker Data MCP Server
MCP server for Dicker Data's B2B partner/reseller REST API - pricing and stock lookup, order placement and tracking, and invoices, for AI assistants and the WYRE Conduit gateway.
Authentication
Dicker Data does not offer self-serve API signup. Request access from [email protected] or [email protected] to receive a long-lived AccountCode + AccessToken pair.
Every real API call additionally requires a short-lived AccessKey, obtained by exchanging the AccountCode/AccessToken via POST /api/AccessKeyRequest. This server handles that exchange (and its refresh, on expiry) internally - callers only ever need to supply the long-lived credentials.
Configuration
Copy .env.example and set the variables below.
/health stays unauthenticated, does not require X-Gateway-S2S, and does not read vendor credentials. The stdio transport does not use CONDUIT_S2S_SECRET.
HTTP authentication
With MCP_TRANSPORT=http and CONDUIT_S2S_SECRET set, every /mcp request must include X-Gateway-S2S. The value is t=<unix seconds>,v1=<hex hmac-sha256>. The hex digest is HMAC-SHA256 over the exact ASCII string t=<unix seconds> (the same prefix that appears in the header), keyed with CONDUIT_S2S_SECRET, encoded as 64 lowercase hex characters. The timestamp must be within 300 seconds of the server clock. A missing or invalid header returns 401. The secret is never written to logs or the response.
X-Gateway-S2S: t=1710000000,v1=<64 lowercase hex chars>
Known placeholders are rejected at startup and do not count as a configured secret: changeme, change-me, secret, example, placeholder, replace-me, your-secret, your-s2s-secret, s2s-secret, replace-with-a-real-secret. Generate a value with openssl rand -hex 32.
In AUTH_MODE=gateway, /mcp also requires X-DickerData-Account-Code and X-DickerData-Access-Token. Those headers are the only Dicker Data credentials for that request. A request missing either returns 401 and does not fall back to DICKERDATA_ACCOUNT_CODE / DICKERDATA_ACCESS_TOKEN.
Tools
Pricing
dickerdata_get_pricing- live pricing + stock-on-hand for one or more product codes.dickerdata_get_price- detailed pricing for a single product code at a given quantity.
Orders
dickerdata_create_order- place a purchase order.dickerdata_get_order_details- look up a single order.dickerdata_list_orders- list orders matching account code / order / backorder / PO number.dickerdata_get_order_serials- shipped serial numbers for an order.dickerdata_get_consignment_status- shipping/tracking status for a consignment.
Account
dickerdata_list_invoices- invoices within a date range.dickerdata_get_invoice_details- line-item detail for a sales order/invoice.
Scope
This is a v1 / MVP surface covering the core distributor workflow (pricing, ordering, tracking, invoicing). Explicitly out of scope for now: Microsoft CSP/ESD subscription management, Autodesk subscriptions, and annuity-order endpoints - these are much larger, vendor-specific surfaces distinct from core distribution. They can be added as a follow-up if there's demand.
Development
npm install
npm run build
npm test
npm run lint # tsc --noEmit
Docker
The image listens on 0.0.0.0 inside the container (MCP_HTTP_HOST) and defaults to AUTH_MODE=gateway. Publish the port on loopback and pass the S2S secret. In gateway mode the account code and access token arrive on each request as X-DickerData-Account-Code and X-DickerData-Access-Token; they are not read from the environment.
docker build -t dicker-data-mcp .
docker run \
-e CONDUIT_S2S_SECRET="$(openssl rand -hex 32)" \
-p 127.0.0.1:8080:8080 \
dicker-data-mcp
Do not pass a known placeholder such as your-s2s-secret or changeme. Startup treats those as unset and exits. Compose refuses to start when CONDUIT_S2S_SECRET is unset, sets AUTH_MODE=gateway, does not pass DICKERDATA_ACCOUNT_CODE or DICKERDATA_ACCESS_TOKEN, and publishes 127.0.0.1:8080:8080. A project .env is interpolation only — do not add env_file to the gateway service.
CONDUIT_S2S_SECRET="$(openssl rand -hex 32)" docker compose up
Single-tenant HTTP (AUTH_MODE=env) still requires the S2S secret, then uses DICKERDATA_ACCOUNT_CODE and DICKERDATA_ACCESS_TOKEN:
docker run \
-e CONDUIT_S2S_SECRET="$(openssl rand -hex 32)" \
-e AUTH_MODE=env \
-e DICKERDATA_ACCOUNT_CODE=your-account-code \
-e DICKERDATA_ACCESS_TOKEN=your-access-token \
-e MCP_HTTP_HOST=0.0.0.0 \
-p 127.0.0.1:8080:8080 \
dicker-data-mcp
Local HTTP without a secret is development-only. It binds 127.0.0.1 and logs a warning. A non-loopback MCP_HTTP_HOST (including 0.0.0.0) is overridden and that override is logged:
MCP_ALLOW_INSECURE_DEV=1 npm run start:http
A signed gateway request:
curl -sS http://127.0.0.1:8080/mcp \
-H 'content-type: application/json' \
-H 'accept: application/json, text/event-stream' \
-H "x-gateway-s2s: $X_GATEWAY_S2S" \
-H "x-dickerdata-account-code: $DICKERDATA_ACCOUNT_CODE" \
-H "x-dickerdata-access-token: $DICKERDATA_ACCESS_TOKEN" \
-d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'