shopify-readonly-mcp

A read-only MCP server for one Shopify store. It lets an AI agent (Claude Code or any MCP client) answer questions like "which orders from this week are still unshipped?" or "what is about to go out of stock?" through the Shopify Admin GraphQL API.

It is read-only by design, so it is safe to hand to an agent:

• every request is a fixed GraphQL query, and the client refuses to send any mutation;
• the app only needs read scopes;
• no customer contact details (email, phone, address) are ever requested;
• requests only go to <your-store>.myshopify.com, whatever SHOPIFY_STORE contains.

Tools

| Tool | What it does | | --- | --- | | get_shop | Store name, domain, currency, timezone | | search_products | Search products with Shopify search syntax (title:shirt, status:active) | | get_product | One product with every variant's SKU, price and inventory | | list_orders | Orders newest first, filterable (fulfillment_status:unshipped, created_at:>2026-10-01) | | get_order | One order with line items, by id or by name (#1001) | | low_stock | Variants with inventory at or below a threshold |

List tools return pageInfo.endCursor; pass it back as after to get the next page.

Setup

Since January 2026, new Shopify apps are created in the Dev Dashboard (not in the store admin).

1. In the Dev Dashboard, create an app.
2. Give it the scopes read_products, read_orders, read_inventory and release a version.
3. Install the app on your store (the store must be in the same Dev Dashboard organization as the app).
4. Orders are "protected customer data" even without names or emails. In the Partner Dashboard, open the app > API access requests > Protected customer data access, select Protected customer data with a reason and save. No extra fields are needed, and dev stores don't need review. Without this, the order tools fail with "not approved to access the Order object".
5. Copy the app's Client ID and Client secret.

The server exchanges these for an access token itself (client credentials grant) and refreshes it before its 24-hour expiry. If you already have an access token, set SHOPIFY_ACCESS_TOKEN instead.

Claude Code

claude mcp add shopify \
  -e SHOPIFY_STORE=your-store \
  -e SHOPIFY_CLIENT_ID=... \
  -e SHOPIFY_CLIENT_SECRET=... \
  -- node /path/to/shopify-mcp/dist/index.js

Environment variables

| Variable | Required | Notes | | --- | --- | --- | | SHOPIFY_STORE | yes | your-store or your-store.myshopify.com | | SHOPIFY_CLIENT_ID + SHOPIFY_CLIENT_SECRET | one of the two | Dev Dashboard app credentials | | SHOPIFY_ACCESS_TOKEN | one of the two | An existing Admin API token | | SHOPIFY_API_VERSION | no | Defaults to 2026-10 |

Development

npm install
npm test                                   # unit tests, no network
node --env-file=.env scripts/mcp-test.mjs  # end-to-end against your dev store

Limits

• Without the read_all_orders scope, Shopify only returns orders from the last 60 days.
• The client credentials grant only works for stores in your own Dev Dashboard organization. To connect a client's store, the app needs the authorization code grant instead.

License

MIT