Shopify Admin Readonly MCP Server

A read-only MCP (Model Context Protocol) server for the Shopify Admin GraphQL API. Allows AI assistants to query your Shopify store data without any risk of modification.

Tools Available

| Tool | Description | |------|-------------| | shopify_get_shop | Get store info (name, domain, currency, plan) | | shopify_list_products | List products with filtering and pagination | | shopify_get_product | Get full product details including variants and images | | shopify_list_product_variants | List variants with SKU/inventory filtering | | shopify_list_orders | List orders with status filtering | | shopify_get_order | Get full order details with fulfillments | | shopify_list_customers | Search/list customers | | shopify_get_customer | Get full customer details with order history | | shopify_list_collections | List product collections | | shopify_list_locations | List fulfillment locations | | shopify_get_inventory_levels | Get inventory by location |

Setup

1. Get Shopify Credentials

1. In your Shopify admin, go to Settings → Apps and sales channels → Develop apps
2. Create a new app (or use an existing one)
3. Under Configuration → Admin API scopes, add these read-only scopes:
   • read_products
   • read_orders
   • read_customers
   • read_inventory
   • read_locations
4. Install the app and copy the Admin API access token

2. Install & Build

npm install
npm run build

3. Configure Claude Desktop (stdio)

Add to your claude_desktop_config.json:

{
  "mcpServers": {
    "shopify-readonly": {
      "command": "node",
      "args": ["/path/to/shopify-admin-readonly-mcp/dist/index.js"],
      "env": {
        "SHOPIFY_SHOP_DOMAIN": "your-store.myshopify.com",
        "SHOPIFY_ACCESS_TOKEN": "shpat_xxxxxxxxxxxx"
      }
    }
  }
}

4. Run as HTTP Server

TRANSPORT=http SHOPIFY_SHOP_DOMAIN=your-store.myshopify.com SHOPIFY_ACCESS_TOKEN=shpat_xxx PORT=3000 node dist/index.js

Environment Variables

| Variable | Required | Description | |----------|----------|-------------| | SHOPIFY_SHOP_DOMAIN | ✅ | Your store domain (e.g., my-store.myshopify.com) | | SHOPIFY_ACCESS_TOKEN | ✅ (legacy) | Static token from admin-created custom app (shpat_...) | | SHOPIFY_CLIENT_ID | ✅ (Dev Dashboard) | Client ID from Dev Dashboard app | | SHOPIFY_CLIENT_SECRET | ✅ (Dev Dashboard) | Client Secret from Dev Dashboard app | | SHOPIFY_API_VERSION | Optional | API version (default: 2025-01) | | TRANSPORT | Optional | stdio (default) or http | | PORT | Optional | HTTP port (default: 3000) |

Auth modes: Use either SHOPIFY_ACCESS_TOKEN (legacy custom apps) or the pair SHOPIFY_CLIENT_ID + SHOPIFY_CLIENT_SECRET (Dev Dashboard apps). Tokens for Dev Dashboard apps expire every 24 hours and are automatically refreshed by the server.

Security

This server is strictly read-only — it only uses GraphQL queries, never mutations. All tools have readOnlyHint: true and destructiveHint: false annotations.