Shopify MCP in 2026: Every Official Server, Setup, and When to Build Your Own

Short answer. "Shopify MCP" is not one product. As of November 2026 Shopify runs several Model Context Protocol servers: buyer-side servers on every store at /api/ucp/mcp (catalog, cart, store questions), authenticated Checkout and Order servers, Shop MCP for searching and buying across Shopify Catalog, a Customer Accounts server, a Dev MCP server for developers, and WebMCP tools in the shopper's browser. The original Storefront MCP catalog and cart tools at /api/mcp have been removed. None of these runs your back office for you: for that you use Shopify's AI Toolkit or build your own Admin API server, which we did for a client.

What changed in 2026

Until 2026, most "Shopify MCP" guides described one endpoint: every store answered at https://{shop}/api/mcp with tools to search the catalog and manage a cart. Shopify has since moved buyer-facing agents to the Universal Commerce Protocol (UCP), an open standard it co-developed with Google. The deprecation notice kept the old cart tools until 31 August 2026; the migration page now says the catalog and cart tools on /api/mcp were removed.

Three things change in code, according to Shopify: every request to /api/ucp/mcp carries an agent profile; update_cart now replaces the whole cart, so you send every line item each time; and every Checkout MCP request is authenticated or signed. The Customer Accounts MCP server is unchanged.

Every official Shopify MCP server, in one table

Two details matter more than the table suggests. Checkout is where Shopify is strictest: in Shop MCP the agent completes a purchase only "after the shopper confirms the total and payment method", and there are no webhooks at launch, so the agent polls the checkout for its status. And Ask MCP is deliberately read-only: it "doesn't change carts, place orders, or start returns".

Which Shopify MCP do you need?

Most searches for "Shopify MCP" come from one of five goals. Each has a different answer, and two of them need no MCP work at all.

For the first goal the work is product data, not code: titles, variants, attributes and policies that an assistant can read and compare. We cover that in agentic commerce. For a plain explanation of what an MCP server is and what to expose, see what is an MCP server.

Agentic Storefronts and Shopify Catalog: what merchants control

Agentic storefronts is a sales channel in the Shopify admin, "active by default for eligible stores". It puts your products in ChatGPT, Google AI Mode and Gemini, Microsoft Copilot and Meta through Shopify Catalog (Google also reads the Google & YouTube channel or Merchant Center). Checkout differs by channel: ChatGPT sends the buyer to your own online store checkout in an in-app browser, while AI Mode, Gemini, Copilot and Meta can use a Shopify-powered direct checkout if you turn it on. Orders arrive in your admin with the channel attributed.

Because the integration is done for you, what decides whether an assistant recommends your product is the data it reads. Before anything technical, check:

• Titles that say what the product is, not only a brand name or a campaign line.
• Real variants with their own price, stock and option names (size, colour, material).
• Attributes in fields, such as metafields for material, dimensions, compatibility or certifications, not only in images or long descriptions.
• Policies and the knowledge base filled in: returns, shipping times, warranty.
• B2B-only items marked as such, so they stay out of consumer channels.

The wider picture, including how assistants choose products, is in agentic commerce.

Connect Claude or ChatGPT to your own store data: 5 ways

Many "Shopify MCP" searches mean something else: "let my AI assistant read my sales and edit my products". Shopify's buyer-side servers cannot do that. These five routes can, with very different risk:

Shopify's own rule of thumb: use Sidekick when the task involves your store data or an action inside the admin, and a general assistant for writing, research and planning. Among App Store apps, some add the controls a store needs: ShopMCP, for example, sets read, change and delete permissions per connection and keeps an audit log of every request, including blocked ones.

If you try a community server such as shopify-mcp, create a separate app for it and start with read-only scopes (read_products, read_orders). Add write_products only for the task that needs it, and keep write_customers and write_orders away from experiments. According to that project's README, apps created in the Dev Dashboard since 1 January 2026 use OAuth client credentials (tokens valid for about 24 hours) instead of a static shpat_ access token; existing custom apps can still use theirs.

For developers: Dev MCP, Claude Desktop and a first UCP request

The Dev MCP server runs on your machine, needs no authentication and gives your coding assistant Shopify's current documentation and API schemas, so it stops inventing GraphQL fields. In Claude Code it is one command (Shopify's instructions cover Cursor, Codex and VS Code too):

claude mcp add --transport stdio shopify-dev-mcp -- npx -y @shopify/dev-mcp@latest

In Claude Desktop or Cursor the same server goes into the MCP configuration file (in Claude Desktop on macOS: ~/Library/Application Support/Claude/claude_desktop_config.json), then restart the app:

{
  "mcpServers": {
    "shopify-dev-mcp": {
      "command": "npx",
      "args": ["-y", "@shopify/dev-mcp@latest"]
    }
  }
}

Building a shopping agent is different: you call a store's UCP endpoint over JSON-RPC, and every request names your agent profile. A first catalog search, following Shopify's example, looks like this (POST to https://{shop}/api/ucp/mcp):

{
  "jsonrpc": "2.0",
  "method": "tools/call",
  "id": 1,
  "params": {
    "name": "search_catalog",
    "arguments": {
      "meta": { "ucp-agent": { "profile": "https://your-agent.example/ucp-profile.json" } },
      "catalog": {
        "query": "organic coffee beans",
        "context": { "address_country": "US" }
      }
    }
  }
}

The wider Shopify AI Toolkit adds code validation for GraphQL, Liquid and extensions, and store management through Shopify CLI, "with you choosing when to execute them".

When to build your own Shopify MCP server

Shopify's servers act for buyers, and the AI Toolkit is built around developers. When a merchant wants to run repetitive store work by asking for it (import a catalogue, retag a range, publish what was reviewed), a small MCP server on the GraphQL Admin API is the missing piece. We built one for Horeca Papatya during its move from WooCommerce to Shopify. The design has two layers:

• Knowledge: Shopify AI Toolkit, so the assistant works from Shopify's real schema and docs instead of memory.
• Action: our own MCP server with a fixed list of tools: search, read, create, update and delete products, set inventory, publish, bulk-update by search query, list low stock, and import a CSV through bulk operations.

The tools are the easy part. The rules around them are what make it safe to use on a live store:

• New products are drafts. create_product defaults to DRAFT; going live is a separate publish step after review.
• Bulk changes rehearse first. bulk_update_products runs as a dry run by default and reports how many products would change; the real run needs an explicit second call.
• Deletes need a yes. delete_product refuses to run without confirm: true, and the assistant is told to ask first.
• Imports use bulk operations, not a loop of single creates, to stay inside Shopify's rate limits.
• GraphQL Admin API only, on a pinned API version, so an upgrade is a decision, not a surprise.
• Minimum scopes, and the token never appears in the chat.

1. Ask
   Plain language

   "Tag every product from this vendor as coffee-machine."

2. Rehearse
   Dry run

   bulk_update_products with dryRun on: the number of matching products comes back, nothing changes.

3. Confirm
   A person

   The merchant checks the count and says yes.

4. Run
   Real update

   The same call with dryRun off; the result lists what changed.

Lesson: the agent's speed comes from the tools, its safety from defaults. Put the cautious option in the tool itself (draft, dry run, confirmation) instead of trusting the prompt to remember it. It is the same pattern we describe in AI agent examples.

Security checklist before you connect an agent to Shopify

• Give each agent its own credentials and the smallest scopes it needs; read-only first.
• Keep money and irreversible actions behind a person: checkout completion, refunds, deletes, price changes.
• Prefer tools that rehearse (dry run) and default to drafts.
• Pin the API version and test before you move to a new one.
• Treat product data and customer messages as untrusted input (prompt injection): an agent should not follow instructions it reads inside them.
• Keep an audit log of every tool call, so you can see what the agent did and undo it.

Troubleshooting

• Calls to /api/mcp fail or return no catalog tools: those tools were removed. Move to https://{shop}/api/ucp/mcp.
• tools/list shows fewer tools than expected: the tools depend on the capabilities your agent profile declares. Ask MCP needs a UCP draft profile that declares dev.ucp.common.ask.
• Items disappear from the cart after an update: update_cart replaces the whole cart. Send every line item each time.
• Checkout requests are rejected: Checkout MCP needs authentication or signed requests, with client credentials from the Catalog section of the Dev Dashboard.
• No status updates from Shop MCP: there are no webhooks at launch. Poll get_checkout.
• Products missing in ChatGPT or Copilot: check Sales channels > Agentic, the channel's Shopify Catalog access, the product status and whether the product is B2B-only.

Frequently asked questions

• What is Shopify MCP?+−

  A family of Model Context Protocol servers that let AI agents work with Shopify: buyer-side servers for catalog, cart, questions, checkout and orders (built on UCP), Shop MCP across Shopify Catalog, Customer Accounts MCP, the Dev MCP server for developers and WebMCP tools in the browser.

• Is Shopify Storefront MCP deprecated?+−

  Yes. Its catalog and cart tools on https://{shop}/api/mcp were removed in favour of UCP servers at https://{shop}/api/ucp/mcp. The cart tools were kept until 31 August 2026. The Customer Accounts MCP server is unchanged.

• Does every Shopify store have an MCP server?+−

  Shopify serves the UCP endpoint at https://{shop}/api/ucp/mcp for stores, and every request must include an agent profile. Which tools an agent sees depends on the capabilities in that profile.

• How do I connect Claude or Cursor to Shopify?+−

  For development, add Shopify's Dev MCP server (npx -y @shopify/dev-mcp@latest) or install the Shopify AI Toolkit plugin. For a store's live data you need an app with Admin API access, through the AI Toolkit's store management or your own MCP server.

• Do I need an MCP server to sell in ChatGPT?+−

  No. Shopify connects merchants to AI channels such as ChatGPT, Google AI Mode, Gemini and Microsoft Copilot and manages them from the Shopify admin. Your part is complete, accurate product data.

• Can I stop my products appearing in ChatGPT?+−

  Yes, per channel: in Sales channels > Agentic, turn off Allow Shopify to manage for me, then turn off Shopify Catalog access for ChatGPT. To hide a single product from every AI channel, set its status to Unlisted. You can't opt out of Shopify Catalog itself, and products can still be found through ordinary web crawling.

• What permissions should a Shopify MCP server have?+−

  The fewest that do the job: read-only scopes such as read_products and read_orders first, write_products only for the task that needs it, and a separate app per tool so you can revoke one without the others.

• Can a Shopify MCP server change my store?+−

  The buyer-side servers cannot touch your admin. Only a server with Admin API access can, such as the AI Toolkit's store management or a custom server. Give it drafts, dry runs and confirmations by default.

Sources

• Shopify: Migrate from Storefront MCP
• Shopify changelog: Storefront MCP cart tools are being deprecated in favour of UCP Cart MCP
• Shopify: Build commerce agents with UCP
• Shopify: Storefront Catalog MCP
• Shopify: Cart MCP
• Shopify: Checkout MCP
• Shopify: Ask MCP
• Shopify: Order MCP
• Shopify changelog: Add shopping and Shop Pay checkout to any agent with Shop MCP
• Shopify: Customer Accounts MCP server
• Shopify: AI Toolkit
• Shopify: WebMCP tools
• Shopify: The agentic commerce platform
• Shopify Help Center: Shopify agentic storefronts
• Shopify Help Center: Managing agentic storefronts
• Shopify Help Center: Shopify Catalog
• Shopify Help Center: Shopify Catalog and product discovery for agentic storefronts
• Shopify: AI ChatGPT guide for Shopify merchants (Sidekick vs ChatGPT)
• GitHub: shopify-mcp (community server)
• Shopify App Store: ShopMCP
• Google: New tech and tools for retailers to succeed in an agentic shopping era

• Shopify
• MCP

Ahmet Molon

Founder