# io.github.codespar/mcp-shopify (npm · @codespar/mcp-shopify)

MCP server for Shopify — Admin REST API (orders, products, customers, inventory, fulfillments)

- Trust score: 69/100 (medium)
- Change this week: +23
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-04

## Components

- npm · `@codespar/mcp-shopify`: 69/100 (this document), [markdown](https://verifymcp.io/servers/codespar-mcp-shopify/codespar-mcp-shopify.md), [page](https://verifymcp.io/servers/codespar-mcp-shopify/codespar-mcp-shopify)

## Channel facts

- Registry: `npm`
- Package: `@codespar/mcp-shopify`
- Version: `0.2.2`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-04.

- **Supply Chain Security**: 83/100
  - No malware found by supply-chain analysis.
  - CVE check failed: a known medium-severity CVE affects hono 4.12.33, reached via @modelcontextprotocol/sdk > hono. A fixed version is available.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (94 of 98), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 42 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 77/100
  - AI-judged instruction clarity (excellent).
  - Tool/resource definitions use about 2514 tokens (~89/item across 28 items; 28 tools + 0 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 30/100
  - Stability observed for 9 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add codespar-mcp-shopify -- npx -y @codespar/mcp-shopify
```

### Codex

```bash
codex mcp add codespar-mcp-shopify -- npx -y @codespar/mcp-shopify
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "codespar-mcp-shopify": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@codespar/mcp-shopify"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add codespar-mcp-shopify --command npx --arg -y --arg @codespar/mcp-shopify
```

### Hermes

```yaml
mcp_servers:
  codespar-mcp-shopify:
    command: "npx"
    args: ["-y", "@codespar/mcp-shopify"]
```

### Other

```json
{
  "mcpServers": {
    "codespar-mcp-shopify": {
      "command": "npx",
      "args": [
        "-y",
        "@codespar/mcp-shopify"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-04 (score 69, 0)

- [security regression] CVE-2026-69207 affects this package: medium
- [security regression] Known CVEs: partial → fail

### 2026-08-02 (score 69, +28)

- [security regression] Provenance: unverified → fail
- [security improvement] Install scripts: unverified → pass
- [security improvement] Known CVEs: unverified → partial
- [security] Stability: Stability not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet.
- [functional regression] Capabilities: pass → unverified
- [functional regression] Tool coverage: 100 → unverified
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] Stability: unverified → 0.23
- [functional improvement] License: unverified → pass
- [functional improvement] Schema quality: unverified → excellent
- [functional improvement] Dependency health: unverified → partial
- [functional] First check of Schema quality: unverified
- [functional] Licence: MIT

### 2026-08-01 (score 41, +20)

- [security improvement] Malware scan: unverified → pass
- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional improvement] MCP protocol: unverified → pass

### 2026-07-31 (score 21, −7)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 28, −18)

- [security regression] Malware scan: pass → unverified

### 2026-07-27 (score 46)

First indexed and scored.

## MCP tools (28)

### `list_orders` (~188 tokens)

List orders with optional filters. Returns an array of order objects with line items, customer, shipping, and financial status.

Input parameters:

- `created_at_max` (string): ISO-8601 maximum created_at timestamp
- `created_at_min` (string): ISO-8601 minimum created_at timestamp
- `financial_status` (string): Filter by financial status (paid, pending, refunded, voided, partially_paid, partially_refunded, authorized)
- `fulfillment_status` (string): Filter by fulfillment status (shipped, partial, unshipped, any, unfulfilled)
- `ids` (string): Comma-separated list of order IDs to retrieve
- `limit` (number): Max results per page (1-250, default 50)
- `status` (string): Order status. Defaults to 'open'.
- `updated_at_min` (string): ISO-8601 minimum updated_at timestamp

### `get_order` (~30 tokens)

Get a single order by ID with full detail.

Input parameters:

- `id` (string, required): Shopify order ID (numeric)

### `create_order` (~76 tokens)

Create a new order. Useful for draft orders, phone orders, or marketplace order ingestion.

Input parameters:

- `order` (object, required): Shopify order object. Must include line_items (array of {variant_id, quantity} or {title, price, quantity}). Optional: customer, billing_address, shipping_address, email, financial_status, tags, note.

### `update_order` (~60 tokens)

Update an existing order (tags, note, email, shipping_address, metafields, etc).

Input parameters:

- `id` (string, required): Shopify order ID
- `order` (object, required): Partial order object with fields to update. The 'id' field is injected automatically.

### `cancel_order` (~90 tokens)

Cancel an order. Optionally restock inventory, refund payment, notify customer.

Input parameters:

- `email` (boolean): Send cancellation email to customer
- `id` (string, required): Shopify order ID
- `reason` (string): Cancellation reason
- `refund` (object): Refund object to issue with the cancellation
- `restock` (boolean): Restock the line items (deprecated in newer versions; use refund)

### `list_products` (~138 tokens)

List products with optional filters. Each product includes variants, images, and options.

Input parameters:

- `collection_id` (string): Filter to products in a specific collection
- `created_at_min` (string): ISO-8601 minimum created_at
- `ids` (string): Comma-separated list of product IDs
- `limit` (number): Max results per page (1-250, default 50)
- `product_type` (string): Filter by product_type
- `status` (string): Filter by product status
- `updated_at_min` (string): ISO-8601 minimum updated_at
- `vendor` (string): Filter by vendor name

### `get_product` (~30 tokens)

Get a single product by ID including all variants and images.

Input parameters:

- `id` (string, required): Shopify product ID

### `create_product` (~56 tokens)

Create a new product with variants, options, and images.

Input parameters:

- `product` (object, required): Shopify product object. Required: title. Optional: body_html, vendor, product_type, tags, status, variants (array), options, images.

### `update_product` (~53 tokens)

Update an existing product's fields, variants, or images.

Input parameters:

- `id` (string, required): Shopify product ID
- `product` (object, required): Partial product object with fields to update. The 'id' field is injected automatically.

### `list_customers` (~101 tokens)

List customers with optional query filter.

Input parameters:

- `created_at_min` (string): ISO-8601 minimum created_at
- `ids` (string): Comma-separated list of customer IDs
- `limit` (number): Max results per page (1-250, default 50)
- `query` (string): Full-text query (email, name, phone, tag, etc)
- `updated_at_min` (string): ISO-8601 minimum updated_at

### `create_customer` (~46 tokens)

Create a new customer record.

Input parameters:

- `customer` (object, required): Shopify customer object. Typical: email, first_name, last_name, phone, addresses (array), tags, accepts_marketing.

### `adjust_inventory` (~103 tokens)

Adjust the available inventory for a specific inventory_item at a specific location by a delta (positive to increase, negative to decrease).

Input parameters:

- `available_adjustment` (number, required): Delta to apply to available quantity (e.g. -3 to decrement by 3, +10 to increment by 10)
- `inventory_item_id` (number, required): Shopify inventory_item_id (numeric) — found on variant.inventory_item_id
- `location_id` (number, required): Shopify location_id (numeric)

### `create_fulfillment` (~78 tokens)

Create a fulfillment for an order (mark line items as shipped, attach tracking number and carrier).

Input parameters:

- `fulfillment` (object, required): Fulfillment object. Typical: location_id, tracking_number, tracking_company, tracking_urls (array), notify_customer (boolean), line_items (array).
- `order_id` (string, required): Shopify order ID to fulfill

### `update_fulfillment_tracking` (~92 tokens)

Update the tracking number, tracking company, or tracking URL on an existing fulfillment (post-ship tracking correction or late-binding tracking attach).

Input parameters:

- `id` (string, required): Shopify fulfillment ID
- `notify_customer` (boolean): Email the customer about the tracking update. Defaults to false.
- `tracking_info` (object, required): Tracking info object. Typical: number (string), company (string), url (string).

### `create_draft_order` (~88 tokens)

Create a draft order (invoice-style quote). Can be completed later into a real order via complete_draft_order.

Input parameters:

- `draft_order` (object, required): Shopify draft_order object. Typical: line_items (array of {variant_id, quantity} or {title, price, quantity}), customer, billing_address, shipping_address, email, note, tags, applied_discount, use_cu…

### `complete_draft_order` (~73 tokens)

Convert a draft order into a real order. Optionally mark as paid or send invoice.

Input parameters:

- `id` (string, required): Shopify draft_order ID
- `payment_pending` (boolean): If true, the draft order is completed with payment pending (customer pays later). If false/omitted, it is marked paid.

### `create_price_rule` (~153 tokens)

Create a price rule (the policy that governs discounts — percentage/fixed amount, prerequisites, entitlements, usage caps). Pair with create_discount_code to mint a usable code.

Input parameters:

- `price_rule` (object, required): Shopify price_rule object. Required: title, target_type ('line_item' | 'shipping_line'), target_selection ('all' | 'entitled'), allocation_method ('across' | 'each'), value_type ('percentage' | 'fixe…

### `create_discount_code` (~68 tokens)

Create a discount code tied to an existing price rule (the customer-facing string like 'SUMMER20').

Input parameters:

- `discount_code` (object, required): Discount code object. Required: code (string, e.g. 'SUMMER20').
- `price_rule_id` (string, required): Parent price_rule ID

### `create_smart_collection` (~83 tokens)

Create a smart collection — an automated collection populated by rules (e.g. vendor, tag, product_type, price range).

Input parameters:

- `smart_collection` (object, required): Shopify smart_collection object. Required: title, rules (array of {column, relation, condition}). Optional: body_html, sort_order, disjunctive (boolean — OR vs AND), published.

### `create_custom_collection` (~66 tokens)

Create a custom collection — a manually curated collection. Products are attached separately via collects.

Input parameters:

- `custom_collection` (object, required): Shopify custom_collection object. Required: title. Optional: body_html, sort_order, published, image, metafields, collects (array of {product_id}).

### `create_metafield` (~121 tokens)

Attach a metafield (custom typed field) to a resource (shop, product, variant, customer, order, collection, draft_order, etc).

Input parameters:

- `metafield` (object, required): Shopify metafield object. Required: namespace, key, value, type (e.g. 'single_line_text_field', 'number_integer', 'json', 'boolean'). Optional: owner_resource ('product' | 'variant' | 'customer' | 'o…

### `create_variant` (~98 tokens)

Add a new variant to an existing product (size/color/SKU permutation with its own price and inventory).

Input parameters:

- `product_id` (string, required): Parent product ID
- `variant` (object, required): Shopify variant object. Typical: option1, option2, option3, price, sku, barcode, inventory_management ('shopify' | null), inventory_policy ('deny' | 'continue'), inventory_quantity, weight, weight_un…

### `update_variant` (~61 tokens)

Update an existing product variant's price, SKU, barcode, options, weight, or inventory policy.

Input parameters:

- `id` (string, required): Shopify variant ID
- `variant` (object, required): Partial variant object with fields to update. The 'id' field is injected automatically.

### `list_transactions` (~82 tokens)

List all payment transactions for an order (authorizations, captures, sales, refunds, voids) including gateway and amount.

Input parameters:

- `in_shop_currency` (boolean): Show amounts in the shop's default currency rather than transaction currency
- `order_id` (string, required): Shopify order ID
- `since_id` (string): Return only transactions with IDs greater than this value

### `list_abandoned_checkouts` (~134 tokens)

List abandoned checkouts (carts where the customer entered contact info but did not complete checkout). Useful for recovery campaigns.

Input parameters:

- `created_at_max` (string): ISO-8601 maximum created_at
- `created_at_min` (string): ISO-8601 minimum created_at
- `limit` (number): Max results per page (1-250, default 50)
- `since_id` (string): Return only checkouts with IDs greater than this value
- `status` (string): Checkout status. Defaults to 'open'.
- `updated_at_min` (string): ISO-8601 minimum updated_at

### `list_locations` (~36 tokens)

List all fulfillment locations (physical stores, warehouses, 3PLs). Use the returned IDs with adjust_inventory and create_fulfillment.

### `create_refund` (~128 tokens)

Refund one or more line items on an order. Can refund to original payment or as store credit, optionally restocking inventory.

Input parameters:

- `order_id` (string, required): Shopify order ID to refund
- `refund` (object, required): Shopify refund object. Typical: currency, notify (boolean), note, shipping ({amount} or {full_refund: true}), refund_line_items (array of {line_item_id, quantity, restock_type: 'no_restock' | 'cancel…

### `register_webhook` (~115 tokens)

Register a webhook subscription for a Shopify event topic (orders/create, orders/paid, products/update, app/uninstalled, etc).

Input parameters:

- `address` (string, required): HTTPS URL that will receive webhook POSTs
- `fields` (array): Optional list of fields to include in the payload
- `format` (string): Payload format. Defaults to 'json'.
- `topic` (string, required): Webhook topic (e.g. 'orders/create', 'orders/paid', 'products/update', 'customers/create', 'app/uninstalled')

## Diagnostics

Captured diagnostic sections: Provenance, Vulnerabilities, Dependencies. The full working is on the page: https://verifymcp.io/servers/codespar-mcp-shopify/codespar-mcp-shopify#diagnostics

## Score history

- 2026-08-04: 69
- 2026-08-03: 69
- 2026-08-02: 69
- 2026-08-01: 41
- 2026-07-31: 21
- 2026-07-30: 28
- 2026-07-28: 46
- 2026-07-27: 46

## Links

- npm package: https://www.npmjs.com/package/@codespar/mcp-shopify
- Socket report: https://socket.dev/npm/package/@codespar/mcp-shopify
- Repository: https://github.com/codespar/mcp-dev-latam
- Changelog RSS feed: https://verifymcp.io/servers/codespar-mcp-shopify/codespar-mcp-shopify/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/codespar-mcp-shopify/codespar-mcp-shopify/changelog.json
- HTML version of this page: https://verifymcp.io/servers/codespar-mcp-shopify/codespar-mcp-shopify