Shopify MCP Server: Production Implementation Guide (2026)

Yes, Shopify has MCP servers, and in 2026 there are more of them than most guides list. A Shopify MCP server is a Shopify-hosted endpoint for AI agents. Through it an agent searches a store's catalogue, builds a cart, creates a checkout or reads order state over the Model Context Protocol. Every tool follows the Universal Commerce Protocol (UCP) as Shopify implements it in its agentic commerce documentation. Merchants deploy nothing. Agencies and in-house teams get a separate Dev MCP for their coding assistants. This guide covers what exists today, what Shopify removed in 2026, how to test a store from the terminal, and when a custom server is still worth building.

Which Shopify MCP servers exist in 2026?

Shopify's agent documentation now describes the buyer journey as four stages, each backed by UCP-conforming MCP tools: negotiate and authenticate, discover products, carts and checkout, and monitor orders. The servers below are the ones a merchant or agent builder meets in practice.

Two distinctions matter, and our explainer on ACP, MCP and UCP covers where each protocol sits. Storefront Catalog MCP is scoped to one merchant and is the server a storefront agent uses; Global Catalog MCP is for discovery across Shopify merchants. And the Dev MCP is not a commerce endpoint at all. It runs locally inside Cursor, Claude Code or VS Code and gives the coding assistant current Shopify docs and schemas.

What changed: Storefront MCP became UCP

If you integrated against https://{shop}/api/mcp in 2025 or early 2026, your catalogue and cart calls no longer work. Shopify's Storefront MCP migration page states that the catalog and cart tools on /api/mcp were removed and that UCP provides them at https://{shop}/api/ucp/mcp. The deprecation notice of 24 June 2026 gave the old get_cart and update_cart tools until 31 August 2026. Only search_shop_policies_and_faqs stays on the old endpoint. For a Hydrogen storefront the same move is covered step by step in our Hydrogen UCP migration guide.

Three things change in agent code, per the same migration page. Every request to /api/ucp/mcp carries a meta object with ucp-agent.profile. That is the URL of a JSON profile declaring which UCP capabilities and versions the agent supports, so the merchant can negotiate before accepting the call. Carts are created explicitly with create_cart, and update_cart replaces the whole cart on every call, so the agent sends the complete line_items array rather than a patch. Checkout requests are authenticated or signed. The Checkout MCP page documents client credentials from the Dev Dashboard, exchanged at api.shopify.com/auth/access_token for a JWT with a 60-minute lifetime and sent as Authorization: Bearer.

Checkout also has a human hand-off built in. When complete_checkout returns requires_escalation, the agent sends the buyer to the continue_url to finish on the merchant's own checkout. Shopify's guidance is to iterate on line items and totals in Cart MCP, which is rate-limited more generously, and create the checkout only when the buyer is ready to buy.

How do you test a store's MCP from the terminal?

The fastest check no longer goes through a chat client. Shopify ships a UCP CLI and an AI Toolkit skill for it; both are documented on the agentic commerce overview, which lists Node.js 18 or higher as the requirement.

1. Install the CLI: npm install -g @shopify/ucp-cli.
2. Search the store's catalogue: ucp catalog search --business https://{shop}.example.com --set /query='cold brew' --view :compact --format md, taken from the Storefront Catalog MCP docs.
3. Fetch the live input schema before composing a payload: add --input-schema to any ucp catalog command.
4. Look up a variant or product: ucp catalog lookup with a gid://shopify/ProductVariant/... id, or ucp catalog get_product with selected options.

If the search returns products with prices and variants, the merchant's catalogue is reachable by agents. If it returns little or the wrong items, look at product data first: types, vendor, metafields, availability and disclosures. The product disclosures documentation shows lookup_catalog returning warnings such as Proposition 65 notices as messages anchored to a product. Missing compliance data therefore shows up in agent results exactly as it would on the page.

How do you connect the Dev MCP to Cursor, Claude Code or VS Code?

The Shopify AI Toolkit is the current home of the Dev MCP. It connects a coding agent to three things. The first is developer docs and API schemas. The second is code validation for GraphQL queries, Liquid templates and extensions against Shopify schemas. The third is supported store-management tasks through the CLI's authenticated store context, with the developer choosing when to execute. The server runs locally and needs no authentication.

• Claude Code: claude mcp add --transport stdio shopify-dev-mcp -- npx -y @shopify/dev-mcp@latest, then restart Claude Code.
• Cursor: Settings, Cursor Settings, Tools and MCP, New MCP server, with npx -y @shopify/dev-mcp@latest as the command.
• VS Code: a shopify-dev-mcp entry under servers in the user-level mcp.json.
• Codex CLI: an [mcp_servers.shopify-dev-mcp] block in ~/.codex/config.toml.

For a team that builds Shopify apps, this replaces the open tabs of Admin GraphQL reference and Polaris docs. Our own loyalty app is developed with Claude Code and the Dev MCP running. A question about a mutation is answered from the current schema rather than a forum thread.

Customer Accounts MCP: the authenticated server

Order history, addresses and other customer data sit behind the Customer Accounts MCP server. Its endpoint is discovered, not hard-coded: fetch https://{shop}/.well-known/customer-account-api and read mcp_api, which resolves to https://{shop}/customer/api/mcp. Requests need an OAuth 2.0 access token obtained with the authorization code flow and PKCE. The app declares scopes such as customer_read_customers and customer_read_orders, plus a customer authentication redirect URI, in shopify.app.toml. This is a real app with an install, so budget for it as one.

When does a custom MCP server make sense?

For most merchants the answer is still never. Shopify's hosted catalogue, cart, checkout, order and customer servers cover the buyer journey, and they move with the UCP specification without any work from the merchant. We build one only for data that lives outside Shopify:

• ERP-native inventory: NetSuite or SAP stock and lead times alongside Shopify data, so an agent can answer when a back-ordered item ships.
• Private B2B catalogues: account-specific prices and availability that must never reach a public channel, behind per-account authentication.
• Non-standard fulfilment: warehouses with their own allocation rules, subscription engines with complex change rules, or marketplaces with seller-specific pricing.

Our rate for a production-grade custom MCP server is £15,000 to £45,000 depending on scope: the server, authentication, observability, test coverage and deployment. Add £5,000 to £15,000 when the underlying system has no clean API to wrap. Our custom app cost breakdown explains how the quote is structured. If the hosted servers already do the job, you are paying to rebuild infrastructure Shopify maintains for free.

Security and rate limiting

Shopify's hosted servers tie access and rate limits to how an agent identifies itself. The Checkout MCP page notes that tool use is subject to access and rate limiting that scale with the agent's identification tier. Checkout is limited more strictly than cart. A custom server has to supply the same discipline itself: authenticate every caller, rate-limit per agent identity, and keep a structured audit log of every tool call. Treat an agent exactly like any other API client, because it is one.

Our verdict and next steps

Use Shopify's hosted MCP servers and do not build your own unless an agent needs data Shopify cannot see. Run the UCP CLI search against your own store this week. If your agent integration still points at /api/mcp for catalogue or cart, migrate it to /api/ucp/mcp with an agent profile. If you build Shopify apps, install the AI Toolkit and the Dev MCP in your editor today. Related reading: scaling MCP in production and optimising for ChatGPT and Perplexity Shopping.

The 2026 move from Storefront MCP to UCP made the hosted route stronger, not weaker. You get one endpoint, one profile format, a documented checkout hand-off and a CLI to test it all. Get a clean ucp catalog search result against your store first. Only then is a custom build a real decision, and for ERP inventory or private B2B pricing it is one our Shopify engineering team scopes in a week.