Part of /argOpen infrastructure for Argentina's AI agent jurisdiction.
ar-agents.arGitHubnpmLive demovsoperated byintegrate

@ar-agents/mercadolibre · v0.4.3 · independent · MELI-unaffiliated

Mercado Libre
Agent Toolkit.
Built on Vercel.

The typed TypeScript SDK Mercado Libre stopped shipping when they archived mercadolibre/nodejs-sdk in February 2022 — rebuilt for the AI SDK era. 14 drop-in tools, 9 domains, OAuth coalescing, /myfeeds replay, HITL gates on irreversible ops, agentic-commerce feed generator.

116 tests passing0 prod CVEs11 KB brotliEdge-runtime ready
InstallTry the live demoRead the docs

Live demoLIVE

A real agent (claude-sonnet-4-6) running the 14 tools against a mocked MELI backend. Try a preset prompt or write your own.

claude-sonnet-4-6 · seller 12345 (MLA) · mocked backend
Try a preset below, or type your own.

Quickstart

Three lines and an LLM is driving Mercado Libre. The 14 tools come pre-typed; the agent never sees a thrown exception — every result is a discriminated union.

pnpm add @ar-agents/mercadolibre ai zod

import { Experimental_Agent as Agent, stepCountIs } from "ai";
import { anthropic } from "@ai-sdk/anthropic";
import { MeliClient } from "@ar-agents/mercadolibre";
import { meliTools } from "@ar-agents/mercadolibre/ai-sdk";

const client = new MeliClient({
  auth: { kind: "bearer", accessToken: process.env.MELI_ACCESS_TOKEN! },
});

const agent = new Agent({
  model: anthropic("claude-sonnet-4-6"),
  tools: meliTools(client, { siteId: "MLA", sellerId: 12345 }),
  stopWhen: stepCountIs(8),
});

const { text } = await agent.generate({
  prompt: "Cuántas órdenes pagas tengo hoy y hay alguna pregunta sin responder?",
});

Nine domains. Production-grade.

Every helper that follows the cookbook recipes — not an exhaustive endpoint dump. The point is to make the agent loop trivial, not to wrap REST calls.

itemsItems + Catalog

get / multiget / create / update / pause / close / relist / search / scroll-iterate. Category predictor + technical-spec planner in one call (categorizeAndPlan).

questionsQuestions

List, answer (≤2000 chars), blacklist + heuristic spam classifier with explainable features (URL/phone/email + repetition + new-account + length).

ordersOrders + Packs

Search, get, billing-info (CUIT/CUIL/DNI), packs (cart vs single). partitionByPack splits a feed into single-orders and cart-grouped buckets.

claimsClaims & Mediation

search, evidences, messages + the 2-day SLA defendClaim helper (sequential uploads + partial-failure surface, never half-defended).

shipmentsMercado Envíos

Shipment + history + label blob (PDF / ZPL) routed through auth + retry + rate-limit + telemetry. Shipping options for any item.

reputationReputation

Thermometer (5_green → 1_red), pre-evaluated alert severities, monitorReputation async-iterator with rethrow on permanent errors.

promotionsPromotions

Candidates + opt-in. autoOptInPromotions enforces a per-item margin floor so you never give away the listing.

webhooksWebhooks

Typed parser + the /myfeeds 2-day replay nobody else implements. Dedup by (topic, resource, sent) so the live feed doesn't double-deliver.

/ai-sdkVercel AI SDK 6

meliTools(client, opts) returns a 14-tool ToolSet. Every tool returns { ok: true, ... } | { ok: false, code, message } — no thrown errors.

Eight blindspots this fills

Things every JS Mercado Libre integration gets wrong because the official archived SDK never modeled them.

  1. 01
    Single-use refresh-token races
    Two parallel refreshes invalidate both tokens. We coalesce per-userId via in-process AsyncLock + document the cross-process CAS pattern.
  2. 02
    Per-seller rate limiting
    Token bucket scoped to seller:<id>, default 24/s burst 60. Idle-bucket sweep every 256 acquires so multi-tenant hosts don't leak.
  3. 03
    /myfeeds 2-day replay
    When your service was down for 5 minutes, this is the only path that gets the events back. Auto-dedup on a live feed.
  4. 04
    Category prediction + tech specs in one call
    categorizeAndPlan parallelizes the two endpoints. Save a round-trip for every CSV-import row.
  5. 05
    Claim defense in 2-day SLA
    defendClaim does GET + sequential evidence uploads (parallel races MELI's one-shot semantics) + optional message. Stops on first failure.
  6. 06
    Reputation thermometer alerts
    evaluateReputationAlerts translates the level + rates into actionable severities. Critical/warning thresholds configurable.
  7. 07
    Promotion margin guard
    autoOptInPromotions never opts in below your floor — and skips candidates where MELI didn't suggest a discount.
  8. 08
    Heuristic spam classifier
    Explainable features (no LLM dependency). Pair the borderline label with an LLM second-pass before auto-answering.

Built for production from day one.

Every line you'd write yourself in your second integration is already there.

Idempotent-only retry
Default classifier retries GET / HEAD / OPTIONS / PUT / DELETE on 5xx. POST / PATCH never auto-retry on 5xx because MELI's gateway can split-brain.
Pluggable telemetry
onRequest / onResponse / onRetry / onRateLimitWait — wire OpenTelemetry, Sentry, Datadog without touching the lib. Hooks never see Authorization headers.
Request timeout default
30s default with AbortSignal.any composing your signal + the timeout signal. A wedged TCP connection can't burn your entire Vercel Edge budget.
Security-audited
No eval, no http://, no hardcoded secrets, SSRF-guard on path injection, FNV-1a hash on bearer-scope (no token leaks in telemetry). Threat model in SECURITY.md.
Edge-runtime native
Web Crypto only. Runs on Vercel Edge, Cloudflare Workers, Deno. ESM 11 KB brotli, ai-sdk subpath 54 KB, testing helpers 18 KB.
116 tests, 4 against live MELI
102 unit + 10 property + 4 integration against the real public API (categories, domain_discovery). publint + attw + pnpm audit --prod all green.

Two strategic moves shipped in v0.4.0v0.4

Beyond making MELI agent-friendly: making it agent-native commerce infrastructure.

hitl
Human-in-the-Loop gates
Irreversible ops (create_item, update_item_price_or_stock, answer_question, defend_claim) wait for a programmatic confirmation callback before firing. The LLM cannot bypass — it isn't a system-prompt rule, it's a function call that doesn't fire. Auto-approve thresholds + input-overrides ship out of the box.
/feed
Agentic Commerce feed generator
@ar-agents/mercadolibre/feed emits ACP-2026-04-17 product feeds from any seller's MELI catalog. ChatGPT/Claude/Gemini buyer agents discover MELI listings without crawling. Cursor-paginated + ETag-cached + reference implementation deployed on bridge-hello.

Performance

Numbers from the bench suite (`pnpm bench`). Run them yourself to verify.

Rate limiter (concurrent acquire, 200 ops)38M ops/s
Spam classifier (typical question)4.5M classifications/s
Full pipeline (auth + rate-limit + retry, 100 sequential GETs)1.5M req/s
Bundle (brotli'd, all dependencies)11.0 KB

Plug it into Claude Desktop, Cursor, or Codeium

@ar-agents/mcp@0.9.0 bundles every package — including this one — into a single MCP server. One install, one config, all 14 MELI tools available to your favorite IDE agent.

{
  "mcpServers": {
    "ar-agents": {
      "command": "npx",
      "args": ["-y", "@ar-agents/mcp"],
      "env": {
        "MELI_ACCESS_TOKEN": "APP_USR-...",
        "MELI_SELLER_ID": "12345",
        "MELI_SITE_ID": "MLA"
      }
    }
  }
}