Shopify Agentic MCP Gateway

Enables AI agents to autonomously browse inventory, negotiate terms, manage carts, and execute secure payments on Shopify stores using standardized protocols. It provides a bridge for LLMs to handle the entire commerce lifecycle from discovery to order tracking through a verifiable mandate chain.

→ kuro-tomo/shopify-agentic-mcp · listed on glama

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings

🚨

Known vulnerabilities in dependencies: 1 critical, 3 high

Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.

🔐

You'll be asked for 7 credentials: AP2_SIGNING_PRIVATE_KEY, AP2_VERIFICATION_PUBLIC_KEY, GATEWAY_API_KEY, SHOPIFY_ACCESS_TOKEN, SHOPIFY_API_KEY, SHOPIFY_API_SECRET, SHOPIFY_STOREFRONT_TOKEN

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// required environment variables

This server reads these from process.env. You'll be asked to provide them before it can run.

configALLOWED_ORIGIN

🔐 secretAP2_SIGNING_PRIVATE_KEY— Yes ES256 private key in JWK format for mandate signing

🔐 secretAP2_VERIFICATION_PUBLIC_KEY— No ES256 public key in JWK format (defaults to deriving from private key)

configAWS_LAMBDA_FUNCTION_NAME

configDYNAMODB_TABLE_LEDGER

configDYNAMODB_TABLE_MANDATES

configDYNAMODB_TABLE_SESSIONS

configFEE_RATE— No Platform fee rate as decimal (default: 0.005 = 0.5%)

configFEE_WALLET_ADDRESS— No Wallet address for fee collection

🔐 secretGATEWAY_API_KEY

configGATEWAY_BASE_URL— No Public gateway URL (default: http://localhost:3000)

configLOG_LEVEL— No Logging level (default: info)

🔐 secretSHOPIFY_ACCESS_TOKEN— your_access_token

🔐 secretSHOPIFY_API_KEY— your_api_key

🔐 secretSHOPIFY_API_SECRET— your_api_secret

🔐 secretSHOPIFY_STOREFRONT_TOKEN— your_storefront_token

configSHOPIFY_STORE_DOMAIN— your-store.myshopify.com

// full audit trail

The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.

// improvement guidance — verified publishers only

We have 4 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Score](https://m8ven.ai/badge/mcp/kuro-tomo-shopify-agentic-mcp-1e946a)](https://m8ven.ai/mcp/kuro-tomo-shopify-agentic-mcp-1e946a)

commit: f66ff56ac2e38656c38a3fa4e146c12147c97b6d

code hash: 3e633abbfc81be1c845956b257d3e7be663876ef2d166dbb6706e8979185da15

verified: 4/11/2026, 3:03:14 PM

view raw JSON →