shopify-mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited shopify-mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
This skill covers working with the Shopify integration via the MCPClient from lib.gumloop_mcp. The MCPClient wraps the Gumloop MCP transport layer with automatic retries, error handling, and typed responses. Use it for all Shopify e-commerce platform operations.
Activate when the user wants to query, create, update, or manage Shopify e-commerce platform using the Gumloop MCP connection to shopify.
from lib.gumloop_mcp import MCPClient
client = MCPClient()
# The client auto-resolves credentials from the agent's connected integrations.
# No API keys or tokens to configure manually.All MCP calls should use this pattern:
def safe_call(client, server, tool, params, max_retries=3):
"""Call an MCP tool with retry and error handling."""
import time
for attempt in range(max_retries):
try:
result = client.call(server, tool, params)
error = getattr(result, 'error', None)
if error:
if attempt < max_retries - 1:
time.sleep(2 ** attempt)
continue
raise RuntimeError('MCP call failed: ' + str(error))
return result
except Exception as exc:
if attempt < max_retries - 1:
time.sleep(2 ** attempt)
continue
raiseAlways read the current state before modifying:
# Fetch current state first with retry
current = safe_call(client, 'shopify', 'list_products', 'list_products', {'limit': 10})
print('Current state:', current)from lib.gumloop_mcp import MCPClient
client = MCPClient()
# Fetch data with retry
result = safe_call(client, 'shopify', 'list_products', 'list_products', {'limit': 10})
print('Result:', result)Always read the current state first (GET-first) before modifying. For destructive operations, call confirm_destructive() or await_confirm() first.
from lib.gumloop_mcp import MCPClient
client = MCPClient()
# Read current state first
current = safe_call(client, 'shopify', 'list_products', 'list_products', {'limit': 10})
print('Current state:', current)
# Now create/update
result = safe_call(client, 'shopify', 'create_product', 'create_product', {'title': 'Cool T-Shirt', 'body_html': '<p>Limited edition tee</p>', 'vendor': 'MyBrand', 'product_type': 'Apparel', 'variants': [{'price': '29.99', 'inventory_quantity': 100}]})
print('Write completed:', result)# Read first, then update
current = safe_call(client, 'shopify', 'list_products', 'list_products', {'limit': 10})
print('Current state:', current)
result = safe_call(client, 'shopify', 'update_product', 'update_product', {'product_id': 1234567890, 'title': 'Updated T-Shirt', 'status': 'active'})
print('Updated:', result)from lib.gumloop_mcp import MCPClient
client = MCPClient()
# ALWAYS confirm with the user first
user_confirmed = await_confirm()
if not user_confirmed:
print('Operation cancelled by user')
return
# Read current state before deleting
current = safe_call(client, 'shopify', 'list_products', 'list_products', {'limit': 10})
print('About to delete:', current)
result = safe_call(client, 'shopify', 'delete_product', 'delete_product', {'product_id': 9999999999})
print('Delete completed:', result)If the native Gumloop shopify connection is unavailable, fall back to the raw REST API:
import os
import requests
# Get API key from bound secrets
api_key = os.environ.get('FALLBACK_API_KEY')
if not api_key:
raise RuntimeError('Missing FALLBACK_API_KEY - use bind_env_vars first')
# Call the native REST API directly
response = requests.get(
'https://shopify.dev/docs/api/admin-rest',
headers={'Authorization': 'Bearer ' + api_key, 'Accept': 'application/json'}
)
response.raise_for_status()
data = response.json()limit, page, or cursor parameters where available.shopifysafe_call(client, 'shopify', 'tool_discovery', {}) to list available tools at runtime.This skill is part of the Gumloop MCP integration suite. Tool names and schemas vary by deployment. Always rely on live discovery, not assumptions.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.