shopify-graphql-mcp (UVU-Store/shopify-graphql-mcp) is an MCP server listed on the M8ven Trust Index. It scores 74 out of 100, grade C. It declares 319 tools. No publisher has claimed this listing.
A Model Context Protocol server that provides comprehensive access to the Shopify Admin GraphQL API, enabling AI assistants to manage Shopify stores programmatically.
Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
UVU-Store
Source: Glama
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.
These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.
health_checkCheck if the Shopify GraphQL MCP server is running and configured
get_analytics_reportFetch analytics reports and metrics from Shopify
run_shopifyql_queryExecute a ShopifyQL query for custom analytics and reporting
get_appsFetch installed apps for the store
get_appFetch a specific installed app by ID
get_app_proxyFetch app proxy configuration for the store
create_app_proxyCreate an app proxy for an app (requires app management permissions)
update_app_proxyUpdate an app proxy configuration
delete_app_proxyDelete an app proxy
get_audit_eventsFetch audit events for the store (staff actions, app installations, etc.)
get_customer_eventsFetch customer events (page views, product views, searches, etc.)
create_staged_uploadCreate staged upload targets for file uploads. Use this for uploading large files, media files, or bulk import data before processing.
list_bulk_operationsList all bulk operations for the app. Results include status, type, and URLs to result files when complete.
get_bulk_operationGet details of a specific bulk operation by ID
run_bulk_queryRun a bulk query operation to fetch large amounts of data asynchronously. Results are returned as a JSONL file. Supports up to 5 connections with max nesting depth of 2 levels. Results available for 7 days after completion.
run_bulk_mutationRun a bulk mutation operation to import data asynchronously. Each line in the JSONL file is processed as a separate mutation execution. Upload file using staged uploads first.
cancel_bulk_operationCancel a running bulk operation. There may be a short delay from when cancellation starts until the operation is actually canceled.
get_cart_transformsFetch cart transforms configured for the store
get_all_cart_transformsFetch all cart transforms including inactive ones
create_cart_transformCreate a new cart transform using a Shopify Function
update_cart_transformUpdate an existing cart transform
delete_cart_transformDelete a cart transform
get_cash_tracking_sessionsFetch cash tracking sessions for POS
get_cash_tracking_sessionFetch a specific cash tracking session by ID
create_cash_tracking_sessionCreate a new cash tracking session for a location
close_cash_tracking_sessionClose a cash tracking session
add_cash_transactionAdd a cash transaction to a tracking session
get_channelsFetch sales channels for the store
get_channelFetch a specific sales channel by ID
create_channelCreate a new sales channel (requires app installation)
update_channelUpdate an existing sales channel
delete_channelDelete a sales channel
get_checkoutsFetch abandoned or active checkouts from the store
get_checkoutFetch a specific checkout by ID
get_checkout_branding_settingsFetch checkout branding settings for the store
update_checkout_branding_settingsUpdate checkout branding settings
complete_checkoutConvert an abandoned checkout to a draft order (for recovery)
get_collectionsFetch collections from the Shopify store
get_collectionFetch a specific collection by ID
create_collectionCreate a new collection (manual or smart collection)
add_products_to_collectionAdd products to a manual collection
update_collectionUpdate an existing collection
delete_collectionDelete a collection
publish_collectionPublish a collection to sales channels
unpublish_collectionUnpublish a collection from sales channels
get_companiesFetch B2B companies from the store
get_companyFetch a specific B2B company by ID
create_companyCreate a new B2B company
update_companyUpdate an existing B2B company
create_company_locationCreate a new location for a B2B company
delete_companyDelete a B2B company
create_company_contactCreate a new contact for a B2B company
update_company_contactUpdate an existing company contact
delete_company_contactDelete a company contact
get_custom_fulfillment_servicesFetch custom fulfillment services for the store
create_custom_fulfillment_serviceCreate a new custom fulfillment service
update_custom_fulfillment_serviceUpdate an existing custom fulfillment service
delete_custom_fulfillment_serviceDelete a custom fulfillment service
get_custom_pixelsFetch custom pixels configured for the store
get_custom_pixelFetch a specific custom pixel by ID
create_custom_pixelCreate a new custom pixel
update_custom_pixelUpdate an existing custom pixel
delete_custom_pixelDelete a custom pixel
toggle_custom_pixelEnable or disable a custom pixel
get_customer_data_erasure_requestsFetch customer data erasure (GDPR) requests
request_customer_data_erasureSubmit a customer data erasure request (GDPR right to be forgotten)
cancel_customer_data_erasureCancel a pending customer data erasure request (GDPR). Can only cancel requests that haven't started processing yet.
get_customer_merge_requestsFetch customer merge requests
request_customer_mergeMerge one customer into another (combines order history, addresses, etc.)
get_customer_payment_methodsFetch stored payment methods for a customer
get_customer_payment_methodFetch a specific payment method by ID
revoke_customer_payment_methodRevoke a customer's stored payment method
get_customersFetch customers from the Shopify store with optional filtering
get_customerFetch a specific customer by ID
create_customerCreate a new customer in the Shopify store
update_customerUpdate an existing customer
delete_customerDelete a customer from the store
create_customer_addressCreate a new address for a customer
update_customer_addressUpdate a customer's existing address
delete_customer_addressDelete a customer's address
get_delivery_customizationsFetch delivery customization rules for the store
create_delivery_customizationCreate a new delivery customization rule using a Shopify Function
update_delivery_customizationUpdate an existing delivery customization rule
delete_delivery_customizationDelete a delivery customization rule
get_delivery_option_generatorsFetch delivery option generator configurations
create_delivery_option_generatorCreate a new delivery option generator using a Shopify Function
update_delivery_option_generatorUpdate an existing delivery option generator
delete_delivery_option_generatorDelete a delivery option generator
get_discountsFetch discount codes from the store
get_discount_codeFetch a specific discount code by ID
create_discountCreate a basic discount code (percentage or fixed amount)
update_discount_codeUpdate an existing discount code
delete_discountDelete a discount code
get_discounts_allocator_functionsFetch discounts allocator functions for the store
create_discounts_allocator_functionCreate a discounts allocator function using a Shopify Function
search_productsSearch products using Shopify's discovery/search functionality
get_product_recommendationsGet product recommendations based on a product
predictive_searchGet predictive search results (autocomplete)
get_draft_ordersFetch draft orders from the store
get_draft_orderFetch a specific draft order by ID
219 further tools are not listed here. The complete surface is in the source.
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default
Zod denial of service vulnerability
ENABLED_TOOL_CATEGORIESThis MCP server provides 150+ tools covering all Shopify operations. Some IDEs have limits on tool counts, so you can enable/disable tool categories via the environment variable:SHOPIFY_ACCESS_TOKENNever commit your to version controlSHOPIFY_STORE_API_URLSHOPIFY_STORE_URLTool annotations
No tools have read-only/destructive annotations
Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.
All four hints declared on every tool
319/319 tools missing one or more hints — health_check (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_analytics_report (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); run_shopifyql_query (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +316 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.
For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.
Tests exist
No test files found
Add tests that exercise each declared tool.
Production dependencies are patched
0 critical, 1 high severity in production deps — @modelcontextprotocol/sdk@1.0.0 (high), zod@3.22.0 (low)
Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
[](https://m8ven.ai/mcp/uvu-store/shopify-graphql-mcp)?variant=verified from the URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check