What Is the Shopify MCP Server?
The Shopify MCP server is a Model Context Protocol server that connects MCP clients such as Claude Desktop and Claude Code to Shopify. It exposes 4 tools and 2 resources through the stdio transport.
What You Can Do with This Integration
listsearchreadcreateHow the Integration Works
Prerequisites
- Node.js 18+ or Python 3.12+
- A Shopify account with API access
- One of: Claude Desktop, Claude Code, Cursor, VS Code
- OAuth 2.0 credentials
- A public HTTPS endpoint for remote Streamable HTTP deployment
Installation
- Ensure Node.js 18+ is installed:
node --version - Install the server from its official package or repository:
# Follow the maintainer's official installation instructions for this MCP server - Set your credentials as environment variables:
export SHOPIFY_API_KEY="your-key-here" - Test the server starts correctly:
node /absolute/path/to/shopify-mcp-server/server.js --help
Client Configuration
Add the server to your Claude Desktop or Cursor configuration file:
{
"mcpServers": {
"shopify": {
"command": "node",
"args": ["/absolute/path/to/shopify-mcp-server/server.js"],
"env": {
"SHOPIFY_API_KEY": "YOUR_KEY_HERE"
}
}
}
}Restart the client after saving. The Shopify tools should appear in the tool palette.
Authentication
Auth method: oauth2
This server uses OAuth 2.0. The client initiates the flow and stores the refresh token securely. Never expose access tokens in config files.
Available Tools
listsearchreadcreaterecordsresourcemetadataresourceComplete Example
{
"jsonrpc": "2.0",
"method": "tools/call",
"params": {
"name": "list",
"arguments": {}
},
"id": 1
}Testing the Connection
- Start the server and check for no startup errors in your client logs.
- Open the MCP Inspector:
npx @modelcontextprotocol/inspector - Connect to
stdioand verify all listed tools appear. - Call the first tool with minimal arguments and confirm a valid response.
Security Considerations
Security Checklist
- Use least-privilege scopes
- Store credentials outside client configuration files
- Require human confirmation before any destructive tool call.
- Log all tool invocations with timestamps and user identity.
- Rotate credentials every 90 days or immediately after suspected exposure.
See the full MCP prompt injection guide and authentication guide for detailed coverage.
Common Errors
| Error | Likely Cause | Fix |
|---|---|---|
| Server not found | Incorrect command or path | Verify the npx package name or executable path |
| Connection failed | Transport mismatch | Confirm stdio transport is configured |
| Tools not visible | Capability negotiation failed | Restart the client after adding the server config |
| Authentication failed | Missing or invalid token | Check the environment variable name and token scope |
| Timeout | Slow external service or network | Add timeout and retry handling in your config |
Full diagnostics: MCP server not connecting · tools not appearing
Alternatives
- stripe MCP Server
- salesforce MCP Server
- servicenow MCP Server
- Direct Shopify REST API — no MCP required but no AI-native discovery.