Crystallize MCP

MCP server for Crystallize headless commerce. Gives AI agents read and write access to your catalogue, products, shapes, orders, customers, and tenant config.

→ HayoDev/crystallize-mcp · listed on glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings

✅

No credential exfiltration, no sensitive file access, no obfuscation

Static analysis found nothing flowing your secrets to unexpected places.

✅

Open source with a license and README

Anyone can audit the code, the license is declared, and the publisher documents what it does.

🔐

You'll be asked for 2 credentials: CRYSTALLIZE_ACCESS_TOKEN_SECRET, CRYSTALLIZE_STATIC_AUTH_TOKEN

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// required environment variables

This server reads these from process.env. You'll be asked to provide them before it can run.

configCRYSTALLIZE_ACCESS_MODE— Write tools require =write (or admin) and a token with write permissions.

configCRYSTALLIZE_ACCESS_TOKEN_ID— Add and CRYSTALLIZE_ACCESS_TOKEN_SECRET to the env block for PIM tools (shapes, orders, customers). See [Authentication](#authentication).

🔐 secretCRYSTALLIZE_ACCESS_TOKEN_SECRET— Add CRYSTALLIZE_ACCESS_TOKEN_ID and to the env block for PIM tools (shapes, orders, customers). See [Authentication](#authentication).

configCRYSTALLIZE_AUDIT_LOG— No Path to write an audit log — ~ is expanded (e.g. ~/.crystallize-mcp/audit.log)

configCRYSTALLIZE_DRY_RUN— Set =true to preview mutations without executing them. The response shows exactly what would change — the mutation payload, before/after values, and a deep link to the item:

configCRYSTALLIZE_PII_MODE— No full (default), masked, or none — controls PII in customer/order responses

🔐 secretCRYSTALLIZE_STATIC_AUTH_TOKEN— No Static auth token (alternative to ID/secret pair)

configCRYSTALLIZE_TENANT_ID

configCRYSTALLIZE_TENANT_IDENTIFIER— "": "your-tenant"

// full audit trail

The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.

// embed badge in your README

[![M8ven Score](https://m8ven.ai/badge/mcp/hayodev-crystallize-mcp-1nbt51)](https://m8ven.ai/mcp/hayodev-crystallize-mcp-1nbt51)

commit: 68282f3c0b1464f37a64d40772d1ef9a43f9fd9e

code hash: 88a25a1eb6d97327b600f311d6efa5e12df4ea41d82b260d4e783d0ff7a98b17

verified: 6/18/2026, 11:40:51 AM

view raw JSON →