# How to connect a shopping agent to Shopify’s Shop MCP

> Shopify's new Shop MCP connects catalog search, merchant carts and checkout. This documentation-based guide shows the setup, shopper approval step and order verification boundary.

By BIG CHANGE Editorial

Published: 2026-10-14T12:58:17.853Z
Updated: 2026-10-14T12:58:17.853Z
Canonical: https://bigchange.ai/blog/connect-shopping-agent-shopify-shop-mcp

![Conceptual charcoal illustration of a product shelf, a shopping basket holding one cup, and a blank checkout terminal; a shopper's hand pauses short of the terminal.](https://bigchange.ai/api/media/file/shop-mcp-catalog-to-checkout-hero-v1.png)
AI-generated conceptual illustration by BIG CHANGE; no actual Shop MCP interface, agent test or purchase is depicted.

Shopify [launched Shop MCP on October 13](https://shopify.dev/changelog/posts/add-shopping-and-shop-pay-checkout-to-any-agent-with-shop-mcp), giving developers one hosted connection for product search, carts and checkout. The service is at `https://mcp.shop.com/`. Its 17 tools can find products in Shopify Catalog and open a checkout with the merchant selling an item. Catalog search needs no API key. A shopper must still approve a real purchase.

This is a guide for developers configuring an MCP-compatible assistant. The steps below follow Shopify’s documentation, checked on October 14. BIG CHANGE did not connect an agent, create a cart or make a purchase. The guide therefore describes expected results, not observed performance.

## The big change

- **What changed:** Shopify now offers a hosted MCP connection that runs from catalog search through a merchant cart and checkout. It also documents Shop Pay completion for a signed-in shopper after explicit confirmation.
- **Who can use it:** Developers with an MCP client that supports protocol version `2026-07-28`, or code that makes the documented HTTP calls. An older client that only uses the `initialize` handshake cannot connect directly.
- **What to check:** A checkout is a single merchant’s transaction. `completed` together with an `order` confirms the purchase; a cart, a checkout link or an in-progress payment does not.

## Before you connect

You need an MCP client that supports remote HTTP servers and Shopify’s documented [connection method](https://shop.dev/docs/connect), or an app that calls the server over HTTP. Use the root URL `https://mcp.shop.com/`; adding `/mcp` produces a 404. Search and cart tools work without a Shop account. Signing in lets the assistant use saved preferences and addresses, find orders, and offer Shop Pay where the merchant supports it. For an assistant using its own HTTP code, Shopify documents an OAuth device flow that the shopper approves on Shop’s site.

Choose a product query, destination country and currency before searching. Keep the shopper’s stated requirements separate from search context: a country or currency helps localize results; a price cap, size or shipping destination is a filter. Prices in the API use the currency’s minor units. Your app should read the response’s `messages` before claiming that a result meets a filter, since the service can report that a filter was not applied as requested. [Shopify’s search guide](https://shop.dev/docs/search) explains the distinction and the 1-to-50 result page limit.

## A documented path from search to order

1. **Connect and check search.** Configure your client with `https://mcp.shop.com/` and load Shopify’s [Shop skill](https://shop.dev/docs/connect) if the client can use it. Shopify suggests checking the connection with a request to find three desk lamps without creating a cart. A working search returns products with a seller, a price in a stated currency and a merchant link. Developers using HTTP can follow Shopify’s [JSON-RPC quickstart](https://shop.dev/docs/quickstart), which includes the required protocol headers and `search_catalog` request. This is a read-only check and requires no sign-in.
2. **Choose the exact item.** Run `search_catalog` with the shopper’s query and requirements. Search returns a featured variant; use `get_product` if the shopper wants another size or color. Compare `product.selected` and the returned `variant.options` with every size, color and other choice the shopper specified before showing or buying it. Shopify says selection can relax without a warning. When the shopper picks a product or changes an option, call `get_product` again to check current availability and price. Keep that variant’s ID and seller domain exactly as returned. Do not assume the merchant will honor a previously displayed price. Show any warning beside the product it concerns. These checks are documented in [Find products](https://shop.dev/docs/search).
3. **Build a cart when requested.** With the shopper’s instruction to collect items, call `create_cart` for the selected merchant and variant. A cart saves items and places no order. Keep items from different sellers in separate carts: Shopify says each cart and checkout belongs to one merchant. The result should contain the cart ID and its lines. If the shopper only wants to browse, stop after search; Shopify’s [cart guidance](https://shop.dev/docs/checkout) says interest in a product alone is not permission to create a cart.
4. **Open and review checkout.** When the shopper asks for the full price or is ready to buy, call `create_checkout` using the cart ID, or the exact variant ID and seller domain from search. The checkout document should return an ID, status, line items, currency, totals, payment methods, `messages`, merchant policy `links` and a `continue_url` for the merchant’s page. Show the shopper the current totals with their labels, including delivery and tax, every warning and every policy link before continuing. Keep disclosures next to the item or field they concern. Give the shopper the unchanged `continue_url`, including its query parameters, alongside the items it covers even if the agent can complete checkout. The checkout may be `incomplete` if it needs an address, or `requires_escalation` if the shopper must finish on the merchant’s page. Shopify says a checkout expires after six hours by default.
5. **Keep payment with the shopper.** If the shopper signs in, the checkout may offer saved addresses and Shop Pay. Before calling `complete_checkout`, read the latest checkout, confirm it is `ready_for_complete`, show the merchant, items, quantities, total and available methods, and have the shopper choose a payment method. Do not select one for them. Keep the merchant’s unchanged `continue_url` available to the shopper even when the agent can complete checkout; if no payment instrument is available, the shopper must use that link. Shopify’s [checkout instructions](https://shop.dev/docs/checkout) say to send `complete_checkout` once after approval and then inspect the returned status. A separate [approval flow for stores outside Shopify](https://shop.dev/docs/approvals) has the shopper approve payment in Shop and supplies a card for that store’s own checkout; it is not the Shopify merchant checkout flow described in steps 3 and 4.
6. **Verify the outcome.** Only `status: completed` with an `order` confirms that the merchant placed an order. If payment is still processing, use `get_checkout` to read the status again. Shopify says there are no webhooks at launch, so an integration must poll `get_checkout` for updates. If a completion call times out or the response is unclear, do not send it again or open a replacement checkout. Read the existing checkout; if it does not show both `completed` and `order`, tell the shopper the purchase is unconfirmed and give them `continue_url`.

## Limits and recovery

Shopify says search works without credentials. Its [launch note](https://shopify.dev/changelog/posts/add-shopping-and-shop-pay-checkout-to-any-agent-with-shop-mcp) points developers who need higher rate limits to an API key in the Shopify Dev Dashboard, but it does not give a public price or rate table for that key. Merchant item prices, shipping and tax come from the current checkout; the shopper should review them before paying. An agent also has its own hosting or model costs if its developer uses one. The announcement does not quantify those costs.

A failed read can be repeated after any stated `retry_after` delay. For cart and checkout creates or updates, Shopify’s [error guide](https://shop.dev/docs/errors) says to use an idempotency key and read an existing resource before retrying an uncertain write. A create sent without a key that fails before returning an ID has an unknown outcome; do not guess by creating another. `complete_checkout` is stricter: never repeat it after an uncertain response. The merchant page remains the shopper’s route when `requires_escalation` or missing payment information prevents agent completion.

Treat checkout IDs, checkout links, access tokens and payment instruments as sensitive. Shopify says the checkout ID and `continue_url` contain access keys, so keep them out of logs and analytics and share the link only with the shopper. The [authentication reference](https://shop.dev/docs/authentication) says to send a Shop token only in the authorization header to `https://mcp.shop.com/`. A payment instrument can contain a credential; do not print or log it.

BIG CHANGE previously covered Shopify’s [browser-agent checkout tools](https://bigchange.ai/blog/shopify-webmcp-browser-agent-checkout). This hosted MCP release describes a separate workflow that begins with catalog discovery. Shopify’s release note and manuals establish what developers can call and what responses to inspect; they do not establish conversion gains, reliability under load or a successful purchase by BIG CHANGE.

## Sources & further reading

- [Shopify developer changelog, “Add shopping and Shop Pay checkout to any agent with Shop MCP,” October 13, 2026](https://shopify.dev/changelog/posts/add-shopping-and-shop-pay-checkout-to-any-agent-with-shop-mcp). Release scope, hosted endpoint, 17 tools, search access, checkout paths and launch webhook status.
- [Shop MCP overview and connection guide](https://shop.dev/docs/). Current protocol, client and sign-in requirements.
- [Shopify, Find products](https://shop.dev/docs/search). Search fields, variant selection, price units and filter warnings.
- [Shopify, Carts and checkout](https://shop.dev/docs/checkout). Merchant scope, status meanings, checkout completion and handling uncertain outcomes.
- [Shopify, Errors and retries](https://shop.dev/docs/errors). Read and write recovery rules.
- [Shopify, Authentication](https://shop.dev/docs/authentication). Shop account access and token handling.

## Sources

- [Shopify developer changelog, Add shopping and Shop Pay checkout to any agent with Shop MCP](https://shopify.dev/changelog/posts/add-shopping-and-shop-pay-checkout-to-any-agent-with-shop-mcp) — Launch date, live endpoint, 17 tools, catalog search without a key, Shop and non-Shopify checkout paths, no launch webhooks and Dev Dashboard key for higher rate limits. Shopify's claims, not independent results.
- [Shop MCP overview](https://shop.dev/docs/) — Hosted endpoint, 2026-07-28 MCP version, 2026-08-25 UCP document version, one merchant per checkout and completed plus order confirmation.
- [Shop MCP, Connect an agent](https://shop.dev/docs/connect) — Root URL and protocol requirement, client paths, skill loading and read-only connection check.
- [Shop MCP, Quickstart](https://shop.dev/docs/quickstart) — Documented JSON-RPC search request, headers, response shape, price units and errors.
- [Shop MCP, Find products](https://shop.dev/docs/search) — Query, filters, context, featured variant and warnings.
- [Shop MCP, Carts and checkout](https://shop.dev/docs/checkout) — Cart and checkout tool behavior, merchant scope, checkout fields and status, human payment approval, sensitive IDs and uncertain completion handling.
- [Shop MCP, Errors and retries](https://shop.dev/docs/errors) — Read recovery, idempotency key for non-payment writes and no repeat of uncertain complete_checkout.
- [Shop MCP, Authentication](https://shop.dev/docs/authentication) — Shop token scope, device flow and private credential handling.
- [Shop MCP, Approve a purchase outside Shopify](https://shop.dev/docs/approvals) — Separate shopper approval/card route for non-Shopify merchant checkout.