Shopify Mcp Server — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Shopify Mcp Server (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A Model Context Protocol (MCP) server for integrating with Shopify Admin API. This server provides tools to access and manage products, customers, orders, inventory, and collections from your Shopify store.
As of January 1, 2026, Shopify requires using the Client Credentials Grant flow for server-to-server authentication. You need to create a custom app in your Shopify admin to get client credentials:
read_products - for product accessread_orders - for order accessread_customers - for customer accessread_inventory - for inventory levelsImportant: The MCP server will automatically obtain and refresh access tokens using these credentials. Access tokens are valid for 24 hours and will be automatically refreshed before expiration.
npm installCreate a .env file in the root directory:
cp .env.example .envEdit .env with your Shopify credentials:
SHOPIFY_STORE_URL=your-store.myshopify.com
SHOPIFY_CLIENT_ID=your-client-id-here
SHOPIFY_CLIENT_SECRET=your-client-secret-here
SHOPIFY_API_VERSION=2024-01npm run buildAdd this server to your Claude Desktop configuration file:
Edit ~/Library/Application Support/Claude/claude_desktop_config.json:
{
"mcpServers": {
"shopify": {
"command": "node",
"args": ["/Shopify-mcp-server/dist/index.js"],
"env": {
"SHOPIFY_STORE_URL": "your-store.myshopify.com",
"SHOPIFY_CLIENT_ID": "your-client-id-here",
"SHOPIFY_CLIENT_SECRET": "your-client-secret-here",
"SHOPIFY_API_VERSION": "2024-01"
}
}
}
}Edit %APPDATA%\Claude\claude_desktop_config.json with similar configuration.
After adding the configuration, restart Claude Desktop.
All list endpoints (get_products, get_orders, get_customers, search_products, search_customers, get_inventory_levels, get_collections) support cursor-based pagination.
How it works:
page_infopagination object with:has_next_page: Boolean indicating if more results existhas_previous_page: Boolean indicating if previous results existnext_page_info: Cursor string to fetch the next page (if available)previous_page_info: Cursor string to fetch the previous page (if available)next_page_info value in the page_info parameterhas_next_page is falseExample workflow:
1. get_customers(limit: 250) → returns 250 customers + next_page_info
2. get_customers(limit: 250, page_info: "cursor_abc") → returns next 250 customers
3. Continue until has_next_page is false#### get_products Retrieve products with optional filtering. Supports pagination.
Parameters:
limit (number, optional): Number of products to retrieve (max 250, default 50)page_info (string, optional): Pagination cursor from previous responsestatus (string, optional): Filter by status ("active", "archived", "draft")product_type (string, optional): Filter by product typevendor (string, optional): Filter by vendorcollection_id (string, optional): Filter by collection ID#### get_product Get detailed information about a specific product.
Parameters:
product_id (string, required): The ID of the product#### search_products Search products by title. Supports pagination.
Parameters:
query (string, required): Search query stringlimit (number, optional): Number of results (max 250, default 50)page_info (string, optional): Pagination cursor from previous response#### get_orders Retrieve orders with optional filtering. Supports pagination.
Parameters:
limit (number, optional): Number of orders (max 250, default 50)page_info (string, optional): Pagination cursor from previous responsestatus (string, optional): Filter by status ("open", "closed", "cancelled", "any")financial_status (string, optional): Filter by financial statusfulfillment_status (string, optional): Filter by fulfillment status#### get_order Get detailed information about a specific order.
Parameters:
order_id (string, required): The ID of the order#### get_customers Retrieve customers from the store. Supports pagination.
Parameters:
limit (number, optional): Number of customers (max 250, default 50)page_info (string, optional): Pagination cursor from previous response#### get_customer Get detailed information about a specific customer.
Parameters:
customer_id (string, required): The ID of the customer#### search_customers Search customers by email, name, or phone. Supports pagination.
Parameters:
query (string, required): Search query (email, name, or phone)limit (number, optional): Number of results (max 250, default 50)page_info (string, optional): Pagination cursor from previous response#### get_inventory_levels Get inventory levels for products at specific locations.
Parameters:
inventory_item_ids (array, optional): Array of inventory item IDslocation_ids (array, optional): Array of location IDslimit (number, optional): Number of results (max 250, default 50)#### get_collections Retrieve both custom and smart collections.
Parameters:
limit (number, optional): Number of collections (max 250, default 50)Once connected to Claude Desktop, you can ask questions like:
For development with auto-rebuild:
npm run devYou can test the server directly using the MCP Inspector or by connecting it to Claude Desktop.
.env file or expose your client credentialsMake sure your .env file exists and contains valid credentials, or that environment variables are properly set in your Claude Desktop configuration.
This error occurs when the client credentials are invalid or the app doesn't have permission to access the store. Verify that:
Shopify has rate limits on API requests. The server doesn't currently implement rate limiting, so be mindful of rapid successive requests.
If you encounter API version errors, update the SHOPIFY_API_VERSION in your environment to a supported version (e.g., "2024-01").
MIT
Contributions are welcome! Please feel free to submit a Pull Request.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.