Verified factsChecked 2026-10-29
| Price | Free. shop.dev says search “needs no account or key”; an optional Dev Dashboard API key only raises limits. Purchases are paid by the shopper at the merchant’s normal prices.3 [Verified 2026-10-29] |
| API key / auth | None for search_catalog, lookup_catalog, get_product and the cart and checkout tools. get_account, search_orders and the five spend-request tools need a Shop account token (OAuth, personal_agent scope). Our keyless search_catalog call on 2026-10-29 returned HTTP 200; get_account without a token returned 401 with a WWW-Authenticate header.6 [Verified 2026-10-29] |
| Rate limit | No number is published for keyless use. Anonymous traffic gets Shopify’s lowest tier, limited per IP and shared with all other unauthenticated traffic, and Shopify says not to use it for production. With an API key the Global Catalog default is 5 requests per second per API client. Shopify’s catalog usage rules add that keyless access cannot get a limit increase.4 [Verified 2026-10-29] |
| License / terms | Shopify API Terms (last updated Oct 7, 2026) apply. Section 24 bans using anything derived from the API to train or improve AI models, and reproducing substantial parts of catalogs beyond limited previews for product discovery. The catalog usage rules ban caching results and downloading product images.5 [Verified 2026-10-29] |
| Version status | No stage label on Shop MCP. It uses MCP protocol 2026-07-28 and Universal Commerce Protocol 2026-08-25; Shopify notes catalog endpoint URLs might change.1 [Verified 2026-10-29] |
| Tools | The docs list 17 tools. Our keyless tools/list on 2026-10-29 returned 19: the 17 plus search_locations and lookup_locations. Search returns 1 to 50 results per call (default 10), and pages stop at 1,000 results.7 [Verified 2026-10-29] |
FeaturesChecked 2026-10-29
YesNoN/ANot published
| Capability | Value |
|---|---|
| StatusNo preview or beta label on shop.dev; MCP 2026-07-28 and UCP 2026-08-25. Shopify notes catalog endpoint URLs might change. | No stage label1 [Verified 2026-10-29 on https://shop.dev/docs] |
| API key requiredNo key for search, cart, checkout. Keyless search_catalog and tools/list returned HTTP 200 on 2026-10-29; account, order and spend-request tools need a Shop OAuth token (get_account gave 401). | No2 [Verified 2026-10-29 by test request to https://mcp.shop.com/] |
| Free tierFree, no account. shop.dev: search needs no account or key; a Dev Dashboard key only raises limits. | Yes3 [Verified 2026-10-29 on https://shop.dev/] |
| Rate limitKeyless number not published: anonymous tier is the lowest, per IP plus a shared pool, not for production. Keyed Global Catalog default is 5 requests/second per API client. | Not published4 [Not published by vendor: checked 2026-10-29 on https://shopify.dev/docs/agents/profiles/auth-and-rate-limiting] |
| Official MCP serverHosted, mcp.shop.com/. Stateless, MCP 2026-07-28; our tools/list returned 19 tools (docs say 17). | Yes2 [Verified 2026-10-29 by test request to https://mcp.shop.com/] |
| Official SDKCLI only, no SDK library. Shopify publishes the shop CLI (npm @shopify/shop 1.2.0, MIT) and plain HTTP examples, but no language SDK for Shop MCP. | No8 [Verified 2026-10-29 on https://github.com/Shopify/shop] |
| Data license / termsAPI Terms updated Oct 7, 2026: no AI training on derived data, no reproducing catalogs. Catalog rules: no caching results or downloading images. | Shopify API Terms + catalog rules5 [Verified 2026-10-29 on https://www.shopify.com/legal/api-terms] |
| Commercial use allowedYes, within the API Terms. Built for apps and agents to sell through; the training, caching and catalog-copying bans still apply. | Yes5 [Verified 2026-10-29 on https://www.shopify.com/legal/api-terms] |
| CORS / browser useAccess-Control-Allow-Origin: *. Returned on our POST and on a preflight with a third-party Origin on 2026-10-29. | Yes2 [Verified 2026-10-29 by test request to https://mcp.shop.com/] |
| Freshness / coverageshop.dev says over 1 billion products from millions of stores; results reflect current price and stock and may not be cached. | Live merchant data; 1B+ products9 [Verified 2026-10-29 on https://shopify.dev/docs/agents/catalog] |
What it does
Shop MCP is Shopify’s hosted Model Context Protocol server at https://mcp.shop.com/, documented on shop.dev. Without any credentials an agent can search Shopify’s Global Catalog (search_catalog, by words, a similar product or a photo), fetch fresh data for known product IDs (lookup_catalog), read every option, variant, price and stock signal for one product (get_product), and create or edit carts and checkouts with the merchant that sells an item. Each result names the seller, the variant price in minor currency units and a merchant URL. When the shopper connects a Shop account through OAuth, the same server can also read their saved addresses and recent orders, complete a checkout with Shop Pay after they confirm, and issue spend requests for purchases at stores that are not on Shopify. The server is stateless: there is no initialize call, every request carries its protocol version and client name in params._meta, and the Mcp-Method and Mcp-Name headers must repeat the method and tool. It speaks MCP 2026-07-28, so clients that only know the older initialize handshake cannot connect; Shopify points those users to its shop CLI or plain HTTP.
Working exampleRun 2026-10-29
curl -sS https://mcp.shop.com/ \
-H 'Content-Type: application/json' \
-H 'Accept: application/json, text/event-stream' \
-H 'MCP-Protocol-Version: 2026-07-28' \
-H 'Mcp-Method: tools/call' \
-H 'Mcp-Name: search_catalog' \
-d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{
"name":"search_catalog",
"arguments":{"catalog":{"query":"ceramic coffee dripper",
"context":{"address_country":"US","currency":"USD"},
"pagination":{"limit":3}}},
"_meta":{"io.modelcontextprotocol/protocolVersion":"2026-07-28",
"io.modelcontextprotocol/clientInfo":{"name":"my-agent","version":"1.0.0"},
"io.modelcontextprotocol/clientCapabilities":{}}}}'Response (trimmed)
HTTP 200, application/json (run 2026-10-29, no key; access-control-allow-origin: *)
{"jsonrpc":"2.0","id":1,"result":{"isError":false,
"structuredContent":{"ucp":{"version":"2026-08-25"},
"products":[
{"title":"V60 Ceramic Coffee Dripper 02 - New Colors",
"variants":[{"price":{"amount":3500,"currency":"USD"},"seller":{"name":"Hario USA", ...}, ...}], ...},
{"title":"Kalita MINO Ceramic Dripper 185 - Sand Black", ... 3800 USD, "Kalita USA"},
{"title":"ORIGAMI Ceramic Dripper - Medium for 1-4 Cup Brewing", ... 4075 USD, "Slow Pour Supply"}],
"pagination":{"has_next_page":true,"total_count":179,"cursor":"eyJvZmZzZXQiOjMs..."}}}}
# Same server, get_account with no token:
HTTP 401
www-authenticate: Bearer resource_metadata="https://mcp.shop.com/.well-known/oauth-protected-resource", scope="personal_agent"Agent setup
Prompt to give your agent
Use the Shop MCP server (https://mcp.shop.com/, no key). Call search_catalog once for the item I describe, with my country and currency in context and a limit of 10. Show the best five as a list: title, seller, price with currency (amounts are in minor units, so 3500 USD is $35.00) and the product URL exactly as returned. Show every message of type warning. Do not create a cart or checkout unless I ask, and never call complete_checkout. Item: a ceramic pour-over coffee dripper under $45, shipping to the US.Agent / MCP-style tool snippet
# Claude Code (keyless; note the trailing slash, there is no /mcp path)
claude mcp add --transport http shop https://mcp.shop.com/
# Optional: Shopify's plugin adds the same server plus its shopping skill
claude plugin marketplace add Shopify/shop
claude plugin install shop@shop
# Gemini CLI
gemini mcp add --transport http shop https://mcp.shop.com/
# Claude.ai / ChatGPT: add a custom connector with the URL https://mcp.shop.com/
# Any other client works only if it speaks MCP 2026-07-28 (server/discover).
# Older initialize-only clients: use the shop CLI instead
npm i -g @shopify/shop
shop search 'ceramic coffee dripper' --ships-to US --currency USD --limit 25Fit and safety
Good for
- Product search with live prices and stock inside Claude, ChatGPT or Cursor
- Shopping assistants that build a cart and hand the shopper a checkout link
- Price and option checks on a known product ID before recommending it
Watch out
- Do not run production traffic on the keyless tier. Shopify says unauthenticated calls share one limit with all other anonymous traffic, so throughput is not guaranteed; get a free Dev Dashboard key and call the Catalog API for a published 5 requests per second.
- Do not cache results or build a product database from it. The catalog rules ban caching results and downloading images, and the API Terms ban reproducing substantial parts of catalogs.
- Do not use the data to train or fine-tune a model. Section 24 of the Shopify API Terms forbids it, including in aggregate or derived form.
- Do not let an agent complete purchases on its own. Only a checkout with status completed and an order confirms a buy; Shopify’s docs say to confirm the total and payment method with the shopper and never resend complete_checkout.
- Do not expect stores that are not on Shopify, or exact facts in every field. Some attributes are inferred by Shopify’s AI and can be missing or wrong, so verify stock and price on the merchant page.
Alternatives
| Shopify Global Catalog API | Same three search tools at catalog.shopify.com/api/ucp/mcp, with an agent profile and an optional API key for higher limits; no carts or accounts. |
| Shopify Storefront Catalog MCP | Each Shopify store’s own /api/ucp/mcp endpoint, for an agent that sells from one store only. |
| Parallel MCP (free) | Keyless web search and page fetch, for product research across stores that are not on Shopify. |
| Official MCP Registry API | To find other commerce MCP servers and check who publishes them. |
FAQ
Is Shop MCP free?
Yes. Searching the Shopify Catalog and building carts and checkouts need no account or API key; an optional Dev Dashboard key only raises rate limits.
How do I add Shop MCP to Claude Code?
Run claude mcp add --transport http shop https://mcp.shop.com/ with the trailing slash. The server has no /mcp path and answers it with a 404.
What is the Shop MCP rate limit?
Shopify publishes no number for keyless use: anonymous calls get the lowest tier, per IP plus a shared pool. With an API key the Global Catalog default is 5 requests per second per API client.
Can I use Shop MCP results to train a model?
No. Shopify’s API Terms forbid using anything derived from the API to train or improve AI models.
Compare
Put Shop MCP (Shopify Catalog search) side by side with other free agent tools on keys, limits, MCP support, licensing and CORS. Open the comparison grid →
SourcesFootnotes
- 1shop.dev/docsVerified 2026-10-29
- 2mcp.shop.comTested 2026-10-29
- 3shop.devVerified 2026-10-29
- 4shopify.dev/docs/agents/profiles/auth-and-rate-limitingVerified 2026-10-29
- 5shopify.com/legal/api-termsVerified 2026-10-29
- 6shop.dev/docs/authentication.mdVerified 2026-10-29
- 7shop.dev/docs/tools.mdVerified 2026-10-29
- 8github.com/Shopify/shopVerified 2026-10-29
- 9shopify.dev/docs/agents/catalogVerified 2026-10-29