Shopify shipped MCP (Model Context Protocol) support across four separate servers during Q1 2026 — Storefront, Customer Account, Checkout, and Dev. For merchants on Shopify Plus the Storefront + Customer Account + Checkout servers are managed infrastructure: Shopify runs them, you enable them. For agencies and in-house teams, the Dev MCP is the one that matters day to day. This guide covers both.

What Each Shopify MCP Server Actually Exposes

The Four Servers

Storefront MCP — Unauthenticated product discovery. Search, variants, collections, pricing, inventory availability, media. Intended for any AI agent that wants to recommend your products.
Customer Account MCP — Authenticated customer actions. Order history, tracking, saved addresses, loyalty balance, subscription management. OAuth'd per customer.
Checkout MCP — Cart and checkout operations. Add/remove line items, apply discounts, calculate shipping and tax, finalise order. Powers ACP-style checkout on behalf of the buyer.
Dev MCP — For developers. Access to Shopify documentation, CLI commands, code generation, and debugging helpers from inside Claude Desktop, Cursor, Windsurf, or any MCP-aware IDE.

Enabling the Managed Servers

Storefront MCP is on by default for every Shopify Plus store after March 24, 2026. Shopify runs the endpoint at https://<your-shop>.myshopify.com/.well-known/mcp/storefront. You do not deploy anything.

Customer Account and Checkout MCP require a one-click enable in Shopify admin → Settings → Apps and sales channels → Agentic commerce. Turning them on starts accepting agent-initiated authenticated requests; turning them off is equally instant and reversible.

Verifying the Storefront MCP Works

Connect Claude Desktop to your Storefront MCP as a test:

Claude Desktop → Settings → Developer → Edit Config.
Add a server entry pointing to https://<your-shop>.myshopify.com/.well-known/mcp/storefront.
Restart Claude Desktop.
In a new chat: "Search this store for <product category you sell> and show me three matching products with prices."

If the agent returns structured results with images, variants, and correct pricing, your endpoint is healthy. If it returns nothing or wrong data, the issue is almost always product data completeness — metafields, product types, vendor tags, or availability. Fix the catalogue before blaming the protocol.

Using the Dev MCP

Dev MCP is genuinely useful if your team builds on Shopify. Point Cursor or Claude Code at https://shopify.dev/mcp and the agent gains access to the latest Shopify CLI commands, Admin GraphQL schema, Polaris component docs, Storefront API reference, and Function examples. For an agency like ours it replaces three tabs of docs that we used to have open constantly.

Anchor Loyalty (our Shopify loyalty app) is now developed with Claude Code + Dev MCP running in the background. Any time a developer asks "how does this GraphQL mutation work?", the agent pulls the live schema rather than a stale Stack Overflow thread.

When a Custom MCP Server Makes Sense

For most merchants: never. Shopify's managed MCP coverage is already broader than what an in-house team would build in six months. The exceptions we have seen:

Deep ERP integration — A custom MCP server exposing NetSuite or SAP inventory alongside Shopify, so an agent can answer "when will this back-ordered item ship?"
Private B2B catalogues — Account-specific pricing and product availability that should never hit public channels. Host behind authentication, expose over a private MCP endpoint, agent requires a per-account token.
Custom fulfilment workflows — Warehouses with their own inventory logic, subscription engines with complex modification rules, or marketplaces with seller-specific pricing.

Cost of a Custom MCP Server

Our going rate for a production-grade custom MCP server in Q2 2026 is £15,000-£45,000 depending on scope. That covers the server implementation itself, authentication, observability, test coverage, and deployment. Add another £5,000-£15,000 if the underlying data source does not already have a clean API. See our full custom app cost breakdown for how we structure the quote.

Security and Rate Limiting

Every MCP request we see in production carries an X-MCP-User-Id or equivalent agent identifier. Treat these exactly like any other client: authenticate, rate-limit, log. Shopify's managed endpoints handle this for you. Custom servers must implement it themselves — we default to 60 requests/minute per agent identifier, plus global burst limits, plus structured audit logging of every tool call the agent made.

What to Expect Next

Shopify has committed to shipping the remaining MCP servers (Fulfilment, Analytics) in 2026. BigCommerce, Commercetools, and SFCC have all signalled MCP support on their 2026 roadmaps. Our advice for merchants: get the Shopify managed servers working cleanly first. Do not pre-build against standards that are still negotiating their v1.