shopify-graphql-mcp (UVU-Store/shopify-graphql-mcp) is an MCP server listed on the M8ven Trust Index. It scores 74 out of 100, grade C. It declares 319 tools. No publisher has claimed this listing.

C
Caution
74/100

shopify-graphql-mcp

A Model Context Protocol server that provides comprehensive access to the Shopify Admin GraphQL API, enabling AI assistants to manage Shopify stores programmatically.

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

UVU-Store

Source: Glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

Install from

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings
⚠️
Known vulnerabilities in dependencies: 1 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
🔐
You'll be asked for 1 credential: SHOPIFY_ACCESS_TOKEN
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// tools this server exposes319 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

health_check

Check if the Shopify GraphQL MCP server is running and configured

get_analytics_report

Fetch analytics reports and metrics from Shopify

run_shopifyql_query

Execute a ShopifyQL query for custom analytics and reporting

get_apps

Fetch installed apps for the store

get_app

Fetch a specific installed app by ID

get_app_proxy

Fetch app proxy configuration for the store

create_app_proxy

Create an app proxy for an app (requires app management permissions)

update_app_proxy

Update an app proxy configuration

delete_app_proxy

Delete an app proxy

get_audit_events

Fetch audit events for the store (staff actions, app installations, etc.)

get_customer_events

Fetch customer events (page views, product views, searches, etc.)

create_staged_upload

Create staged upload targets for file uploads. Use this for uploading large files, media files, or bulk import data before processing.

list_bulk_operations

List all bulk operations for the app. Results include status, type, and URLs to result files when complete.

get_bulk_operation

Get details of a specific bulk operation by ID

run_bulk_query

Run a bulk query operation to fetch large amounts of data asynchronously. Results are returned as a JSONL file. Supports up to 5 connections with max nesting depth of 2 levels. Results available for 7 days after completion.

run_bulk_mutation

Run a bulk mutation operation to import data asynchronously. Each line in the JSONL file is processed as a separate mutation execution. Upload file using staged uploads first.

cancel_bulk_operation

Cancel a running bulk operation. There may be a short delay from when cancellation starts until the operation is actually canceled.

get_cart_transforms

Fetch cart transforms configured for the store

get_all_cart_transforms

Fetch all cart transforms including inactive ones

create_cart_transform

Create a new cart transform using a Shopify Function

update_cart_transform

Update an existing cart transform

delete_cart_transform

Delete a cart transform

get_cash_tracking_sessions

Fetch cash tracking sessions for POS

get_cash_tracking_session

Fetch a specific cash tracking session by ID

create_cash_tracking_session

Create a new cash tracking session for a location

close_cash_tracking_session

Close a cash tracking session

add_cash_transaction

Add a cash transaction to a tracking session

get_channels

Fetch sales channels for the store

get_channel

Fetch a specific sales channel by ID

create_channel

Create a new sales channel (requires app installation)

update_channel

Update an existing sales channel

delete_channel

Delete a sales channel

get_checkouts

Fetch abandoned or active checkouts from the store

get_checkout

Fetch a specific checkout by ID

get_checkout_branding_settings

Fetch checkout branding settings for the store

update_checkout_branding_settings

Update checkout branding settings

complete_checkout

Convert an abandoned checkout to a draft order (for recovery)

get_collections

Fetch collections from the Shopify store

get_collection

Fetch a specific collection by ID

create_collection

Create a new collection (manual or smart collection)

add_products_to_collection

Add products to a manual collection

update_collection

Update an existing collection

delete_collection

Delete a collection

publish_collection

Publish a collection to sales channels

unpublish_collection

Unpublish a collection from sales channels

get_companies

Fetch B2B companies from the store

get_company

Fetch a specific B2B company by ID

create_company

Create a new B2B company

update_company

Update an existing B2B company

create_company_location

Create a new location for a B2B company

delete_company

Delete a B2B company

create_company_contact

Create a new contact for a B2B company

update_company_contact

Update an existing company contact

delete_company_contact

Delete a company contact

get_custom_fulfillment_services

Fetch custom fulfillment services for the store

create_custom_fulfillment_service

Create a new custom fulfillment service

update_custom_fulfillment_service

Update an existing custom fulfillment service

delete_custom_fulfillment_service

Delete a custom fulfillment service

get_custom_pixels

Fetch custom pixels configured for the store

get_custom_pixel

Fetch a specific custom pixel by ID

create_custom_pixel

Create a new custom pixel

update_custom_pixel

Update an existing custom pixel

delete_custom_pixel

Delete a custom pixel

toggle_custom_pixel

Enable or disable a custom pixel

get_customer_data_erasure_requests

Fetch customer data erasure (GDPR) requests

request_customer_data_erasure

Submit a customer data erasure request (GDPR right to be forgotten)

cancel_customer_data_erasure

Cancel a pending customer data erasure request (GDPR). Can only cancel requests that haven't started processing yet.

get_customer_merge_requests

Fetch customer merge requests

request_customer_merge

Merge one customer into another (combines order history, addresses, etc.)

get_customer_payment_methods

Fetch stored payment methods for a customer

get_customer_payment_method

Fetch a specific payment method by ID

revoke_customer_payment_method

Revoke a customer's stored payment method

get_customers

Fetch customers from the Shopify store with optional filtering

get_customer

Fetch a specific customer by ID

create_customer

Create a new customer in the Shopify store

update_customer

Update an existing customer

delete_customer

Delete a customer from the store

create_customer_address

Create a new address for a customer

update_customer_address

Update a customer's existing address

delete_customer_address

Delete a customer's address

get_delivery_customizations

Fetch delivery customization rules for the store

create_delivery_customization

Create a new delivery customization rule using a Shopify Function

update_delivery_customization

Update an existing delivery customization rule

delete_delivery_customization

Delete a delivery customization rule

get_delivery_option_generators

Fetch delivery option generator configurations

create_delivery_option_generator

Create a new delivery option generator using a Shopify Function

update_delivery_option_generator

Update an existing delivery option generator

delete_delivery_option_generator

Delete a delivery option generator

get_discounts

Fetch discount codes from the store

get_discount_code

Fetch a specific discount code by ID

create_discount

Create a basic discount code (percentage or fixed amount)

update_discount_code

Update an existing discount code

delete_discount

Delete a discount code

get_discounts_allocator_functions

Fetch discounts allocator functions for the store

create_discounts_allocator_function

Create a discounts allocator function using a Shopify Function

search_products

Search products using Shopify's discovery/search functionality

get_product_recommendations

Get product recommendations based on a product

predictive_search

Get predictive search results (autocomplete)

get_draft_orders

Fetch draft orders from the store

get_draft_order

Fetch a specific draft order by ID

219 further tools are not listed here. The complete surface is in the source.

// known CVEs in dependencies1 high1 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

high@modelcontextprotocol/sdk@1.0.0GHSA-w48q-cv73-mx4w

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

lowzod@3.22.0GHSA-m95q-7qp3-xv42

Zod denial of service vulnerability

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
configENABLED_TOOL_CATEGORIESThis MCP server provides 150+ tools covering all Shopify operations. Some IDEs have limits on tool counts, so you can enable/disable tool categories via the environment variable:
🔐 secretSHOPIFY_ACCESS_TOKENNever commit your to version control
configSHOPIFY_STORE_API_URL
configSHOPIFY_STORE_URL
// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

319/319 tools missing one or more hints — health_check (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_analytics_report (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); run_shopifyql_query (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +316 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Tests exist

No test files found

Add tests that exercise each declared tool.

Production dependencies are patched

0 critical, 1 high severity in production deps — @modelcontextprotocol/sdk@1.0.0 (high), zod@3.22.0 (low)

Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 4 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Verified](https://m8ven.ai/badge/mcp/uvu-store/shopify-graphql-mcp?variant=verified)](https://m8ven.ai/mcp/uvu-store/shopify-graphql-mcp)
Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.
commit: 01de5f4098424137f132328671206b41188194c9
code hash: e7766681f574b72a87936e5c85cfc5877313cb120b3825d5f78023d5d8067639
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client