Verified

Shopware MCP Server

Shopware 6 entities and administrative audits via the Model Context Protocol.

Data last scanned today · Reviewed today

5826 tools★ 57TypeScriptMIT

Overview

Shopware MCP Server acts as an abstraction layer between your AI assistant and the complex Shopware 6 Admin API. Instead of interacting directly with raw endpoints, the server provides curated tools for managing products, orders, customers, and inventory. It translates complex shop states into model-friendly JSON, streamlining data retrieval and administrative workflows. The server features built-in auditing capabilities, such as the shop_audit tool, which performs eleven distinct checks on your shop status—including monitoring stale unpaid orders or identifying paid orders that have not shipped. By consolidating multiple API requests into single, focused tool calls, it simplifies tasks that would otherwise require intensive manual querying.

Our verdict

This server carries a high-risk score of 38/100, primarily because its authentication methods and read-only configurations have not been subject to professional editorial review. As a community-maintained project rather than an official vendor tool, it should be deployed with caution in production environments until the security implications of its API interaction methods are fully audited.

Supports Shopware 6 with sixteen specialized administrative tools.
Small footprint with only two direct dependencies.
Includes automated end-to-end testing against real Shopware instances.
Compact JSON output optimized for LLM consumption.

High security risk due to unreviewed authentication processes.
Not maintained by the official Shopware vendor.
Read-only mode safety has not been verified.

Setup

Claude Desktop

{
  "mcpServers": {
    "shopware-mcp": {
      "args": [
        "-y",
        "shopware-mcp"
      ],
      "command": "npx"
    }
  }
}

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows), then restart Claude Desktop. Some servers require API keys or tokens as environment variables — check the project's README and add an "env" object if needed.

No read-only mode — running this grants full read/write access.
No built-in authentication — anyone with access to this config can invoke every tool it exposes.

Tools

Tool	Description	Risk
shop_info	Shop info	low
sales_channels_list	List sales channels	low
products_search	Search products	low
products_get	Get product	low
orders_search	Search orders	low
orders_get	Get order	low
order_documents_list	List order documents	low
document_download	Download document PDF	low
customers_search	Search customers	low
customers_get	Get customer	low

Compatibility

Client	Local	Docker	Remote	Read-only
ChatGPT
Claude Desktop
Cursor
VS Code
Windsurf

Frequently asked questions

›Is the server capable of writing data to my Shopware store?

The server is read-only by default. You must explicitly start it with the --allow-write flag to enable write operations, and even then, writes are performed as dry runs first to show the exact request.

›Does the server require custom configuration to support installed plugins?

No configuration is needed. The server automatically detects installed extensions at startup and registers additional tools accordingly.

›How are security and sensitive data handled?

The server scrubs secrets from entity search results and refuses to expose entities that hold credentials. Additionally, secrets are never included in output, logs, or errors.

›What is the function of the write budget feature?

The write budget allows you to cap the total number of real write operations a single process is permitted to perform.