cob-shopify-mcp

A production-grade MCP server and CLI tool that enables AI agents to manage Shopify stores through 49 built-in tools across products, orders, inventory, and analytics. It supports natural language workflows for tasks like inventory tracking, customer support, and sales reporting.

→ callobuzz/cob-shopify-mcp · listed on glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings

🚨

Secret credentials may flow to a network call

2 flows detected: SHOPIFY_CLIENT_SECRET. We can’t prove the destination matches the brand the credential belongs to.

🔐

You'll be asked for 3 credentials: MY_TOKEN, SHOPIFY_ACCESS_TOKEN, SHOPIFY_CLIENT_SECRET

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// required environment variables

This server reads these from process.env. You'll be asked to provide them before it can run.

configCOB_SHOPIFY_ADVERTISE_AND_ACTIVATE— tools.advertise_and_activate

configCOB_SHOPIFY_CUSTOM_TOOLS— ./custom-tools # Load custom YAML tools from directory

configCOB_SHOPIFY_DISABLE— cancel_order,tool2 # Disable specific tools

configCOB_SHOPIFY_ENABLE— some_tier2_tool # Enable specific Tier 2 tools

configCOB_SHOPIFY_HOST

configCOB_SHOPIFY_LOG_LEVEL— observability.log_level

configCOB_SHOPIFY_PORT

configCOB_SHOPIFY_READ_ONLY— Read-only? Use only the read scopes and set =true in .env:

configCOB_SHOPIFY_STORAGE_BACKEND

configCOB_SHOPIFY_TRANSPORT

🔐 secretMY_TOKEN

configNONEXISTENT_VAR

🔐 secretSHOPIFY_ACCESS_TOKEN— shpat_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

configSHOPIFY_API_VERSION— shopify.api_version

configSHOPIFY_CLIENT_ID— e =your_client_id \

🔐 secretSHOPIFY_CLIENT_SECRET— e =shpss_your_secret \

configSHOPIFY_STORE_DOMAIN— e =your-store.myshopify.com \

// full audit trail

The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.

// improvement guidance — verified publishers only

We have 6 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Score](https://m8ven.ai/badge/mcp/callobuzz-cob-shopify-mcp-7ae24n)](https://m8ven.ai/mcp/callobuzz-cob-shopify-mcp-7ae24n)

commit: 3a54d035e1a51deb71d0bd78b4f86b34c477a4a6

code hash: 9649620b5a03cc5891abe104cedc744249f108772241c214577b31fd70a8e8bc

verified: 6/12/2026, 11:38:29 AM

view raw JSON →