Everything On This Shopify Card Is Right Except The URL

A four-step card went round: “Automate Shopify with Claude — two ways to connect, one way to run it, one safety rule.” Connect the Admin MCP. Add the Dev MCP. Ask it questions. Mind the guardrails.

We should say first that this is the most safety-conscious card this page has published. It prints “numbers shown are examples only” under its mock-up. It tells you to try it on a development store first. It says “never post or share your API token.” It builds a three-rung ladder — read scopes, then test on five products, then write scopes — and its last line is “Start read-only.”

All of that is good advice. All of it is attached to the wrong address.

Step 1 points at the Storefront MCP

The card’s first step reads: “PASTE: Your store’s Admin MCP URL”, and the panel beside it shows the address to paste:

your-store.myshopify.com/api/mcp

Underneath, three scopes: read_products, read_orders, write_products. And in the step above: “AUTHORIZE: Admin API token, read scopes first.”

Shopify’s own documentation gives that URL a different name. On the Storefront MCP page, the endpoint is https://{shop}/api/mcp — the Storefront MCP server, the public one. And it is currently a much smaller thing than the card implies. The same page states:

“The catalog and cart tools on https://{shop}/api/mcp were removed.”

The tools it lists as gone are search_catalog, get_product_details, get_cart and update_cart. The one it describes as still there is search_shop_policies_and_faqs — “unchanged on /api/mcp”.

So the address on the card is a public endpoint that, today, answers questions about your shipping policy. It is not where orders live, it is not where products are edited, and — the part that matters most — Storefront MCP servers take no authentication. There is nowhere on that endpoint to put an Admin API token.

Which means the guardrail bites its own first step

Step 4 of the card is correct and important: “Your token is a key to the whole store. Scope it tight, never post it.” Every word of that is right.

Step 1 has you cut that key for a lock that is not on that door. Follow the card exactly and you will create an Admin API access token, look for the field to paste it into, and not find one — or, worse, create it, leave it sitting in your store’s app settings doing nothing, and forget it. A credential that exists for no reason is strictly worse than one that does not exist.

And the questions in step 3 cannot be answered from that endpoint either. “What sold best last week?” needs order data. “Bulk edit products, tags and prices” needs write access to the Admin API. Neither is reachable from the URL the card tells you to paste.

Diagram: four Shopify MCP surfaces, and what each one is for

The confusion is understandable, because “Shopify MCP” is not one thing. It is several, with different addresses, different authentication and very different powers.

Step 2 checks out completely

Credit where it is earned. The card’s second step tells you to open claude_desktop_config.json and point it at @shopify/dev-mcp, with this block:

"mcpServers": {
  "shopify-dev": {
    "command": "npx",
    "args": ["-y", "@shopify/dev-mcp"]
  }
}

That package is real and it is Shopify’s. On npm it is @shopify/dev-mcp, described as “a command line tool for setting up Shopify Dev MCP server”, currently at version 1.16.0, published in September 2026, with 140 releases behind it. Shopify documents it on its own AI Toolkit page. It runs locally, needs no authentication, and reads documentation and schemas rather than your store.

The card’s description — “Docs and schemas for Claude, zero store data” — is exactly accurate. If you only do one thing from this card, do step 2. It is useful, it is official, and it cannot touch anything.

The card, step by step

What the working version looks like

Keep the card’s shape, change the plumbing.

• Install the Dev MCP. Official, local, harmless, and genuinely useful — it means Claude writes GraphQL against the real schema instead of guessing at field names.
• Decide separately how Admin data reaches Claude. That is a different decision with a different risk profile: a community MCP server you have reviewed, or your own script against the Admin GraphQL API with a scoped custom-app token. Neither is the URL on the card, and the community option is not vetted by Shopify, so handing it your token is a choice you make with your eyes open — the same calculation as pointing your tools at somebody else’s endpoint.
• Keep the ladder exactly as drawn. It is good practice whatever sits underneath it.

One addition the card does not have, and it costs nothing: do the first run against a development store. The card’s own fine print says so; its four steps do not. A dev store makes rungs 1 and 2 free of consequence, and it is the only way to find out what a write scope actually does before it does it on real orders.

If you are wiring MCP servers into Claude Code rather than the desktop app, the registration happens in a different place again — a block in .mcp.json at the project root, not a connector in the app. We mapped where each of those files lives and when it loads separately.

Four honest caveats

1. Shopify’s MCP surface is moving fast. This is not a guess — Shopify’s own page uses the words “were removed” about tools that existed earlier this year. It is entirely possible the card described something accurate at the time it was drawn. It is also why the card’s instruction to check the official docs is the right instruction, and why this article has a date on it: October 2026.
2. We could not read every page. Shopify’s own /docs/apps/build/mcp returned a 404 for us, so we could not see a single authoritative list of every MCP server Shopify runs. If an official Admin MCP exists somewhere we did not reach, the card’s step 1 is closer to right than we have said — though the URL would still be the Storefront one.
3. The card may be describing a community server. Several exist, they do take an Admin API token, and the scopes on the card are exactly the scopes they use. If so, everything in step 1 is correct except the address — which is the one line you would copy.
4. We did not connect anything. This is a documentation check, not a test. We read Shopify’s pages and the npm registry; we did not paste a token anywhere, which is also the advice.

The one-line version

A careful card with a copy-paste error in the one place a copy-paste error is invisible. The safety ladder is worth keeping, the Dev MCP step is worth doing today, and the URL in step one answers questions about your returns policy. Check the address before you cut the key.