13 tools across 8 scopes. Both figures are derived from the scope catalogue in the repository, so this page cannot drift from what the server actually registers.
The catalogue
| Scope | Family | Tools | Shopify grant needed |
|---|---|---|---|
| boostecom:store.read | relay | getShopInfo, getStoreContext, introspectSchema | — |
| boostecom:catalog.read | relay | listProducts, getProduct | read_products or write_products |
| boostecom:orders.read | relay | listOrders | read_orders or write_orders |
| boostecom:content.read | relay | listPages | read_content or write_content |
| boostecom:themes.read | relay | listThemes, getTheme, runAudit | read_themes, write_themes or write_theme_code |
| boostecom:analytics.read | relay | runShopifyQL | read_analytics or read_reports |
| boostecom:graphql.read | relay | shopifyAdminGraphQL | — |
| boostecom:studio.read | native | getStudioSection | — (see below) |
Any one of the listed Shopify grants satisfies a row. A dash means Shopify has no say: either the tool needs no particular grant, or Shopify enforces per query.
relay vs native
Not cosmetic. The family decides two rules:
relay reaches Shopify through the bridge. A static bst_mcp_
bearer satisfies it, because the key is store-scoped and holding it is
the authorization.
native reaches a system BoostEcom owns. It requires an
identified caller, so a static key never satisfies it. The reason is
worth stating plainly: getStudioSection guards a resource whose
permission hangs off an OrganizationMember row. With no user, there is
nobody to check, and an uncheckable permission must refuse, never pass.
Why studio.read shows an empty Shopify column
shopify: [] on a native scope does not mean "needs no permission".
It means Shopify has no say. The gate is the caller's own studio.*
permission, asked per section at call time: the same check the dashboard
pages make.
The scope is offered on the consent screen to any user, unlike a relay scope a store's Custom App cannot satisfy. That is deliberate: a Shopify grant is a hard ceiling that moves only by reconnecting the app, while a Studio permission is a membership that can change tomorrow. Refusing the scope at consent time would freeze a long-lived grant against a permission the user may soon hold, and the per-call guard answers correctly either way.
The legacy mcp scope
Clients that consented before the catalogue existed hold a single mcp
scope. It expands to the relay family and only ever will: it was
consented to when the catalogue was the Shopify bridge and nothing else,
so it can only mean that. It does not reach native tools.
GraphQL passthrough
shopifyAdminGraphQL is a passthrough to the Shopify Admin GraphQL API,
paired with introspectSchema for discovery. Shopify's own permission
model applies per query: the bridge does not widen it.
Scope strings on the wire
Scopes travel as a space- or comma-separated string. The advertised list in the authorization-server metadata is the legacy scope plus all eight above.