MCP for AI tools
Let an AI assistant read your apps, stores and releases, or check and request access to a client store. It uses the same keys and limits as the REST API.
Install
You need Node.js 20.19 or newer and a client that runs local stdio servers. Run this once, as the same OS user as your MCP client, and wait for the CLI help to appear:
Then create a key in Settings → AI tools and save it to a private file with permissions 600.
Configure your client
There are two servers. One checks and requests access to client stores, the other reads your workspace. Add the one you need, replace the workspace ID, point it at your key file, and restart the client.
| Client | Where the configuration goes |
|---|---|
| Claude Desktop | claude_desktop_config.json, from Settings → Developer → Edit Config |
| Claude Code | .mcp.json in your project |
| Cursor | ~/.cursor/mcp.json, or .cursor/mcp.json in a project |
| Other clients | Wherever the client lists stdio servers under mcpServers |
Tools
Workspace server
| Tool | Does | Same as |
|---|---|---|
workspace_apps_list | List workspace app definitions. | GET /workspace/apps |
workspace_stores_list | List workspace stores and their recorded status. | GET /workspace/stores |
workspace_release_status | Read a saved fleet release by ID. | GET /workspace/releases/{releaseId} |
Access server
| Tool | Does | Same as |
|---|---|---|
shopify_access_capabilities | Returns supported permission names. | GET /shopify/capabilities |
shopify_access_check | Asks Shopify for the current relationship. Specific permission scopes are not verified. | GET /shopify/access |
shopify_access_request | Caller context is traceability, not authority. Sends exactly the listed permissions. Reuse one key for one intent; never change keys to retry an unknown outcome. | POST /shopify/access-requests |
shopify_access_request_status | Stored receipt only; updatedAt states freshness. | GET /shopify/access-requests/{requestId} |
shopify_access_request_refresh | Reconciles evidence without resending. Does not verify individual permissions. | POST /shopify/access-requests/{requestId}/refresh |
Turn on access requests only for assistants you allow to send them: a request reaches the merchant.
Things to ask
- “Which of my client stores are not installed yet?”
- “List my apps and how many stores each one is on.”
- “Do we have collaborator access to client-store-shopify-demo.myshopify.com?”
- “What is the state of release rel_123?”