Shopify MCP Server (Cesarjoquin)

Shopify Admin GraphQL API operations via a typed MCP tool interface.

Data last scanned today · Reviewed today

35★ 135RustMIT

Overview

This server translates MCP tool calls into Shopify Admin GraphQL operations, allowing AI assistants to manage complex ecommerce data. It supports product CRUD, inventory levels, customer management, order fulfillment, and metafield operations, with all list tools supporting cursor pagination and search syntax filtering. The architecture includes optional Redis-backed token persistence, structured JSON logging, and graceful shutdown capabilities. It handles authentication through either static access tokens or OAuth client-credentials to interact with the Shopify Admin API securely.

Our verdict

This server carries a high-risk security score of 35/100. The primary concern is that it lacks a read-only mode, meaning every installation provides the AI client with full write access to the connected Shopify store. Additionally, it is maintained by a single community contributor rather than an official Shopify vendor and has not yet undergone editorial review. This tool is best suited for experienced developers working in non-production environments who can carefully audit the tool calls being made.

Supports Redis-backed token caching for efficient authentication
Small supply-chain footprint with only seven direct dependencies
Includes structured JSON logging for request visibility

No read-only mode restricts safety against unauthorized modifications
Lacks official vendor maintenance and security vetting
High bus-factor risk with only one project contributor

Setup

Claude Desktop

{
  "mcpServers": {
    "cesarjoquin-shopify-mcp": {
      "args": [
        "-y",
        "shopify-mcp"
      ],
      "command": "npx"
    }
  }
}

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows), then restart Claude Desktop. Some servers require API keys or tokens as environment variables — check the project's README and add an "env" object if needed.

No read-only mode — running this grants full read/write access.
No built-in authentication — anyone with access to this config can invoke every tool it exposes.

Compatibility

Client	Local	Docker	Remote	Read-only
Claude Desktop
Cursor
VS Code
Windsurf
ChatGPT

Frequently asked questions

›What authentication methods does the server support?

The server supports both static access tokens for legacy apps and OAuth client-credentials for Shopify Dev Dashboard apps.

›Is Redis required to run this server?

Redis is optional and is used specifically for persisting OAuth tokens across restarts.

›Which Node.js version is required?

The server requires Node.js version 18 or later.

›What API scopes are necessary for the server to function?

You need to enable Admin API scopes including read/write permissions for products, customers, and orders, plus additional scopes for inventory or metafields as needed.

›Can I use environment variables and CLI flags simultaneously?

Yes, CLI flags take precedence and will override any values provided in your environment variables.

Badge

Maintain this server? Add the live badge to your README.