# What is the Nova MCP server, and what can it read and change?

Source: https://novadata.io/docs/mcp/overview-and-security
Checked against Nova's code on 2026-10-29

The Nova MCP server lets an AI assistant, such as Claude, ChatGPT or Copilot, read your Nova data through the Model Context Protocol. It reads by default. The only writes are your own Nova settings and, on workspaces where Nova has turned it on, listing content on Amazon; each one is previewed and needs your confirmation, and prices and stock are never changed.

## How does an assistant connect?

| Setting | Value |
|---|---|
| Endpoint | `https://mcp.novadata.io/api/mcp` |
| Transport | Remote MCP over Streamable HTTP, POST only, no session kept between requests |
| Sign-in | OAuth: the assistant opens the Nova sign-in and you approve |
| OAuth discovery | `https://mcp.novadata.io/.well-known/oauth-protected-resource` |
| Without OAuth | A workspace token, sent as `Authorization: Bearer nova_mcp_...` |

A request without credentials gets a 401 pointing to the OAuth discovery address, which starts the sign-in. Tokens are for terminal clients and scripts: you create one on the **Nova MCP** page with **Generate a token instead**. It is shown once; Nova keeps only a hash.

## What can it read?

The same data as the app, through the same services: sales and profit, ads, search terms, Search Query Performance, DSP, inventory, listing health, Best Seller Rank, reviews, Subscribe & Save, Vendor Central registers, and your cost settings and events. See [Tools](/docs/mcp/tools).

## What can it change?

**Writes**

| Write | Where it lands | Who may confirm it | Credential |
|---|---|---|---|
| COGS, FBM rates, VAT categories, product tags, supply chain settings | In Nova | An organization Owner, or a Workspace owner of the workspace holding the account | OAuth only |
| Events (dated notes on charts) | In Nova | Any member | OAuth only |
| Listing content | On Amazon, Seller Central accounts only | Owner as above, on a workspace where Nova has turned Amazon writes on | OAuth only |

Workspace tokens cannot write. There is no write tool for advertising: bids, budgets, campaigns and negative keywords are read only.

Every write takes two calls. The first previews: Nova validates the rows, returns the before and after, the warnings and a confirmation token, and writes nothing. The assistant shows you the preview (some hosts show a panel with a Confirm button) and commits only after your approval, resending the same payload with the token. The token lasts 15 minutes, works once, and is bound to that payload, that tool and the person who previewed.

Listing content covers the title, bullets, description, backend keywords, dimensions and other attributes Amazon marks editable, and the preview also runs Amazon's own validation. Offer attributes are always refused: price, list price, quantity, shipping, tax and condition. The listing tools do not appear until Nova turns Amazon writes on for one of your workspaces.

## Whose data does it see?

| Credential | Accounts in scope |
|---|---|
| OAuth, organization Owner | Every workspace of the organization |
| OAuth, member | The workspaces where the member has a seat, combined |
| Workspace token | The workspace it was created in, while its creator can still open it |

The scope is read again on every request. Add an account to a workspace, remove one, or remove a member, and the assistant sees the change at its next call. A credential that resolves to no account is refused.

## How do you revoke access?

- **An assistant**: remove or disconnect Nova in the assistant's connector settings.
- **A token**: on the **Nova MCP** page, under **Your tokens**, click the trash icon (**Revoke this token**). The next request with it is refused. Each token shows its **Last used** date, or **Never used**.
- **A person**: remove them from the organization or from the workspace. Their sign-in and the tokens they created lose that access at the next call.

## What does Nova log?

Nova receives tool calls, not your conversation. For each call it records who made it (the person or the token), the tool and its arguments, the one sentence the assistant gives for the call, the accounts in scope, and the outcome: success or the error, duration and rows returned. A write answers only once its log entry is saved.

## Ask your AI

> Which Nova accounts and workspaces can you see through this connection, and which marketplaces does each one sell on?