Founding cohort pricing is open: Pro at today's price, locked while you stay. Limited seats. See the offer

Shopify MCP

Plug your Shopify store into Claude and ChatGPT.

One MCP endpoint per store. Approve the scopes and your assistant reads catalogue, orders and themes live, without writing a thing.

22 read-only tools behind one consent screen

Connect your store Talk to the founder

11 scopes, granted one by one
OAuth 2.1 with PKCE
Free on every plan

Paste this in your clienturl

Add a custom connector and paste the URL. The client registers itself and opens the consent screen: no client id, no secret.

https://www.boostecom.app/api/mcp/v1/<STORE_ID>

Tools your client can callRead-only, each behind a scope you approve: 22
Scopes on the consent screenGrant one, a few or all of them: 11
Calls a day on the Free planThe relay runs no model, so it spends no credits: 2,000

Clients

A connect guide for each client

Each guide takes one client from its settings screen to your first question, in that client's own words. These are the clients we test against.

Longer reads

Works with

Endpoint

One URL. Your client finds the rest.

Each connected store gets its own MCP endpoint. An OAuth-aware client reads the discovery documents from its first refused call and walks you to the consent screen.

OAuth 2.1 with PKCE, no client secret to keep
Each token opens one store and is hashed at rest
A static key for CI and headless runs

Your store

https://www.boostecom.app/api/mcp/v1/<STORE_ID>

Discovery

GET https://www.boostecom.app/.well-known/oauth-authorization-server
GET https://www.boostecom.app/.well-known/oauth-protected-resource/api/mcp/v1/<STORE_ID>
GET https://www.boostecom.app/api/mcp/<STORE_ID>/.well-known/oauth-protected-resource

Replace STORE_ID with the id shown in store settings, under connectors.

Read-only

Your assistant reads. Every write waits for you.

The relay refuses every mutation before it reaches Shopify and logs the attempt. Changes happen in the dashboard, where you approve each one.

Mutations refused before Shopify sees them
Every write attempt lands in your audit log
Changes go through the dashboard approval flow

Connect your store

Request

tools/call shopifyAdminGraphQL

mutation {
  productUpdate(product: { id: "gid://shopify/Product/1", title: "New title" }) {
    product { id }
  }
}

Response

{
  "isError": true,
  "content": [
    {
      "type": "text",
      "text": "Refused: this mutation is classified destructive (product/price updates, discounts, inventory, …). This connector is read-only: every write requires human approval. Run it from the BoostEcom dashboard chat, where the approval flow lives."
    }
  ]
}

Tools

22 tools, and what to ask each one

Most cover the paths an agent walks every day. One is a passthrough onto the whole Admin API read surface, with Shopify's own cost and throttle figures returned beside the data.

Tool	Availability	What it returns	Ask it like this
`getStoreContext`Scope None	No Shopify scope gate	Plan, currency, timezone, markets, locales, themes, legal policies, catalogue counts and your granted scopes, in one call.	“Where am I? Give me the store setup.”
`getShopInfo`Scope None	No Shopify scope gate	Store name, plan, currency, timezone and primary domain.	“What plan and currency is this store on?”
`runAudit`Scope read_themes · write_themes · write_theme_code	Scoped	Shop, themes and a product sample in one round trip, so the model reasons over the whole store at once.	“Give me the state of the store.”
`listProducts`Scope read_products · write_products	Scoped	Products, optionally filtered by status.	“Which products are still in draft?”
`getProduct`Scope read_products · write_products	Scoped	One product by its numeric id.	“Show me every field of this product.”
`listOrders`Scope read_orders · write_orders	Scoped	Recent orders, optionally filtered by status.	“Summarise the orders that are still open.”
`listPages`Scope read_content · write_content	Scoped	The store's CMS pages.	“List the CMS pages. Do we have a returns policy page?”
`getMetafields`Scope None	No Shopify scope gate	The metafields of one resource, by its Admin GraphQL id, optionally filtered to one namespace.	“What custom data is attached to this product?”
`listMetaobjectDefinitions`Scope None	No Shopify scope gate	Every metaobject definition: type, fields and how many entries exist.	“What structured content types does this store define?”
`listMetaobjects`Scope None	No Shopify scope gate	The entries of one metaobject type, with Shopify's own pagination cursor.	“List the entries of the FAQ metaobject.”
`listThemes`Scope read_themes · write_themes · write_theme_code	Scoped	Every theme on the store, the published one included.	“Which theme is published right now?”
`getTheme`Scope read_themes · write_themes · write_theme_code	Scoped	One theme by its numeric id.	“Which theme is this, and is it the published one?”
`runShopifyQL`Scope read_analytics · read_reports	Scoped	A ShopifyQL table: sales, sessions, conversion or inventory, over any period you name.	“What were my sales last month?”
`introspectSchema`Scope None	No Shopify scope gate	Any Admin GraphQL type, with nested input types and enums resolved inline.	“What fields does ProductInput take?”
`shopifyAdminGraphQL`Scope Shopify enforces	No Shopify scope gate	Any read the Admin API allows: metafields, markets, translations, inventory. Cost and throttle status come back with the data.	“Pull the metafields on my best-selling variants.”
`getStudioSection`Scope None	No Shopify scope gate	One Studio section: pipeline, clients, concepts, QC or cockpit. Each call checks the caller's own Studio permission for that section.	“Which concepts are waiting on QC?”
`getStudioProduction`Scope None	No Shopify scope gate	The store's production board: gate, work in flight, renders, deliveries, concepts and economics. One Studio permission per block.	“What is my brand producing right now?”
`listStudioGenerations`Scope None	No Shopify scope gate	Every render this store asked for, with its real status, model and artifact. Costs only with the economics permission.	“Which renders failed this week, and what did they cost?”
`getStudioPricing`Scope None	No Shopify scope gate	What one generation costs per composer mode, in USD, before you ask for it. No MCP tool starts a generation.	“How much does a short video cost?”
`getStoreIntelligence`Scope None	No Shopify scope gate	What BoostEcom has observed about this store's domain: traffic, inferred economics, catalogue, stack, ad creatives, reviews, social audience and brand.	“What does BoostEcom know about my store's traffic and stack?”
`searchDocs`Scope None	No Shopify scope gate	The documentation passages that answer a question, each with a link to the exact section.	“How does the marketplace escrow window work?”
`getDoc`Scope None	No Shopify scope gate	One documentation page in full, by slug, with its list of sections.	“Show me the credits page in full.”

How it works

Connected in 4 steps

The same path for every client. Only where you paste the URL changes from one client to the next.

Create your account and connect Shopify through a Custom App. The Shopify grants you tick there cap everything that follows.

Shopify grants that open tools

read_products
read_orders
read_content
read_themes
read_analytics
read_reports

Scopes

11 scopes, one per family of tools

Two gates, and both must pass: the scope you approve for this client, and what your Shopify Custom App grants. Narrow either one and the tool list narrows with it.

Scope	What it opens	Shopify grant required
`boostecom:store.read`Store identity & setupREAD	Plan, currency, timezone, primary domain, markets, locales, legal policies and the Admin schema.getShopInfo · getStoreContext · introspectSchema	Any connected store
`boostecom:catalog.read`CatalogueREAD	Products and their variants, including drafts and archived items.listProducts · getProduct	read_products · write_products
`boostecom:orders.read`OrdersREAD	Recent orders and their status.listOrders	read_orders · write_orders
`boostecom:content.read`Pages & contentREAD	The storefront's CMS pages.listPages	read_content · write_content
`boostecom:metadata.read`Metafields & metaobjectsREAD	Custom data attached to your resources, and the structured-content shapes your store declares. Read only.getMetafields · listMetaobjectDefinitions · listMetaobjects	Any connected store
`boostecom:themes.read`ThemesREAD	Themes on the store, published or not, and the audit that reads them.listThemes · getTheme · runAudit	read_themes · write_themes · write_theme_code
`boostecom:analytics.read`AnalyticsREAD	ShopifyQL queries: sales, sessions, conversion and inventory over any period.runShopifyQL	read_analytics · read_reports
`boostecom:graphql.read`Admin API passthroughREAD	Any read the Admin API allows. Shopify enforces your scopes on every single query.shopifyAdminGraphQL	Any connected store
`boostecom:studio.read`Agency StudioREAD	The production floor: prospect pipeline, client gates, creative concepts, the QC queue and the economics cockpit. Each section still asks for your own Studio permission.getStudioSection · getStudioProduction · listStudioGenerations · getStudioPricing	Any connected store
`boostecom:docs.read`DocumentationREAD	Search and read the public BoostEcom documentation. Grants nothing private: this is what /docs already serves to anyone.searchDocs · getDoc	Any connected store
`boostecom:intelligence.read`Store intelligenceREAD	What BoostEcom has observed about this store's domain: traffic, inferred economics, catalogue, tech stack, ad creatives, reviews, social audience and brand. Read-only, and only for this store.getStoreIntelligence	Any connected store

Intelligence MCP

Ask about the market in the same conversation

A second, public MCP server reads the Shopify store graph: rank a category, look up a domain, find similar stores. Add it beside your store's endpoint.

Starts without an account or a key
An Intelligence key lifts the per-IP ceiling
Public records only

See what Intelligence reads

Add it to your client

{
  "mcpServers": {
    "boostecom-intelligence": {
      "url": "https://www.boostecom.app/api/mcp/intelligence"
    }
  }
}

Read its tool list

curl -s https://www.boostecom.app/api/mcp/intelligence/manifest

Versus

Against Shopify's own connector

Both pointed at the same store in one session, read-only. Shopify's connector writes and searches the shopify.dev docs. This one reads further into the store.

	BoostEcom	Shopify's connector
Scopes granted Measured on the same store through currentAppInstallation.	183	58
Scopes the other lacks The official set is a strict subset: it holds nothing ours does not.	125	0
Fields on one store-info call getShopInfo against get-shop-info, same store.	48	8
Pixels and script tags Tracking and consent surfaces. The official connector has no pixel scope at all.	✓	—
Payouts, disputes, bank accounts The Shopify Payments read surface.	✓	—
GDPR, audit events, consent Privacy settings, audit log, customer events.	✓	—
Storefront and Customer Account APIs The unauthenticated_* and customer_* scope families.	✓	—
Cart Transform and Shopify Functions Bundles, delivery and payment customisations, discount allocators.	✓	—
ShopifyQL analytics Same query, same result: ours runs through the GraphQL passthrough.	✓	✓
Schema introspection __type and __schema resolve through the passthrough.	✓	✓
Cost and throttle returned to the model Shopify's own figures, so an agent paces itself instead of guessing.	✓	—
Writes to the store Ours is read-only: changes go through the dashboard approval flow.	—	✓
shopify.dev docs search The official connector ships a documentation search, ours does not.	—	✓

Measured on one merchant's Custom App: a store that grants fewer scopes gets fewer. The structural point holds either way: the merchant installs a Custom App, so it can request what a public app is not allowed to.

Rate limits

Free on every plan, capped against abuse

The relay forwards a Shopify API call and runs no model, so it spends no credits. Limits count per organisation: stores in one organisation share a budget.

Custom plans run uncapped. A refused call names the plan, the limit it hit and what to do next.

	Free	Pro	Max 5x	Max 20x
Calls per minute	50	500	1,000	5,000
Calls per day	2,000	50,000	100,000	No daily cap

Limits

What it does not do

Read these before you connect a store. Each one is deliberate.

It does not write
Every mutation is refused and logged. A change to your store goes through the dashboard, where you approve it.
It stays inside your Custom App
A tool your Shopify grant cannot satisfy is never registered, so your client never sees it.
A static key stops at 15 tools
A key names a store, never a person. Studio, store intelligence and the docs tools need an OAuth sign-in.

Which AI clients can connect?Clients

Any client that speaks MCP over HTTP. We test against Claude, ChatGPT custom connectors, Claude Code and Cursor, and each one has a connect guide. All four sign in over OAuth from the URL alone; a static key is there for CI and headless runs.

Can my assistant change my store through it?Safety

No. The relay refuses every mutation before it reaches Shopify, including any document it cannot prove only reads. Changes go through the BoostEcom dashboard, where you approve each one.

Does the AI client ever see my Shopify token?Security

No. The client signs in to BoostEcom, never to Shopify. Your Custom App token stays encrypted on our side and is decrypted per request. Revoke the BoostEcom token and the client is cut off, with nothing to change in Shopify.

What does it cost?Pricing

Nothing, on every plan, Free included. The relay forwards a Shopify Admin API call and runs no model, so it spends no credits. The rate limits exist to stop abuse.

How do I limit what an agent can reach?Scopes

With two gates. On the consent screen, approve only the scopes you want: grant the catalogue alone and the order, theme and analytics tools disappear for that client. In Shopify, your Custom App's grant caps every client at once.

What happens when a tool needs a scope I did not grant?Consent

The call is refused with the exact scope to ask for, and your client re-authorizes for that one scope: you approve it, and nothing else changes. When your Shopify Custom App cannot grant it, the refusal says so instead, and the fix is to reconnect the app.

How does authorization work?Authorization

Standard OAuth 2.1 with PKCE. A first call without a token is refused with a pointer to our discovery documents. The client registers itself, sends you to the consent screen, then trades a one-time code for a token bound to this store. Its refresh token rotates on every use.

Is there a REST API, a GraphQL API or an SDK?Surface

There is no GraphQL API or SDK of our own. The supported surfaces are the per-store MCP endpoint, the public Intelligence MCP server and the Intelligence REST API with its own keys. The GraphQL you reach is Shopify's Admin API, through the passthrough tool.

Point it at your store and ask.

Describe what you want your agent to read, and @Atlas tells you which tool and which scope it needs.

1Connect the store

2Paste the URL in your client

3Approve the scopes

4Ask about your store

Point it at your store and ask.