alexa-mcp
This project was developed and is maintained by AI (Claude Code). Use at your own discretion.
An MCP server for Amazon Alexa: list and control Echo speakers, Echo Shows and Fire TVs, make Alexa speak or announce, run routines, read and control the smart-home devices Alexa knows about (thermostats, lights, plugs, locks, garage doors, robot vacuums, scenes), read and edit shopping/to-do lists, and set or cancel alarms, timers and reminders.
It talks to Amazon's private Alexa web API — the one the Alexa app uses — through alexa-remote2. There is no public API for any of this, so expect occasional breakage when Amazon changes things.
Sign in once
You sign in to Amazon in your own browser; this server never sees your password.
- In a chat: ask Claude to sign in to Alexa. It calls
alexa_begin_loginand gives you an amazon.com link. Sign in there (password, two-step code, whatever Amazon asks), and you land on a blankwww.amazon.com/ap/maplandingpage. Paste that page's address back and Claude callsalexa_finish_login. - Hosted connector: the sign-in page shows a Sign in to Amazon button and a box for that same address.
- Terminal:
npx @chrischall/alexa-mcp loginprints the link and reads the pasted address (--printalso writes the registration as one base64 line forALEXA_REGISTRATION; treat it as a credential).
Under the hood this is the Alexa iOS app's OAuth sign-in with PKCE. The link carries only a challenge, the matching secret stays on the server, and the code in the pasted address is single-use and expires in minutes. Finishing registers a virtual device named alexa-mcp on your account and saves the registration (refresh token plus session cookies) to ~/.alexa-mcp/registration.json (mode 0600). After that no browser is needed: cookies are re-minted from the refresh token every few days. To revoke access, remove the alexa-mcp device from your Amazon account (Manage Your Content and Devices → Devices). A copy of the token is written to registration-seed.json while sign-in completes and deleted once registration.json is saved. Versions before this fix never deleted it, so if you are cleaning up an older install, delete ~/.alexa-mcp/registration-seed.json too.
Tools
| Tool | What it does |
|---|---|
alexa_list_devices | Echo speakers, Echo Shows, Fire TVs and other Alexa devices with online status (not thermostats, lights or plugs: those are smart-home) |
alexa_get_now_playing | Media state on one device |
alexa_list_volumes | Volume and mute (only devices Amazon reports, often just a few) |
alexa_get_do_not_disturb | Which devices have Do Not Disturb on |
alexa_get_equalizer | Bass / mid / treble of a speaker or soundbar |
alexa_list_bluetooth | Bluetooth devices paired with each Echo, and what's streaming |
alexa_list_routines | Routines with their triggers |
alexa_list_smart_home | Thermostats, lights, plugs, locks, sensors, groups and scenes, with the actions this server can send to each |
alexa_get_smart_home_state | Live state: thermostat temperature, mode and setpoints, humidity, light on/brightness/colour, lock state, sensors, reachability |
alexa_list_lists / alexa_get_list_items | Shopping and to-do lists |
alexa_list_alarms_reminders | Alarms, timers and reminders (with ids for cancelling) |
alexa_set_volume ✋ | Set a device's volume |
alexa_playback ✋ | Play / pause / next / previous |
alexa_stop ✋ | Stop one device (or all of them): music, a ringing alarm, speech |
alexa_speak ✋ | Speak on one device, or announce on several |
alexa_run_builtin ✋ | Play weather, traffic, the news briefing, a joke, a story, calendar and other built-ins out loud |
alexa_fire_tv ✋ | Fire TV on / off / pause / resume / home |
alexa_set_do_not_disturb ✋ | Do Not Disturb on or off |
alexa_set_equalizer ✋ | Set bass / mid / treble |
alexa_run_routine ✋ | Run a routine now |
alexa_control_smart_home ✋ | turnOn / turnOff / setBrightness / setColor / setColorTemperature / sceneActivate |
alexa_list_device_modes | A device's mode settings (thermostat fan mode, vacuum mode, light effect), current value and options |
alexa_set_device_mode ✋ | Change one of those modes, e.g. fan mode to Circulate (not garage doors) |
alexa_lock ✋ | Lock or unlock a smart lock. Unlocking reduces security; Amazon may insist on a voice PIN or the Alexa app |
alexa_garage_door ✋ | Open or close a garage door. Opening reduces security |
alexa_set_thermostat ✋ | Thermostat setpoint(s) and/or mode, checked against the thermostat's allowed range |
alexa_set_vacation_mode ✋ | Thermostat vacation / away mode, emulated: saves each thermostat's settings, sets energy-saving setpoints, and restores them when turned off |
alexa_create_reminder ✋ / alexa_create_timer ✋ / alexa_cancel_alarm_reminder ✋ | Set a reminder, alarm or timer; cancel one |
alexa_add_list_item ✋ / alexa_update_list_item ✋ / alexa_remove_list_item ✋ | Edit a list: add, check off / un-check, delete |
alexa_begin_login / alexa_finish_login | Browser sign-in (see above) |
alexa_session_status | Configuration, no network |
alexa_healthcheck | Does Amazon still accept the session? |
✋ = confirmation-gated. A client that supports prompts asks you first; elsewhere (claude.ai, Claude Desktop) the first call sends nothing and returns a preview plus a confirmToken, and only a repeat call with that token acts.
Deliberately left out:
- Free-text voice commands ("Alexa, …", the library's
textCommand). They can buy things and unlock doors without going through a specific, confirm-gated tool, so no tool sends one.
Unlocking a door and opening a garage door are possible, but only through alexa_lock and alexa_garage_door, which are marked destructive and always confirmation-gated.
Vacation mode is an emulation. The Alexa app's own thermostat Vacation Mode is not reachable through the API this server uses (its thermostat modes are only HEAT / COOL / AUTO / OFF), so this does not flip the app's toggle. Instead alexa_set_vacation_mode saves each thermostat's mode and setpoints to ~/.alexa-mcp/vacation.json (mode 0600) before it changes anything, then sets heat-to 55° / cool-to 85° (or what you ask for). Thermostats that are OFF stay OFF. Turning it off restores the saved settings. Turning it on twice is refused, so the originals are never overwritten.
Configuration
| Variable | Default | Purpose |
|---|---|---|
ALEXA_REGISTRATION | — | Registration JSON, or the base64 line from login --print. Optional when the state file exists. If it is malformed but the state file is valid, the state file is used and a warning is logged. |
ALEXA_STATE_DIR | ~/.alexa-mcp | Where registration.json and pending sign-ins live. |
ALEXA_AMAZON_PAGE | amazon.com | Amazon site of the account (or what the registration recorded). |
ALEXA_ACCEPT_LANGUAGE | en-US | Accept-Language sent to Amazon. |
MCP_CONFIRM_MODE | ask-user | ask-user / auto / refuse — whether the model must get your approval in chat before using a confirmToken. |
MCP_CONFIRM_ELICITATION | on | off skips the confirmation prompt even on clients that declare support. |
When both ALEXA_REGISTRATION and the state file are present, whichever has the newer tokenDate wins, whatever device it belongs to (a tie goes to the state file, the refreshed copy). So a re-login through alexa_finish_login survives a restart even with an older ALEXA_REGISTRATION still set, and a freshly pasted ALEXA_REGISTRATION beats an old state file.
Upgrading from 0.1
0.2.0 changed how the connector signs in. The pasted ALEXA_REGISTRATION field is replaced by the browser sign-in flow (auth.flow in mint.yaml: a Sign in to Amazon link, then paste the address you land on). Existing hosted registrations must switch to the new flow: sign in once more through it. alexa-mcp login --port <n> is no longer needed: the flag is ignored with a notice, since the sign-in now happens in your own browser.
Hosting
mint.yaml describes the server to mcp-host: one child per user (identity.perUserChild), a two-step auth.flow (begin → sign in on amazon.com → paste the address), and the registration persists in each user's data dir.
Development
npm install
npm test # typecheck + vitest (no network)
npm run build # tsc + esbuild bundle (dist/bundle.js is the .mcpb entry)
See docs/ALEXA-API.md for the verified response shapes and hosts.