• A Shopify store on any plan (the MCP path does not require Plus).
• Node.js 20+ on your machine or deployment target (Vercel Functions work too).
• An Anthropic API key — pay-as-you-go, no monthly minimum.
• 20 minutes if you go DIY. 5 minutes through BoostEcom.

In your store admin: Settings → Apps and sales channels → Develop apps → Create an app. Name it Claude integration. The default Admin API section is what we'll configure.

Grant scopes by use case. Start narrow:

| Use case | Scopes | |---|---| | Catalog audit (read-only) | read_products, read_inventory, read_content | | Order analysis | read_orders, read_customers, read_analytics | | Copy rewriting | + write_products, write_content | | Promotions | + write_discounts |

Install the app. Save the Admin API access token somewhere safe — Shopify only shows it once.

We ship a hardened, production-ready server with per-tool scope checks built in. Installation takes three commands:

npx @boostecom/mcp-shopify init
# follow the prompts: paste your domain + Admin API token
npx @boostecom/mcp-shopify start

The server exposes 23 typed tools covering products, collections, themes, menus, metafields, redirects, orders, customers, locations, inventory, analytics. Every tool ships its own scope check — if Claude requests update_metafield and the server only holds read_* scopes, the call is refused without ever reaching Shopify.

→ The full listing: /marketplace/mcp/shopify-admin.

Why we publish the server instead of code samples

Three reasons:

1. Versioning — Shopify ships API updates every quarter. The server is the only thing you bump; your tool definitions stay stable.
2. Audit log — every tool invocation is logged with the calling model, timestamp, input, output. Replay-friendly.
3. Scope drift detection — the server compares granted scopes against the tools the model tries to use, and surfaces the delta. No more "why does the audit silently skip orders?".

The Anthropic SDK accepts MCP transports natively:

import Anthropic from "@anthropic-ai/sdk"
import { MCPClient } from "@anthropic-ai/sdk/mcp"

const claude = new Anthropic({ apiKey: process.env.ANTHROPIC_API_KEY })
const mcp = await MCPClient.connect({
  command: "npx",
  args: ["@boostecom/mcp-shopify", "start"],
  env: { SHOPIFY_SHOP: "yourstore.myshopify.com", SHOPIFY_TOKEN: "shpat_…" },
})

const response = await claude.messages.create({
  model: "claude-opus-4-7",
  max_tokens: 4096,
  mcp_servers: [mcp],
  messages: [
    {
      role: "user",
      content: "Audit my product catalog. Flag PDPs missing schema, weak titles, and broken images. Return JSON.",
    },
  ],
})

The model auto-discovers the tools, chains the calls, and returns structured output. No manual tool-loop code.

Most production workloads share the same shape:

1. Discovery — the model lists products, fetches a sample of N.
2. Scoring — the model grades each one against criteria (schema, title length, image count, price tier).
3. Prioritization — the model returns the top K with justification.
4. (Optional) Action — the model writes the fix via write_* scopes, gated behind human approval.

The BoostEcom platform ships this loop as a reusable skill. The DIY version runs ~150 lines of orchestration code with retry logic, error boundaries, and rate-limit handling for both Anthropic AND Shopify.

Every Claude × Shopify deployment we've seen fail had the same root cause: too many scopes, too early.

Phase 1 — observe (read-only): live with the audit in production for a week. Watch what Claude reads, what it ignores, what it tries to do but can't. Read-only is the longest and most informative phase.

Phase 2 — author (write_products, write_content): let Claude rewrite copy ON A STAGING THEME. Compare the rewrites against your existing copy, accept what you approve, reject what you don't. Two weeks.

Phase 3 — operate (selective write_*): grant operations on specific surfaces (discounts, inventory). Always behind human approval for destructive actions.

Never grant: write_payment_*, write_users, write_files. A hallucination there is unrecoverable.

The MCP server alone gets you 60% of the way. The remaining 40%:

• Multi-store routing — one MCP per store doesn't scale past 10+ stores. BoostEcom maintains a per-org credential pool with isolated audit logs.
• Session memory — Claude needs context that survives conversations. We persist conversational state, the store knowledge base, and workflow runs.
• Voice + WhatsApp — operators don't always want to type. Hume EVI integration for voice, a WhatsApp connector for thumb-driven ops.
• Skills marketplace — pre-built audit / rewrite / test workflows. One click from the marketplace, zero prompt engineering.
• Specialist agents — beyond Claude, BoostEcom routes specialist models for ops, finance, support, growth. @Atlas orchestrates.

→ See the full list at /features/ai-copilot.

Does MCP require Shopify Plus?

No. MCP is a transport protocol on top of any Shopify Admin API access. Custom Apps work on every plan, including Basic.

Can I run the MCP server in a serverless environment?

Yes — the server is stateless. Vercel Functions, AWS Lambda, Cloudflare Workers all work. For long-running audits, we recommend a small VM (2 vCPU, 4 GB of RAM is more than enough).

How does Claude know which tools the server exposes?

MCP announces tool schemas at the handshake. Claude downloads the schema list once per session, then calls tools by name with typed arguments. You pre-register nothing in the Claude SDK.

What about rate limits?

Shopify's GraphQL Admin API uses a calculated point cost (a 1000-point bucket refilling at 50 points/sec). The BoostEcom MCP server tracks points and auto-throttles. DIY: implement a leaky bucket around every fetch.

Can I bring my own Anthropic API key (BYOK)?

Yes — Account → Tokens → BYOK. Claude calls go on your account, not through BoostEcom billing.