Shopify Shop MCP Opens Search and Checkout to AI Agents
The live service exposes 17 tools for shopping and buyer-approved payments, while commission-generating Promoted Placements remains in early access.
Listen
AI narration
10:27
0:00 / 10:27
AI SummaryGenerated from this article
Third-party AI agents can now search Shopify's catalog of over one billion products, build carts and complete Shop Pay checkout through Shop MCP, launched October 13, 2026. The service exposes 17 tools for discovery, sign-in, carts, checkout and order tracking, with basic search requiring no account or API key. Shop Pay checkout requires buyer approval before purchase completion, and single-use payment credentials protect card details.
Shopify restricts caching search results and warns that AI-inferred product attributes may be incorrect. The commission-generating Promoted Placements program remains in early access, and the service lacks webhooks at launch, requiring developers to poll for checkout status.
Third-party AI agents can now search Shopify’s catalog of more than one billion products, build carts and complete Shop Pay checkout after buyer approval through a single connection. Basic search requires neither an account nor an API key, according to Shopify’s Shop MCP announcement.
Announced on October 13, 2026, Shop MCP exposes 17 tools spanning discovery, sign-in, carts, checkout and order tracking. Developers building AI products no longer need separate integrations for finding an item and purchasing it.
Access without an account has limits. Saved Shop Pay checkout requires sign-in and purchase confirmation. Shopify also restricts storing search results, warns that AI-inferred product attributes can be wrong, and labels its commission-generating Promoted Placements program as early access.
Connect Once, Then Test From the Terminal
Shop MCP is live at https://mcp.shop.com. Developers can add that address as an MCP server in an agent’s configuration, or point a coding agent at the accompanying instructions at https://mcp.shop.com/skill.md.
Shopify also provides a CLI that calls the same server. Its documented starting point is:
Each result includes the store, price and stock status, according to the announcement. Developers can inspect real responses before connecting the service to an agent’s reasoning and tool-use loop.
The Shop MCP developer site shows a more constrained query with shipping destination, currency and result count:
A relevant product is still a poor recommendation if it cannot ship to the buyer or its price is presented in the wrong currency.
Ordinary applications can call the service over HTTPS too; Shopify says an AI model is not required. The interface speaks UCP through MCP using JSON-RPC request formats, and each request includes an agent profile URL. MCP supplies the connection mechanism. Deciding what a shopper should buy remains the application’s job.
The 17 Tools Cover More Than Product Search
Shopify groups the tools into several shopping flows.
Work with Zeniteq
Let’s work together
We’re open to thoughtful collaborations with teams building in AI. Explore the ways we can work together.
Buyers approve a purchase in Shop, then the agent receives single-use card details for the merchant’s own checkout.
Post-purchase assistance
Signed-in shoppers can find orders and tracking through search_orders.
Search and product inspection serve different purposes. Shopify documents filters for price, size, color, rating, store, shipping origin and other attributes. Its get_product tool returns options, variants and metadata, with the developer site describing access to current stock, specifications and images.
An agent can narrow a broad request, inspect the actual variant and then build a cart. Developers should not treat a search match as sufficient evidence that the requested size, color or configuration is available.
After a shopper signs in with Shop, searches sent with their token are ranked using preferences, browsing and purchase history. Shopify says the underlying personalization information stays within Shop and is not passed to the application.
Carts and checkout on Shopify stores also work without sign-in. Using a buyer’s saved addresses and Shop Pay details, however, requires an authenticated shopper. “No account needed” describes the search entry point, not every capability in the service.
Shop Pay Approval Separates Shopping From Spending
The payment flow adds a clear approval step. In its announcement, Shopify describes a signed-in shopper confirming the total and payment method before the agent completes the purchase with complete_checkout.
That confirmation authorizes the agent to finish the transaction. An instruction to find suitable shoes should not be treated as approval of a particular purchase.
Shopify says MCP clients such as Claude and ChatGPT handle sign-in, while developers implementing their own client can use a device flow. Once authenticated, a shopper can use saved addresses and Shop Pay without re-entering those details for each agent-assisted purchase.
Under the documented Shop Pay safeguard, each approved payment receives single-use payment credentials. The agent does not receive the buyer’s actual card details.
The implementation differs by merchant:
On Shopify stores, the documented path uses cart and checkout tools, followed by complete_checkout after the buyer confirms.
On non-Shopify stores, the shopper approves the purchase in Shop, and the agent receives single-use card details to use in that merchant’s existing checkout. Shopify says the payment is processed like a regular card transaction without requiring a merchant integration.
The second route broadens the payment service’s reach. It does not provide an identical structured checkout API on every website: the agent still has to complete the non-Shopify merchant’s checkout flow.
Developers should treat temporary payment credentials as sensitive and avoid placing them in ordinary conversation logs or analytics. Single-use credentials do not make all transaction data harmless. Careful handling is an implementation precaution, not an additional protection Shopify establishes merely by calling the credentials single-use.
Personalization Does Not Mean the App Receives Everything
Shopify distinguishes between information an application receives and information Shop uses internally.
Its sign-in example lists name, email, photo, saved addresses, orders and deliveries among the information available to the app, alongside checkout capabilities. Preferences used for ranking, such as a shopper’s size, preferred colors or previous browsing interests, are described as remaining known only to Shop.
An application could therefore offer more relevant results without receiving the underlying preference history. It still receives personal data, including identity, address and order information, that needs appropriate handling.
Catalog access has explicit restrictions too. Shopify’s developer site says applications may not cache results or re-host merchant images. Developers are instructed to fetch information when users need it and load images from their original source beside the listing. A team planning to copy search responses into a persistent recommendation database should not assume that API access grants permission to retain that data.
Accuracy requires its own checks. Shopify warns that AI-inferred attributes may be missing or incorrect. It tells developers to handle absent fields, display currencies and verify availability before linking.
Structured data can make an agent’s work easier, but every catalog attribute is not necessarily a verified merchant specification. Critical purchase requirements deserve a separate check; a loosely matching result is insufficient.
Promoted Placements Is Not Part of General Availability
Search is described as free and available without an account or key. Shopify directs developers who need higher limits to create an API key in the Dev Dashboard, but the supplied launch materials do not specify numerical rate limits or a higher-volume pricing schedule. Teams should establish those constraints before planning production traffic.
The monetization feature is less mature. Shopify advertises commissions when shoppers buy items an application finds, but explicitly labels Promoted Placements as early access and provides a waitlist. Developers can evaluate the shopping integration now without assuming commission access is generally available. The launch materials do not establish broadly available commission rates, eligibility or placement terms.
Existing Catalog API integrations require no action because of this announcement, Shopify says. Shop MCP offers a new integration option without requiring a rewrite of those connections.
A Successful Tool Call Is Not Yet a Completed Order
Shop MCP has no webhooks at launch, a limitation that directly affects production readiness. Developers must poll get_checkout for checkout status, according to the launch instructions.
Shopify’s stated end-to-end success condition is a checkout returning status: completed with an order. Orders placed through an agent appear in the merchant’s Shopify admin like other orders.
Status handling is therefore essential to the integration. An assistant should distinguish between a prepared cart, buyer approval and a confirmed purchase. Attempting the final tool call is not enough to announce success.
Shop MCP’s immediate value is the connected path from catalog search to an approved transaction. Its billion-product reach makes discovery useful, but developers face a narrower test: can the application select the correct variant, present an accurate total, obtain approval, protect the returned credentials and confirm the order without overstating what happened?
