Best MCP for Shopify: 10 servers compared

The best MCP for Shopify at a glance

Ranked for store owners and marketers who want an AI assistant to work on their own store.

Rows 1 and 3 to 6 can change your store through MCP. Row 2 is for building on Shopify, rows 8 to 10 serve shoppers, and row 7 only reads.

How these Shopify MCP servers were compared

Each server was checked against its own docs, pricing page or GitHub repo on November 7, 2026. No client store data was used.

• Who it is for: a merchant, a developer building on Shopify, or a team building an agent for shoppers.
• Store access: the Admin API, the storefront, one customer's account, or only docs.
• Writes and guardrails: what it can change and what stands between the agent and the live store.
• Setup and upkeep: hosted login or custom app plus a local process; stars and last commit.

Shopify's official servers rank lower only because most serve developers or shoppers. For setup steps, read how to set up a Shopify MCP connection.

The 10 Shopify MCP servers, one by one

1. Ryze AI MCP

A hosted MCP server you add to Claude, ChatGPT or Cursor as one connector URL. The store connects with its domain and one approval in the Shopify admin, or with your own custom app. The same connector covers Google Ads, Meta Ads, GA4, Search Console and TikTok. Disclosure: Ryze AI publishes this page.

Setup steps and the tool list are on the Shopify MCP page; other platforms are on the developers page.

2. Shopify AI Toolkit and Dev MCP

Shopify's toolkit for AI coding tools. Its Dev MCP server runs locally without authentication, searches Shopify's docs and API schemas and validates GraphQL, Liquid, theme and extension code. It does not connect to a store; store tasks go through Shopify CLI, where store execute keeps mutations off unless you allow them.

3. GeLi2001/shopify-mcp

The most-starred community server on GitHub (239 stars, MIT license, last commit April 5, 2026). It runs locally with npx and has 31 Admin GraphQL tools for products, customers, orders, metafields, inventory and tags. It takes Dev Dashboard client credentials and refreshes the 24-hour token, or a legacy static token.

4. Composio Shopify toolkit

A developer platform that gives agents many apps through one MCP gateway or SDK. Its Shopify toolkit lists 376 tools and 45 triggers, from inventory adjustments to refunds, with OAuth2 sign-in.

5. cob-shopify-mcp

An open-source server and CLI (18 stars, MIT, last commit November 1, 2026) with 62 built-in tools across products, orders, customers, inventory and analytics. Its 16 analytics tools use ShopifyQL, and every response carries Shopify's query cost.

Servers 6 to 10: Zapier, Lemonado and Shopify's buyer-side servers

6. Zapier MCP

Zapier MCP turns Zapier's Shopify actions into tools. You choose the actions the assistant may run, such as creating a draft order, a customer or a blog entry, then add the endpoint to your AI tool.

7. Lemonado

Lemonado is a hosted analytics workspace with an MCP server. It reads orders, refunds, products, inventory, customers and discount codes, next to ad data from other sources, and its FAQ says it leaves Shopify untouched.

8. Storefront Catalog, Cart and Checkout MCP (Shopify)

Shopify's buyer-side servers on the Universal Commerce Protocol (UCP). On a store's /api/ucp/mcp endpoint an agent searches that store's catalog, builds a cart and turns it into a checkout. They replaced Storefront MCP, whose catalog tools were deprecated on April 22, 2026 and cart tools on June 24, 2026, then removed.

9. Global Catalog MCP (Shopify)

Global Catalog MCP searches products across all Shopify merchants with search_catalog, lookup_catalog and get_product, grouping offers from several merchants per product.

10. Customer Accounts MCP (Shopify)

Customer Accounts MCP acts for one signed-in customer: order status, order details, returns and account preferences. Requests need an OAuth 2.0 token from the authorization code flow with PKCE.

Side-by-side: store access, writes and guardrails

What each server reads, what it changes and what stops a wrong change.

A free server still costs time: someone creates the custom app, picks scopes and keeps Node.js and tokens working. Hosted servers trade that work for a subscription.

Shopify's official MCP servers and who each is for

Shopify documents several MCP servers, each for a different person. None of them exposes your store admin as MCP tools.

For admin work, Shopify's route is Shopify CLI: run store auth, then store execute with a GraphQL query, adding the allow-mutations flag only when you mean to change data.

Shopify Admin API limits every MCP server runs into

Every server calls the same Shopify APIs, so the same limits apply (API limits, GraphQL Admin rate limits):

Limits apply per app and per store, and Shopify may lower them briefly, so a good server waits about one second and retries. Mutations cost 10 points each by default.

The REST Admin API has been legacy since October 1, 2024; new public apps must use GraphQL since April 1, 2025. Ryze AI, GeLi2001/shopify-mcp and cob-shopify-mcp use GraphQL; Composio still lists some tools on the legacy REST Admin API.

The 60-day order window trips up merchants most. If an assistant says your first orders were two months ago, check for read_all_orders before trusting the totals.

How to choose a Shopify MCP server

Start from who will use the agent and whether it should change anything.

Using Claude? See how to connect Shopify with Claude. For GA4, see the best MCP for Google Analytics.

Prompts to test any Shopify MCP server

Run these on a development store or with read scopes first.

Expect a table of products. A server without Admin API access cannot answer.

This shows whether the connection has read_all_orders.

You see the real permissions before you ask for edits.

With approvals on in your client, the write call waits for your click.

This needs one connector for the store and the ad accounts, or two servers in one chat. For GA4, see how to connect Claude to Google Analytics.

Access and safety checklist before you connect

• Create the app in the Dev Dashboard. Custom apps created since January 1, 2026 live there; older ones stay in the Shopify admin.
• Grant only needed scopes. Read scopes for reports, write_products for catalog edits, read_all_orders only for older orders.
• Treat customer fields as sensitive. Names, emails, phone numbers and addresses are protected customer data.
• Expect token refresh. Client credentials tokens expire after 24 hours.
• Hold writes for approval in Claude, ChatGPT or Cursor, and keep deletes in their own tool.
• Know how to revoke: uninstall the app or rotate its credentials.

Ryze AI's default connection lets the agent edit product, collection, page and blog content and SEO fields; theme files, redirects and customer records need a custom app. More: Ryze AI for Shopify stores.

Sources

The verdict

Pick by who uses the agent: developers start with Shopify's AI Toolkit and Dev MCP, shopping-agent builders with the UCP servers, reporting teams with a read-only server. For a store owner who wants an assistant to change the store, weigh scopes, approvals and who maintains the server.