Shopify MCP Server
Shopify store management via GraphQL API including products, orders, and customers.
Data last scanned today · Reviewed yesterday
Overview
Shopify MCP Server provides a comprehensive interface for interacting with your Shopify store data. By integrating directly with the Shopify GraphQL Admin API, it allows AI models to perform CRUD operations on products, variants, and customer records. The server also handles order fulfillment, refund processing, and inventory adjustments through a suite of targeted tools. Built in TypeScript, the project supports both legacy static access tokens and modern OAuth client credentials. It includes advanced filtering and cursor-based pagination, allowing for detailed queries across store resources like metafields and tags.
Our verdict
This server carries a high risk level with a security score of 22/100, primarily because it lacks a built-in authentication method, meaning anyone with access to your configuration can interact with your store. Furthermore, the server operates with full write access by default across all tools, and it is a community-maintained project rather than an official Shopify tool. Users should proceed with extreme caution and ensure their Shopify API scopes are restricted to the minimum required permissions before deployment.
- Supports modern OAuth client credentials and legacy static access tokens.
- Comprehensive CRUD coverage for products, customers, and order management.
- Utilizes Shopify's GraphQL Admin API for efficient data retrieval.
- Contains a small dependency footprint of only six direct modules.
- Lacks any internal authentication mechanism for the MCP server instance.
- Grants full write access permissions across all store resources.
- Maintenance status is community-led with no official vendor support.
- Project has not undergone an editorial security review.
Setup
{
"mcpServers": {
"shopify-mcp": {
"args": [
"-y",
"shopify-mcp"
],
"command": "npx"
}
}
}Paste into ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows), then restart Claude Desktop. Some servers require API keys or tokens as environment variables — check the project's README and add an "env" object if needed.
- No read-only mode — running this grants full read/write access.
- No built-in authentication — anyone with access to this config can invoke every tool it exposes.
Tools
| Tool | Description | Risk |
|---|---|---|
| get-products | Get all products or search by title with pagination and sorting | low |
| get-product-by-id | Get a specific product by ID with full details including SEO, options, media, variants, and collections | low |
| create-product | Create a new product | medium |
| update-product | Update an existing product's fields | medium |
| delete-product | Delete a product | high |
| manage-product-options | Create, update, or delete product options (e.g. Size, Color) | medium |
| manage-product-variants | Create or update product variants in bulk | medium |
| delete-product-variants | Delete one or more variants from a product | high |
| get-customers | List customers with search, pagination, and sorting | low |
| get-customer-by-id | Get a single customer by ID with full details | low |
| create-customer | Create a new customer | medium |
| update-customer | Update a customer's information | medium |
| delete-customer | Delete a customer | high |
| customer-merge | Merge two customer records into one | medium |
| manage-customer-address | Create, update, or delete a customer's mailing address | medium |
| get-orders | Get orders with filtering, pagination, and sorting | low |
| get-order-by-id | Get a specific order by ID with smart lookup | low |
| update-order | Update an existing order | medium |
| get-customer-orders | Get orders for a specific customer with pagination and sorting | low |
| order-cancel | Cancel an order with options for refunding, restocking, and customer notification. | high |
| order-close-open | Close or reopen an order | medium |
| order-mark-as-paid | Mark an order as paid (for manual/offline payments) | medium |
| create-fulfillment | Create a fulfillment (mark items as shipped) with optional tracking | medium |
| refund-create | Create a full or partial refund with optional restocking | medium |
| create-draft-order | Create a draft order for phone/chat sales, invoicing, or wholesale | medium |
| complete-draft-order | Complete a draft order, converting it into a real order | medium |
| get-metafields | Get metafields for any Shopify resource (products, orders, customers, variants, collections, etc.) | low |
| set-metafields | Set metafields on any Shopify resource. Creates or updates up to 25 metafields atomically | medium |
| delete-metafields | Delete metafields from any Shopify resource | high |
| inventory-set-quantities | Set absolute inventory quantities for items at specific locations | medium |
| manage-tags | Add or remove tags on any taggable resource (orders, products, customers, draft orders, articles) | medium |
Compatibility
| Client | Local | Docker | Remote | Read-only |
|---|---|---|---|---|
| ChatGPT | ||||
| Claude Desktop | ||||
| Cursor | ||||
| VS Code | ||||
| Windsurf |
Frequently asked questions
›What are the prerequisite requirements to run this server?
You must have Node.js version 18 or higher installed and a Shopify store with a configured custom app.
›Which authentication methods does the server support?
The server supports modern OAuth client credentials for apps created in the Shopify Dev Dashboard and legacy static access tokens.
›How does the server handle OAuth token expiration?
When using client credentials, the server automatically exchanges them for an access token and refreshes it before it expires.
›Can I use environment variables instead of command-line arguments for configuration?
Yes, you can create a .env file containing your Shopify credentials and run the server using npx without extra flags.
›What should I do if I encounter an error about a missing SHOPIFY_ACCESS_TOKEN variable?
This error often indicates that you have the wrong package installed; ensure you are using 'shopify-mcp' and not 'shopify-mcp-server'.
›Is it possible to customize the Shopify API version?
Yes, the default API version is 2026-01, but you can override this using the --apiVersion flag or the SHOPIFY_API_VERSION environment variable.
Alternatives
Badge
Maintain this server? Add the live badge to your README.