Shopify launched Shop MCP on October 13, giving developers one hosted connection for product search, carts and checkout. The service is at https://mcp.shop.com/. Its 17 tools can find products in Shopify Catalog and open a checkout with the merchant selling an item. Catalog search needs no API key. A shopper must still approve a real purchase.

This is a guide for developers configuring an MCP-compatible assistant. The steps below follow Shopify’s documentation, checked on October 14. BIG CHANGE did not connect an agent, create a cart or make a purchase. The guide therefore describes expected results, not observed performance.

The big change

  • What changed: Shopify now offers a hosted MCP connection that runs from catalog search through a merchant cart and checkout. It also documents Shop Pay completion for a signed-in shopper after explicit confirmation.
  • Who can use it: Developers with an MCP client that supports protocol version 2026-07-28, or code that makes the documented HTTP calls. An older client that only uses the initialize handshake cannot connect directly.
  • What to check: A checkout is a single merchant’s transaction. completed together with an order confirms the purchase; a cart, a checkout link or an in-progress payment does not.

Before you connect

You need an MCP client that supports remote HTTP servers and Shopify’s documented connection method, or an app that calls the server over HTTP. Use the root URL https://mcp.shop.com/; adding /mcp produces a 404. Search and cart tools work without a Shop account. Signing in lets the assistant use saved preferences and addresses, find orders, and offer Shop Pay where the merchant supports it. For an assistant using its own HTTP code, Shopify documents an OAuth device flow that the shopper approves on Shop’s site.

Choose a product query, destination country and currency before searching. Keep the shopper’s stated requirements separate from search context: a country or currency helps localize results; a price cap, size or shipping destination is a filter. Prices in the API use the currency’s minor units. Your app should read the response’s messages before claiming that a result meets a filter, since the service can report that a filter was not applied as requested. Shopify’s search guide explains the distinction and the 1-to-50 result page limit.

A documented path from search to order

  1. Connect and check search. Configure your client with https://mcp.shop.com/ and load Shopify’s Shop skill if the client can use it. Shopify suggests checking the connection with a request to find three desk lamps without creating a cart. A working search returns products with a seller, a price in a stated currency and a merchant link. Developers using HTTP can follow Shopify’s JSON-RPC quickstart, which includes the required protocol headers and search_catalog request. This is a read-only check and requires no sign-in.
  2. Choose the exact item. Run search_catalog with the shopper’s query and requirements. Search returns a featured variant; use get_product if the shopper wants another size or color. Compare product.selected and the returned variant.options with every size, color and other choice the shopper specified before showing or buying it. Shopify says selection can relax without a warning. When the shopper picks a product or changes an option, call get_product again to check current availability and price. Keep that variant’s ID and seller domain exactly as returned. Do not assume the merchant will honor a previously displayed price. Show any warning beside the product it concerns. These checks are documented in Find products.
  3. Build a cart when requested. With the shopper’s instruction to collect items, call create_cart for the selected merchant and variant. A cart saves items and places no order. Keep items from different sellers in separate carts: Shopify says each cart and checkout belongs to one merchant. The result should contain the cart ID and its lines. If the shopper only wants to browse, stop after search; Shopify’s cart guidance says interest in a product alone is not permission to create a cart.
  4. Open and review checkout. When the shopper asks for the full price or is ready to buy, call create_checkout using the cart ID, or the exact variant ID and seller domain from search. The checkout document should return an ID, status, line items, currency, totals, payment methods, messages, merchant policy links and a continue_url for the merchant’s page. Show the shopper the current totals with their labels, including delivery and tax, every warning and every policy link before continuing. Keep disclosures next to the item or field they concern. Give the shopper the unchanged continue_url, including its query parameters, alongside the items it covers even if the agent can complete checkout. The checkout may be incomplete if it needs an address, or requires_escalation if the shopper must finish on the merchant’s page. Shopify says a checkout expires after six hours by default.
  5. Keep payment with the shopper. If the shopper signs in, the checkout may offer saved addresses and Shop Pay. Before calling complete_checkout, read the latest checkout, confirm it is ready_for_complete, show the merchant, items, quantities, total and available methods, and have the shopper choose a payment method. Do not select one for them. Keep the merchant’s unchanged continue_url available to the shopper even when the agent can complete checkout; if no payment instrument is available, the shopper must use that link. Shopify’s checkout instructions say to send complete_checkout once after approval and then inspect the returned status. A separate approval flow for stores outside Shopify has the shopper approve payment in Shop and supplies a card for that store’s own checkout; it is not the Shopify merchant checkout flow described in steps 3 and 4.
  6. Verify the outcome. Only status: completed with an order confirms that the merchant placed an order. If payment is still processing, use get_checkout to read the status again. Shopify says there are no webhooks at launch, so an integration must poll get_checkout for updates. If a completion call times out or the response is unclear, do not send it again or open a replacement checkout. Read the existing checkout; if it does not show both completed and order, tell the shopper the purchase is unconfirmed and give them continue_url.

Limits and recovery

Shopify says search works without credentials. Its launch note points developers who need higher rate limits to an API key in the Shopify Dev Dashboard, but it does not give a public price or rate table for that key. Merchant item prices, shipping and tax come from the current checkout; the shopper should review them before paying. An agent also has its own hosting or model costs if its developer uses one. The announcement does not quantify those costs.

A failed read can be repeated after any stated retry_after delay. For cart and checkout creates or updates, Shopify’s error guide says to use an idempotency key and read an existing resource before retrying an uncertain write. A create sent without a key that fails before returning an ID has an unknown outcome; do not guess by creating another. complete_checkout is stricter: never repeat it after an uncertain response. The merchant page remains the shopper’s route when requires_escalation or missing payment information prevents agent completion.

Treat checkout IDs, checkout links, access tokens and payment instruments as sensitive. Shopify says the checkout ID and continue_url contain access keys, so keep them out of logs and analytics and share the link only with the shopper. The authentication reference says to send a Shop token only in the authorization header to https://mcp.shop.com/. A payment instrument can contain a credential; do not print or log it.

BIG CHANGE previously covered Shopify’s browser-agent checkout tools. This hosted MCP release describes a separate workflow that begins with catalog discovery. Shopify’s release note and manuals establish what developers can call and what responses to inspect; they do not establish conversion gains, reliability under load or a successful purchase by BIG CHANGE.

Sources & further reading