Shopify

Name: Shopify MCP Server
Availability: InStock
Author: Shopify

HIPAA CompliantSOC2 ReadyISO 27001 Ready

Productivity25 tools

Manage a Shopify store from your AI assistant. Twenty-five tools, but one of them composes arbitrary Admin GraphQL mutations — 518 of them in Shopify's current reference. OAuth advertises 32 scopes, 27 of which begin write_.

Verified connector

Listed by Anthropic as a partner connector in its Connectors Directory.

Connection checked by Agentman on 19 August 2026.

Anthropic states this reflects the level of review a connector received, not a security audit.

Connect Shopify via MCP

https://setup.shopify.com/mcp

Works in any MCP-compatible client. In Agentman Studio it is one click — no config file to edit.

Use in Agentman

Connect Shopify once and your agents call these tools on their own — on a schedule, in a workflow, with nobody at the keyboard.

Open in Agentman Studio

Shopify Tools & Capabilities (25)

search_products

get-shop-info

get-product

create-product

update-product

list-orders

get-order

list-customers

get-inventory-levels

set-inventory

create-discount

add-to-collection

run-analytics-query

bulk-update-product-status

search_collections

get-collection

create-collection

update-collection

upload-image

switch-shop

graphql_schema

graphql_query

graphql_mutation

validate_graphql_codeblocks

search_docs_chunks

Tool names from Anthropic's directory listing. This server requires sign-in, so we could not read tool descriptions or parameter schemas.

Limits

The tool count does not measure the surface. Twenty-five tools front an Admin GraphQL API whose current reference documents 518 mutations, 287 queries and 1,115 objects, counted from Shopify's sitemap on 2026-08-19. Review the scope grant, not the tool list.
No published constraint on graphql_mutation. We found no allowlist, denylist or server-side confirmation step documented for it. The scope grant is the only boundary any Shopify page describes.
Twenty-seven of thirty-two advertised scopes are write scopes. And because a Shopify write scope implies read on the same resource, the grant covers reading everything it can write.
write_publications is advertised but undocumented. It appears in the server's live scope list and nowhere in Shopify's public access-scopes reference as fetched on 2026-08-19.
read_all_orders reaches beyond the default window. Shopify documents it as lifting the 60-day order limit, and as normally requiring permission requested from the Partner Dashboard.
No documented cap on bulk-update-product-status. No published page we found states how many products one call may touch, or whether a partial failure rolls back.
One store at a time. Shopify states the app connects to a single store even within one organization, and that switching disconnects the current store and re-authorizes.
Access is capped twice. Shopify documents that the app's approved access and the acting user's staff permissions both apply; the narrower one wins.
Scope cannot be reduced after approval. Shopify states you must uninstall the app to lower the granted access.
Shopify does not review AI-tool actions. Its help page states that Shopify neither reviews nor approves what connected AI tools do, that AI outputs can contain errors, and that monitoring the store for changes is the merchant's responsibility.
Data leaves Shopify on connection. Shopify states that once shared, the data is governed by the AI provider's terms and is no longer processed by Shopify.
Rate limits are the Admin API's. 100 points/second of calculated query cost on standard plans, 200 on Advanced, 1000 on Plus, 2000 on enterprise, under a leaky-bucket algorithm. Shopify publishes no separate MCP quota.
We could not verify tool behaviour ourselves. The endpoint returned HTTP 403 to an anonymous request on 2026-08-19, so no schemas and no safety annotations were readable. Tool names are Anthropic's; descriptions of what they do are inference from the names plus Shopify's API reference, and are labelled as such.
Prompts are unconfirmed. Anthropic's snapshot lists no prompt names, and the gated endpoint blocked our own prompts/list, so we cannot say whether the server serves any.

Frequently asked questions

Far more than its twenty-five tools suggest. One tool, `graphql_mutation`, composes mutations against Shopify's Admin GraphQL API, and Shopify's own documentation sitemap carries 518 mutation reference pages for the current version, counted on 2026-08-19. The twenty typed tools are a convenience layer over a surface roughly twenty times larger than the tool count implies.

No published Shopify page states an allowlist, a denylist or a confirmation step for it, and that silence is the finding. The documented boundary is the OAuth scope grant instead. Shopify's help documentation does advise confirming whether a tool prompts before making a change, which implies the prompt is a client behaviour rather than a server guarantee.

Thirty-two, verified live on 2026-08-19 from the server's RFC 9728 descriptor. Twenty-seven begin with `write_`, covering products, orders, inventory, customers, discounts, themes, fulfilments and checkouts. Only five are read-only. Because a Shopify write scope implies read on the same resource, the granted set is effectively read and write across most of the store.

No. Shopify documents that the app for ChatGPT, Claude or Perplexity connects one store at a time, even when the stores share an organization. Asking the tool to switch stores disconnects the current one and starts a fresh authorization for the next. The `switch-shop` tool therefore changes which single store is connected.

No, but your own permissions cap what the tool can do. Shopify documents two limits stacked together: the access you approve at install, and the user permissions of the staff account interacting with the tool. A staff member who can read products but not edit them cannot grant the tool product editing.

Shopify's published Admin GraphQL limits apply, because the connector calls that API. The standard plan allows 100 points per second of calculated query cost, rising to 200 on Advanced, 1000 on Plus and 2000 on enterprise. Shopify publishes no separate MCP quota, so every tool call draws from the same leaky bucket.

Sources

Shopify help — connecting your store to AI tools — https://help.shopify.com/en/manual/apps/connecting-ai-tools (fetched 2026-08-19 as Markdown via the .md suffix; this is the documentation URL Anthropic's directory publishes, and it 307-redirects to /en/manual/ai-powered-tools/connecting-ai-tools, which is the canonical path) · retrieved 2026-08-19
Shopify AI Toolkit — https://shopify.dev/docs/apps/build/ai-toolkit (fetched 2026-08-19 as Markdown; documents the separate, authless Dev MCP server whose documentation tools also appear in this connector's tool list) · retrieved 2026-08-19
Shopify API access scopes — https://shopify.dev/docs/api/usage/access-scopes (fetched 2026-08-19 as Markdown; source for write-implies-read, for read_all_orders, and for the absence of write_publications) · retrieved 2026-08-19
Shopify Admin GraphQL API reference — https://shopify.dev/docs/api/admin-graphql (fetched 2026-08-19 as Markdown) · retrieved 2026-08-19
Shopify documentation sitemap — https://shopify.dev/sitemap.xml and sitemap_standard.xml.gz (fetched 2026-08-19; 8,685 URLs. The 518-mutation, 287-query and 1,115-object counts are derived by counting reference URLs under admin-graphql/latest/) · retrieved 2026-08-19
Shopify API rate limits — https://shopify.dev/docs/api/usage/limits (fetched 2026-08-19; the per-plan points-per-second table and the leaky-bucket description) · retrieved 2026-08-19
Shopify free trials — https://help.shopify.com/en/manual/intro-to-shopify/pricing-plans/free-trial (fetched 2026-08-19 as Markdown; the four-month trial for AI-tool-created stores) · retrieved 2026-08-19
Live RFC 9728 protected-resource descriptor — https://setup.shopify.com/.well-known/oauth-protected-resource (fetched 2026-08-19; 200 with 32 scopes. The path-append and path-insert forms both return 404) · retrieved 2026-08-19
Live RFC 8414 authorization-server metadata — https://setup.shopify.com/.well-known/oauth-authorization-server/auth (fetched 2026-08-19; served only from the path-insert form — the root and path-append forms return 404) · retrieved 2026-08-19
Live anonymous probe — 2026-08-19: initialize posted to the endpoint returns HTTP 403 {"statusCode":403,"error":"ForbiddenError"} with no www-authenticate header, retried once with a browser user agent for the same result · retrieved 2026-08-19
shopify.dev/robots.txt and help.shopify.com/robots.txt (both fetched 2026-08-19; each allows the paths used here, disallowing only search, tracking-parameter and beta paths. No Content-Signal line on either host, on any axis, and none in the response headers for the pages fetched) · retrieved 2026-08-19
Anthropic connector directory — https://claude.ai/directory/80917cb7-3071-4fca-b053-a4262d356c60 (snapshot 2026-08-16; 25 tool names, no prompt names, permissions published as "Read + Write", tier published as partner) · retrieved 2026-08-16