Install
$ agentstack add mcp-benwmerritt-shopify-mcp ✓ scanned · ✓ verified — works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ● Network access Used
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ● Environment & secrets Used
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
About
███████╗██╗ ██╗ ██████╗ ██████╗ ██╗███████╗██╗ ██╗ ███╗ ███╗ ██████╗██████╗
██╔════╝██║ ██║██╔═══██╗██╔══██╗██║██╔════╝╚██╗ ██╔╝ ████╗ ████║██╔════╝██╔══██╗
███████╗███████║██║ ██║██████╔╝██║█████╗ ╚████╔╝ ██╔████╔██║██║ ██████╔╝
╚════██║██╔══██║██║ ██║██╔═══╝ ██║██╔══╝ ╚██╔╝ ██║╚██╔╝██║██║ ██╔═══╝
███████║██║ ██║╚██████╔╝██║ ██║██║ ██║ ██║ ╚═╝ ██║╚██████╗██║
╚══════╝╚═╝ ╚═╝ ╚═════╝ ╚═╝ ╚═╝╚═╝ ╚═╝ ╚═╝ ╚═╝ ╚═════╝╚═╝
Shopify MCP
A Model Context Protocol (MCP) server that connects agents to the Shopify Admin GraphQL API. Use it to browse, edit, and clean up store data via a curated set of tools.
npm: shopify-mcp binary: shopify-mcp
Highlights
- CRUD for products, collections, orders, and customers
- Draft orders for quotes, manual orders, and B2B pricing
- Inventory and location lookups for stock workflows
- Metafields for custom data
- Metaobject entry creation and lookup for existing definitions
- URL redirects management
- OAuth login flow with local token caching
- Bulk product cleanup utilities
Prerequisites
- Node.js 18+
- A Shopify custom app (OAuth or Admin API token)
Local setup (this repo)
Use this when you want to run the MCP server from this local checkout instead of a remote deployment.
- Install dependencies and build:
npm install
npm run build
- Create local env config:
cp .env.example .env
Set at least:
MYSHOPIFY_DOMAIN=your-store.myshopify.comSHOPIFY_ACCESS_TOKEN=shpat_xxxREMOTE_MCP=false
- Start local MCP (stdio):
npm run start:local
start:local uses stdio mode. Remote mode is only enabled with --remote or REMOTE_MCP=true.
Install + run
OAuth flow (recommended)
- Create a custom app and copy Client ID and Client Secret.
- In App setup, set App URL and Allowed redirection URLs to:
http://localhost:3456/callback
- Start the OAuth flow:
npx shopify-mcp --oauth --domain=your-store.myshopify.com --clientId=xxx --clientSecret=yyy
Tokens are stored at ~/.shopify-mcp/tokens.json. After that, start the server with just the domain:
npx shopify-mcp --domain=your-store.myshopify.com
Optional: override scopes with --scopes or SHOPIFY_SCOPES.
Access token (manual)
- Create a custom app in Shopify
- Enable Admin API scopes:
read_products,write_productsread_customers,write_customersread_orders,write_ordersread_draft_orders,write_draft_ordersread_inventory,write_inventoryread_locationsread_content,write_contentread_files,write_files
- Install the app and copy the Admin API access token
Run:
shopify-mcp --accessToken= --domain=.myshopify.com
MCP client setup
Claude Desktop (local repo build)
Build first (npm run build), then point Claude Desktop at this repo's built entrypoint:
{
"mcpServers": {
"shopify-local": {
"command": "node",
"args": [
"/absolute/path/to/shopify-mcp/dist/index.js",
"--domain",
"your-store.myshopify.com"
],
"env": {
"SHOPIFY_ACCESS_TOKEN": "shpat_xxx",
"REMOTE_MCP": "false"
}
}
}
}
If you completed OAuth locally, remove SHOPIFY_ACCESS_TOKEN and keep --domain.
Claude Desktop (npm package)
{
"mcpServers": {
"shopify": {
"command": "npx",
"args": [
"shopify-mcp",
"--accessToken",
"",
"--domain",
".myshopify.com"
]
}
}
}
If you completed OAuth, omit --accessToken and keep --domain.
Config paths:
- macOS:
~/Library/Application Support/Claude/claude_desktop_config.json - Windows:
%APPDATA%/Claude/claude_desktop_config.json
Remote MCP (Railway, etc.)
By default this server runs as a local stdio MCP. Passing --remote (or setting REMOTE_MCP=true) switches it to HTTP/SSE mode so it can be deployed as a remote MCP server for Claude.ai or other remote clients. This repo ships a Dockerfile and railway.json so Railway builds and starts it in remote mode out of the box.
1. Get a token locally (one-time):
npx shopify-mcp --oauth --domain=your-store.myshopify.com --clientId=xxx --clientSecret=yyy
# Token saved to ~/.shopify-mcp/tokens.json
2. Deploy to Railway:
- Create a project from this repo. Railway reads
railway.jsonand builds the
Dockerfile, which starts the server with --remote.
- Set the service environment variables (Railway injects
PORTautomatically):
SHOPIFY_ACCESS_TOKEN=shpat_xxx # from tokens.json (or use the OAuth vars)
MYSHOPIFY_DOMAIN=your-store.myshopify.com
MCP_API_KEY=choose-a-long-random-string # required to authenticate remote clients
# REMOTE_MCP=true is already implied by the Dockerfile's --remote flag
# PORT is injected by Railway (defaults to 3000 when run locally)
3. Connect:
- Health check:
GET /health - MCP endpoint (SSE):
GET /mcp?apiKey= - Messages:
POST /messages?apiKey=
Auth uses the apiKey query parameter; requests without a matching MCP_API_KEY receive 401.
Test the container locally before deploying:
docker build -t shopify-mcp .
docker run -p 3000:3000 \
-e MYSHOPIFY_DOMAIN=your-store.myshopify.com \
-e SHOPIFY_ACCESS_TOKEN=shpat_xxx \
-e MCP_API_KEY=test \
shopify-mcp
# then in another shell: curl localhost:3000/health
Environment variables (optional)
SHOPIFY_ACCESS_TOKEN=your_access_token
MYSHOPIFY_DOMAIN=your-store.myshopify.com
# Optional OAuth values:
# SHOPIFY_CLIENT_ID=your_client_id
# SHOPIFY_CLIENT_SECRET=your_client_secret
# SHOPIFY_SCOPES=comma,separated,scopes
Tool catalog
Products
products— unified lookup/search/filter. Passidfor a single product; omitidto list/search with filters (title,status,vendor,tag, inventory, dates,hasImages, …). Returns the product's Shopify Standard Product Taxonomycategory({id, name, fullName}) inslim/standard/full. Page size capped at 100.create-productupdate-product— acceptscategory(Shopify Standard Product Taxonomy GID,vp-*prefix); the tool verifies the category actually stuck and throws a loud, actionable error if Shopify silently rejected the GID, instead of leaving you with a nullcategory.delete-productdelete-variantdelete-product-imagesbulk-update-productsbulk-delete-productscount-products-by-tagfind-products-by-metafield— list products that have / don't have / both for a givennamespace.key, paginated across the whole catalog via cursorsearch-taxonomy— browse Shopify's product category taxonomy; setincludeAttributes:trueto also return each category's attributes (e.g. Color, Pattern) and their allowed values
Collections
get-collectionsmanage-collection-productscreate-collectionupdate-collectiondelete-collection
Customers
get-customers(supports pagination viacursor)update-customer
Orders
orders— unified lookup/list. Passidfor a single order; omitidto list with filters (customerId,status, pagination viacursor). Replacesget-orders,get-order-by-id, andget-customer-orders.update-order
Draft Orders
draft-orders— unified lookup/list. Passidfor a single draft order; omitidto list with filters (status,query, pagination viacursor).create-draft-orderupdate-draft-ordercomplete-draft-order
Inventory
get-inventory-levelsupdate-inventory
Locations
get-locations
Metafields
get-metafields— server-side filter withkey+namespace(single field) orkeys: ["namespace.key", …](multi) via Shopify's nativemetafields(keys:); setincludeDefinitions:trueto merge ALL definitions with current values so empty/unfilled fields show up (value:null,isSet:false)set-metafield(create or update; supportsmetaobject_reference/list.metaobject_reference)bulk-set-variant-metafields— set metafields across many variants of one product in a singleproductVariantsBulkUpdatecall (up to 250 variants/call). UNIFORM mode (metafields) fans one value out to every variant and auto-discovers the variant IDs; PER-VARIANT mode (variants) sets different values per variant. Avoids oneset-metafieldcall per variant.delete-metafieldlist-metafield-definitions— discover metafield definitions for an owner type (PRODUCT, ORDER, CUSTOMER, …); each entry now includesconstraints(e.g.{key:"category", values:["vp-2","vp-2-2-3", …]}) so agents can see category-gating before writing (e.g.vehicle_*requiresvp-2*Vehicle categories; values on disallowed categories are silently filtered out by Shopify on read).get-metafield-options— resolve a metafield's selectable options in one call (for metaobject-reference fields, returns the available metaobject entries; for choice-lists, the allowed choices)
Metaobjects
list-metaobject-definitionsget-metaobject-definitioncreate-metaobject— optionalstatus(ACTIVE/DRAFT); defaults to Shopify'sDRAFTfor publishable definitions, passACTIVEto publish on createupdate-metaobject— edit fields on an existing entry (only provided keys change); optionalstatusto publish (ACTIVE) or unpublish (DRAFT)delete-metaobjectlist-metaobjects— returnsstatusper entry; optionalstatusfilter (applied client-side to the fetched page)get-metaobject— returns the entry's publishstatus
Files
get-files— list/search files in the storeattach-file-to-product— attach an existing media file to a productdetach-file-from-product— remove a media file from a productcreate-file-upload-session— start a browser upload session (remote mode only)get-file-upload-session— check an upload session (remote mode only)
URL redirects
get-redirectscreate-redirectdelete-redirect
Analytics
get-store-counts- Get all key counts in one call (products, variants, orders, customers, collections)get-product-issues- Audit products for problems (zero inventory, low stock, missing images, zero price)
Bulk Operations
start-bulk-export- Start async bulk export (products, orders, customers, inventory, or custom query)get-bulk-operation-status- Check progress of bulk operationget-bulk-operation-results- Download and parse completed results (summary, sample, or full)
Server
get-status- Report MCP server status, configured store, and connection health
Debugging
Tail Claude Desktop logs:
tail -n 20 -f ~/Library/Logs/Claude/mcp*.log
License
MIT
Source & license
This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: benwmerritt
- Source: benwmerritt/shopify-mcp
- License: MIT
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet — be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.