Shopify Multi-Store MCP

One MCP server. Every Shopify store.

Query, compare, report, and make guarded updates across Shopify stores from Claude, Codex, Cursor, VS Code, and other MCP clients.

Demo · Quick start · Reports · AI clients · Security

Version 1.6.0

This branch adds guided Admin workflows, ShopifyQL reports, schema validation, and a generic action surface for any Admin mutation.
See feature coverage and acceptance requirements.
Full Shopify ChatGPT parity is not yet verified.

See it work

The demonstration uses sample stores and sample data. The server keeps each real store credential separate.

Quick start

Install the server, connect your stores, and run the health check:

npm install --global shopify-multi-store-mcp-server
shopify-multi-store setup
shopify-multi-store doctor

Claude Code users can add the server with one command:

claude mcp add shopify-multi-store -- npx -y shopify-multi-store-mcp-server start

Each store gets a permanent alias and a separate secure credential. Every store operation requires that alias.

What you get

This server and Shopify Dev MCP

The two servers solve different problems. Use both when an agent needs Shopify reference material and access to your stores.

Shopify Dev MCP helps an agent create and examine Shopify code. This server runs the approved operation against the selected store.

Ready-made reports

shopify_report runs one read-only report across selected stores. Set report to one of these:

To search products across stores, use shopify_search with resource: "products" and stores.

Try prompts like these:

• “Give me a portfolio snapshot for every connected store.”
• “Summarize orders and current order values for the last 30 days. Keep currencies separate.”
• “Show low, zero, and negative inventory across retail and wholesale.”
• “Show products that are out of stock here but available in another store.”
• “Find SKU A123 across every store and compare its status, price, and inventory.”
• “Search every store for products related to protein.”
• “Show unfulfilled orders older than two days, grouped by age.”
• “Find products that are active in one store but missing or draft in another.”
• “Find price differences and duplicate SKUs across these stores.”
• “Compare inventory for SKU A123 and B456 across retail and wholesale.”
• “List unfulfilled orders from the last seven days in three stores.”
• “Audit catalog health and show the products with missing SEO or media data.”
• “Compare the active catalog and featured collections across these stores.”

Connect an AI client

The server works in clients that support local stdio MCP servers. Agent Skills improve tool selection when the client supports them.

Add the MCP server:

claude mcp add shopify-multi-store -- npx -y shopify-multi-store-mcp-server start

Copy the included skill for personal use:

mkdir -p ~/.claude/skills/shopify-multi-store
cp .claude/skills/shopify-multi-store/SKILL.md ~/.claude/skills/shopify-multi-store/SKILL.md

Claude Code also discovers .claude/skills inside this repository.

Add this server to the client's MCP configuration:

{
  "mcpServers": {
    "shopify-multi-store": {
      "command": "npx",
      "args": ["-y", "shopify-multi-store-mcp-server", "start"]
    }
  }
}

Add this server to .vscode/mcp.json:

{
  "servers": {
    "shopify-multi-store": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "shopify-multi-store-mcp-server", "start"]
    }
  }
}

Use npx as the command and -y shopify-multi-store-mcp-server start as the arguments.

Copy skills/shopify-multi-store/SKILL.md into the client's skills directory when supported. Clients without skill support still get every MCP tool.

Host it for your team

Local use on your own computer (above) is the default. Hosting is optional: whoever wants a shared server runs one, and their team connects from the AI app they already use, on any plan: Claude (personal custom connector), ChatGPT, Codex, Claude Code, Cursor, VS Code, Gemini CLI, Windsurf, or any MCP client that supports remote servers.

People sign in with their own Shopify staff account, and every call runs with that person's own Shopify permissions: Shopify decides what they can do, with no roles or policy file on the server. Shopify tokens stay on the server, encrypted. Reconnecting is at most once a day and one click for all stores. Every tool call is audited.

Two ways to host, both self-hosted by whoever wants a shared server:

• Cloudflare Workers: Step-by-step in docs/DEPLOY-CLOUDFLARE.md: create a Shopify app, set four secrets, deploy, add the MCP URL in your AI app.
• Any server: run shopify-multi-store serve (or the included Dockerfile) and share https://<host>/mcp.

See Connect from your AI app for per-client steps, docs/HOSTED.md for setup, and docs/ACTIONS.md for per-user access and the generic action tools.

Store authentication

Authorization code setup uses http://127.0.0.1:3456/oauth/callback. Add it as an allowed redirect URL first.

The default authorization code scopes are read-only. Grant only the Admin API scopes required for the task.

Connect your first store

Each store needs an alias (lowercase letters, digits and hyphens, such as main) and its permanent *.myshopify.com domain, which the store admin shows under Settings > Domains. The credential depends on how you get Admin API access. Shopify now creates new apps in the Dev Dashboard; custom apps made in the store admin keep working where they already exist.

With a Dev Dashboard app (new setups):

1. Open the Dev Dashboard (dev.shopify.com), choose Apps > Create app, and name it (for example "Multi-Store MCP").
2. Create a version. Under access scopes, add the scopes you need. read_products,read_orders,read_inventory,read_locations,read_customers covers the read tools; for everything the tools can do, print the full list with node "$(npm root -g)/shopify-multi-store-mcp-server/scripts/print-scopes.mjs" --full and remove any scope your app is not approved for. For the authorization code method, also add the redirect URL http://127.0.0.1:3456/oauth/callback.
3. Release the version, then install the app on your store from the Dev Dashboard, approving the scopes.
4. Copy the app's client ID and client secret from its settings.
5. Run shopify-multi-store oauth. Choose client-credentials if the store is in the same Shopify organization as the app, otherwise authorization-code (a browser window opens to approve). Enter the alias, the *.myshopify.com domain, the client ID and the client secret. With client credentials the server gets and refreshes tokens itself.

With a custom app created in the store admin:

1. In the store admin, open Settings > Apps (Apps and sales channels in some admins) > Develop apps and open your app. If your admin still offers it, you can create one there.
2. Under Configuration, give the Admin API the scopes you need, then install the app.
3. Under API credentials, reveal the Admin API access token (it starts with shpat_; Shopify shows it once).
4. Run shopify-multi-store setup and enter the alias, the *.myshopify.com domain and the token.

Then run shopify-multi-store doctor to check every store, and repeat for each further store. Secrets go to the operating system credential store, never to the configuration file.

Manage stores

shopify-multi-store list
shopify-multi-store doctor
shopify-multi-store remove store-alias

shopify-multi-store import /absolute/path/to/stores.json

The import copies credentials into the operating system credential store and preserves configured stores. Delete the old credential file after checking the import.

MCP tools

The server exposes 29 tools.

Read-only operations can run in parallel. Mutations stay isolated to the selected stores.

Every guided write tool defaults to dryRun: true, which returns a before/after (or would-create) preview without changing anything; pass dryRun: false, after the user authorizes the exact store and change, to apply it. The tool then reads the result back. Tags on products, orders, and customers change with addTags and removeTags; replaceTags replaces every tag and the preview lists the tags it would remove. Write results are never dropped for size: large results are trimmed, keeping status, counts, and every item that did not apply.

shopify_graphql_mutation and shopify_run_action refuse denylisted mutations and need confirm set to the mutation name for destructive ones, including mutations that are destructive only because of their arguments, such as a product status of ARCHIVED.

Generic action tools

Three tools reach every Shopify Admin API mutation (514 in API 2026-04), including the 483 without a dedicated tool:

A denylist blocks mutations that mint credentials or change the app's own billing. Request the full scope set with node scripts/print-scopes.mjs --full. See docs/ACTIONS.md for worked examples and what no third-party app can do.

Shopify companion skills

Install Shopify's official Admin GraphQL and ShopifyQL skills:

shopify-multi-store install-shopify-skills

The command installs both skills for supported agents. Pass --agent <name> to select one agent.

The skills search Shopify documentation and check custom GraphQL operations. ShopifyQL adds sales, revenue, order, conversion, and trend analysis.

This server still controls store selection, credentials, execution, and mutation authorization. Shopify's skill scripts send usage telemetry by default.

Set OPT_OUT_INSTRUMENTATION=true to turn off that telemetry.

This integration uses the official Shopify AI Toolkit. It also reflects useful patterns from Shopify Admin Skills.

Security model

Secrets never enter the main configuration file.

The configuration stores aliases, domains, API versions, and non-secret OAuth client IDs. Its default path is ~/.config/codex-shopify-multi-store/stores.json.

The codex-shopify-multi-store name, in that path and as the credential store's service name, is a legacy name from the project's first version. It stays so existing installs keep their stores and credentials; it does not mean the server works only with Codex.

Set SHOPIFY_MULTI_STORE_CONFIG to use another configuration path.

• Never commit access tokens, OAuth client secrets, .env files, or credential-bearing configuration files.
• Grant only the Shopify Admin API scopes required for the task.
• Confirm the target store before every mutation.
• Read SECURITY.md for vulnerability reporting.

Linux credential storage requires a Secret Service provider, such as GNOME Keyring or KWallet.

Other installation options

Run a health check without a global install:

npx -y shopify-multi-store-mcp-server doctor

Install directly from GitHub (npm runs the prepare script, which builds the server):

npm install --global github:alex-brecher/shopify-multi-store

Development

git clone https://github.com/alex-brecher/shopify-multi-store.git
cd shopify-multi-store
npm ci
npm test
npm run test:live
npm pack --dry-run

The live test uses configured stores and performs read-only Shopify Admin API calls.

License

MIT

Read the changelog, contribution guide, security policy, and directory submission guide.