Shopify MCP: Dev MCP, Storefront MCP and Admin access explained

Shopify has embraced MCP from two directions: helping developers build on Shopify, and letting AI agents shop from Shopify stores. Neither of those is "manage my store from Claude", which is what most merchants search for, so this guide separates the three. Client instructions are in Claude Code, Cursor and Claude Desktop.

Shopify Dev MCP: for developers

An official local server that gives coding agents access to Shopify's developer documentation, the Admin and Storefront GraphQL schemas with validation, Polaris component docs and Liquid references. The point is correctness: an agent with the schema stops inventing fields.

claude mcp add --transport stdio shopify-dev -- npx -y @shopify/dev-mcp@latest

No login needed. Use it when building apps, themes, Functions or checkout extensions.

Storefront MCP: for shopping agents

Every store exposes an MCP endpoint at its domain, in the form https://<store>/api/mcp. It offers tools to search products, get product details, manage a cart and read store policies. It is designed for agents that buy on behalf of consumers: assistants inside chat apps, Shopify's own agentic commerce features, and custom shopping agents.

As a merchant you do not set it up; it is there. What you can do is make sure your catalogue data (titles, descriptions, variants, policies) reads well to an agent, because that is now a discovery channel. This is the commerce side of SEO for AI search.

Admin operations: community servers

For "update prices on these 40 products", "list unfulfilled orders older than 3 days" or "draft product descriptions for the new collection", you need the Admin API. Community MCP servers wrap it, authenticating with a custom app's Admin API access token scoped to the resources you choose.

The setup pattern:

1. Create a custom app in the Shopify admin, grant it only the scopes needed (read_products, read_orders, write_products if you must).
2. Install the app and copy the access token.
3. Configure the community server with the store domain and token; add it to your client.

Review the server's code before trusting it with a write token. Product and inventory edits are live on the storefront immediately.

What to ask

• "Products with inventory below 5 that sold more than 20 units last month."
• "Orders from the last 48 hours with a shipping address outside the EU."
• "Draft SEO titles and descriptions for every product in the Autumn collection, in our house style." (draft, not write, until reviewed)
• "Compare conversion by landing page for the last campaign using GA4." (with the Analytics server)

Safety for merchants

An Admin token with write scopes is the keys to the shop. The controls are the usual: minimal scopes, approval on every write, results from customer-authored content (order notes, reviews) treated as untrusted, and a log. For a store run by a team, those live in a gateway rather than in each person's client. Walma AI Hub hosts approved servers behind one policy in the customer's own EU region; book a walkthrough if you want agents working in your store safely.