Shopify MCP: A Practical 2026 Guide for Developers

What is Shopify MCP?

Searched "shopify mcp" expecting one thing to install? The honest answer: the term covers several different products. Shopify MCP refers to Shopify's family of Model Context Protocol servers, endpoints that let an AI agent or LLM talk to Shopify through a standardized, self-describing tool interface. There are two official families plus a tier of community projects, and they do entirely different jobs:

1. Storefront MCP (and its companion Customer Accounts MCP): hosted endpoints on a store's own domain that let external shopping agents search a catalog, manage a cart, and answer policy questions.
2. Shopify Dev MCP (part of the Shopify AI Toolkit): a local server that connects coding assistants to Shopify's docs, API schemas, and code validation.
3. Community Shopify MCP servers: third-party projects that wrap Shopify's Admin API so you can operate your store from an AI client. These are not maintained by Shopify.

Most "shopify mcp" searchers mix these up, so before any setup, it helps to know which one you actually need. The rest of this guide pulls them apart, walks through a real shopify mcp setup, and covers permissions, security, and troubleshooting.

The official Storefront MCP server

Shopify's Storefront MCP lets developers "Connect any AI assistant to real-time commerce data from Shopify stores" using the Model Context Protocol (MCP). Its stated purpose is to "help customers search, ask, and buy in natural language."

Here's the thing about the shopify storefront mcp: it requires zero setup. Every Shopify store already has a live endpoint at:

https://{shop}.myshopify.com/api/mcp

Per Shopify's docs, "Storefront MCP servers don't require authentication." Requests are plain HTTP POST using JSON-RPC 2.0 with Content-Type: application/json. Nothing to install. You just point an MCP-capable client at the URL.

What the Storefront MCP exposes

The standard tools at /api/mcp include:

• search_shop_policies_and_faqs: "Answers questions about the store's policies, products, and services to build customer trust."
• get_cart: "Retrieves the current contents of a cart, including item details and checkout URL."
• update_cart: "Updates quantities of items in an existing cart or adds new items. Creates a new cart if no cart ID is provided."

There's also a separate, UCP-aligned catalog endpoint at https://{shop}.myshopify.com/api/ucp/mcp exposing search_catalog, lookup_catalog, and get_product. These conform to the Universal Commerce Protocol catalog capability and require an agent profile in every request (the meta.ucp-agent.profile parameter).

The Customer Accounts MCP server

The Customer Accounts MCP server is the authenticated companion. It provides "tools for customer-specific actions, including order management and account details," so checking order status, retrieving order details, or managing account preferences. Unlike the storefront tools, it requires OAuth 2.0, an access token obtained via the authorization code grant flow with PKCE, plus Level 2 protected customer data (PII) access requested from the Shopify Partner dashboard. You can discover the available tools via the tools/list command, each with a complete schema.

Where this fits: agentic commerce

Storefront MCP is part of Shopify's January 11, 2026 agentic commerce announcement, which centers on the Universal Commerce Protocol (UCP, co-developed with Google), Storefront MCP servers, and an "Agentic Plan" opening Shopify's Catalog to brands not using Shopify for their online store. This is what lets shoppers discover and buy products inside surfaces like ChatGPT, Microsoft Copilot, and Google AI Mode. Shopify reported on its Q3 2025 earnings call that AI-driven traffic was up 7x and AI-attributed orders up 11x since January 2025.

If you're a merchant, you mostly don't build this. Your store already participates. If you're a developer building a shopping agent, you consume these endpoints.

The official Shopify Dev MCP server

The other official offering is a completely different beast. The Shopify Dev MCP server, now part of the Shopify AI Toolkit, connects your coding assistant to "Shopify's documentation, API schemas, and code validation." It doesn't touch a live store's data. It helps you build apps and themes.

It runs locally over stdio. The npm package is @shopify/dev-mcp (latest version 1.14.0, ISC license, built on the MCP SDK 1.29.0). Supported clients: Claude Code, Codex, Cursor, Gemini CLI, Hermes, and VS Code.

Tools the Dev MCP exposes

Two capability buckets here: docs/schema search and code validation. Documented tool names include learn_shopify_api (call this first, it provides API context and a conversation ID reused across subsequent calls), search_docs_chunks, fetch_full_docs, introspect_graphql_schema, and validate_graphql_codeblocks, plus validate_theme / validate_theme_codeblocks gated by an environment variable. Tool names are version-specific and have changed over time, so verify against the live README or npx @shopify/dev-mcp@latest if exact names matter to your tooling.

Step-by-step: setting up the Shopify Dev MCP

Prerequisite: Node.js 18 or higher.

Option A: the Shopify AI Toolkit plugin (recommended)

Shopify recommends the AI Toolkit plugin for auto-updates. The commands are per-client. For Claude Code:

/plugin marketplace add Shopify/shopify-ai-toolkit
/plugin install shopify-plugin@shopify-ai-toolkit

For Gemini CLI:

gemini extensions install https://github.com/Shopify/shopify-ai-toolkit

For Cursor, install from the Cursor Marketplace. For Codex, run /plugins, search "Shopify," and add it. For VS Code, use the Command Palette → "Chat: Install Plugin From Source" → paste https://github.com/Shopify/shopify-ai-toolkit. Full details are in the shopify-ai-toolkit README (note: the maintainers state they don't accept pull requests, any pull requests will be automatically closed).

Option B: the raw Dev MCP server via npx

If your client isn't covered by the plugin, configure the MCP server directly. For Claude Code:

claude mcp add --transport stdio shopify-dev-mcp -- npx -y @shopify/dev-mcp@latest

For Cursor (Settings → Tools and MCP → New MCP server) or Gemini CLI (settings.json):

{
  "mcpServers": {
    "shopify-dev-mcp": {
      "command": "npx",
      "args": ["-y", "@shopify/dev-mcp@latest"]
    }
  }
}

For VS Code (Command Palette → "MCP: Open User Configuration", mcp.json):

{
  "servers": {
    "shopify-dev-mcp": {
      "command": "npx",
      "args": ["-y", "@shopify/dev-mcp@latest"]
    }
  }
}

For Codex (~/.codex/config.toml):

[mcp_servers.shopify-dev-mcp]
command = "npx"
args = ["-y", "@shopify/dev-mcp@latest"]

Useful environment variables

You can tune behavior with env vars inside the mcpServers entry:

• POLARIS_UNIFIED=true: surface Polaris web-components docs (available in early access).
• LIQUID_VALIDATION_MODE=full|partial: full (default) enables validate_theme over whole theme directories; partial enables validate_theme_codeblocks.
• OPT_OUT_INSTRUMENTATION=true: disables the on-by-default telemetry (more on this below).

Community Admin-API MCP servers

The official servers cover shoppers (Storefront) and builders (Dev). Neither one lets you operate your store conversationally, though. Updating inventory, editing orders, managing products: that's the gap the community fills.

The most popular is GeLi2001/shopify-mcp, described as an "MCP Server for Shopify API, enabling interaction with store data through GraphQL API." It runs via npx shopify-mcp and exposes roughly 31 tools across products, customers, orders, draft orders, metafields, inventory, and tags through the GraphQL Admin API. Another option is amir-bengherbi/shopify-mcp-server.

These are third-party projects, not vetted by Shopify. They authenticate with a Shopify Admin access token (a legacy shpat_ token) or client credentials, and require scopes such as read/write_products, read/write_customers, and read/write_orders. Setup usually means editing a JSON config like claude_desktop_config.json and restarting the client. As Polar Analytics notes, basic setup is largely copy/paste JSON ("if you can copy and paste a text block and replace a couple of placeholder values, you can complete the setup in under 10 minutes"); advanced use still needs developer skills.

Permissions and security

Treat MCP access the way you'd treat any credential surface:

• Least privilege for Admin-API servers. A shpat_ token is a secret. Scope it to only what the agent needs. If an agent only reads inventory, don't grant write_orders. These community servers run with whatever scopes you give them.
• Pin versions in audited environments. npx -y @shopify/dev-mcp@latest auto-runs the latest published version on each start. For reproducible builds, pin a specific version.
• The Dev MCP doesn't need store write tokens. It's read/validate-oriented (docs, schemas, validation). Store management goes through the Shopify CLI, not the Dev MCP.
• Don't expose customer-account tools without proper auth. Storefront browse/cart tools are intentionally public, but the Customer Accounts server requires the OAuth 2.0 authorization code grant flow with PKCE for a reason.
• Telemetry is on by default in the AI Toolkit. Per the README, skill scripts and a hook POST usage events to https://shopify.dev/mcp/usage, and on Claude Code the hook can attach the user's most recent prompt verbatim (truncated to 2000 chars). Disable with OPT_OUT_INSTRUMENTATION=true.
• Payments are never raw. In agentic checkout flows, agents must never collect or transmit raw payment credentials; payment runs through the store's checkout, not the agent.

Troubleshooting

• `npx` fails on Windows. The dev-mcp README has historically recommended wrapping the command: use "command": "cmd" with "args": ["/k", "npx", "-y", "@shopify/dev-mcp@latest"]. (This snippet circulates via README mirrors after the repo was consolidated into shopify-ai-toolkit: confirm against the current README.)
• Tools don't appear. Confirm Node.js 18+ is on your PATH, then restart the client fully so it re-reads the MCP config.
• Wrong tool names. Dev MCP tool names are version-specific. Inspect them with npx @shopify/dev-mcp@latest or the MCP inspector (npx @modelcontextprotocol/inspector).
• Storefront MCP returns nothing. Verify the exact endpoint (/api/mcp vs /api/ucp/mcp) and that requests are JSON-RPC 2.0 with Content-Type: application/json. UCP catalog tools also require the agent-profile parameter.

Beyond shopping: agents that operate the store

Most coverage of Shopify MCP explains the inbound direction: letting external shoppers buy from your store. The under-discussed inverse is building your own agent that uses Shopify's MCP or Admin API as a tool to act on the store. Something triggered by an event (a new order, low stock, a refund request) that acts through APIs (update inventory, tag orders, draft a response).

This event-triggered, agent-as-operator pattern is exactly the frame gamut.so (from Datawizz) is built around. An AI agent knowledge workforce where agents use MCP servers as tools to act on external systems, triggered by events and acting through APIs. A Shopify MCP server is just one tool such an agent can pick up, the same way it would reach for a payments or support API. The mental model holds whether or not you use a platform to do it: the MCP server is the tool, the event is the trigger, the API is the action.

FAQ

What is the Shopify MCP server?

It's not one server. Shopify ships an official Storefront MCP (and Customer Accounts MCP) for shopping agents, and an official Dev MCP for coding assistants. Community servers wrap the Admin API for store operations.

Does the Storefront MCP require setup or API keys?

No. Every store has a live endpoint at https://{shop}.myshopify.com/api/mcp, and Storefront MCP servers don't require authentication. The Customer Accounts MCP, by contrast, requires OAuth 2.0.

What's the difference between the Storefront MCP and the Dev MCP?

The Storefront MCP is a hosted endpoint for AI shopping agents (catalog, cart, policies). The Dev MCP runs locally for coding assistants and provides docs, schema introspection, and code validation.

Which AI clients work with Shopify MCP?

Any MCP-compatible client. The Dev MCP officially supports Claude Code, Codex, Cursor, Gemini CLI, Hermes, and VS Code. Storefront discovery additionally reaches surfaces like ChatGPT, Gemini, and Copilot.

Can a Shopify MCP server modify my store data?

The external-facing Storefront MCP is shop/read-oriented and does not let outside agents edit your admin data. A community Admin-API server can modify data (pricing, inventory, listings), but only with write scopes on the token you provide.

Is the Shopify MCP server free?

The official servers are free; the Dev MCP server is open source (ISC license). Some AI clients and third-party servers carry their own pricing.

Do I need coding skills to set it up?

Basic setup is copy/paste JSON config plus a client restart. Advanced and custom use still requires developer skills.

Sources

• Shopify Storefront MCP docs
• Storefront MCP server reference
• Customer Accounts MCP server
• Shopify Dev MCP / AI Toolkit
• Shopify agentic commerce announcement
• Model Context Protocol
• @shopify/dev-mcp on npm
• GeLi2001/shopify-mcp