What it is
The Shopify Dev MCP server runs locally with npx -y @shopify/dev-mcp@latest over stdio and needs no authentication. Version 1.17.0 was published on 16 October 2026 under the ISC licence. It is one part of the Shopify AI Toolkit, which Shopify now recommends installing as a plugin in Claude Code, Codex, Cursor, VS Code and others; the plugin auto-updates and adds a single shopify agent skill.
The server lets an agent search Shopify's developer docs and API schemas, validate GraphQL operations, Liquid and theme files and UI-extension code against those schemas, and resolve supported API versions. It reads nothing from your store.
Store work lives elsewhere. The wider toolkit can run supported store-management tasks through Shopify CLI's logged-in store context, and shopping agents use the Universal Commerce Protocol servers on each store (Catalog, Cart, Checkout and Order MCP at /api/ucp/mcp), which replaced the old Storefront MCP catalog and cart tools.
Install
npx -y @shopify/dev-mcp@latestOur review
Shopify's APIs are versioned by date, and models trained on older docs write queries and extension code that no longer validate. The Dev MCP server's value is that the agent can search current docs and check its GraphQL, Liquid and extension code against Shopify's real schemas before you run anything. For app and theme work that is a large share of the debugging loop removed, at no cost.
The validation tools are configurable in a way the docs undersell. By default LIQUID_VALIDATION_MODE is full, which registers validate_theme for checking whole theme directories; partial mode drops it and validates individual code blocks through the merged validate tool. Doc lookups go through search_docs_chunks. Shopify does not publish a tool count, and the toolkit docs add that validation does not remove the need to review and test the result.
Telemetry is the catch. Published builds send usage events to shopify.dev that can include tool inputs and results, which means the code you validate. The plugin goes further: on Claude Code its hook can attach your most recent prompt verbatim, up to 2,000 characters, whenever a Shopify skill activates. Opting out takes an empty file at ~/.config/shopify-ai-toolkit/opt-out, OPT_OUT_INSTRUMENTATION=true or DO_NOT_TRACK=1, and Shopify warns that environment variables do not reach GUI-launched MCP servers or Codex's exec mode, so the file is the reliable route. Builds run from source send nothing.
Merchants should look elsewhere. The bare server has no store access at all; the toolkit's store tasks run through Shopify CLI, and Shopify's docs do not list which tasks are supported. That leaves the npx server as the minimal option in Shopify's own line-up: fewer moving parts than the plugin, and no prompt-capturing hook, but no automatic updates either.
Where it earns its place
A freelance developer building a public Shopify app in Cursor
Write Admin GraphQL queries that validate on the first run
The agent searches current docs, drafts the query and validates it against the schema before execution, so field names from an older API version are caught locally. Free; the cost is the doc chunks added to your model's context.
A theme developer at a six-person Shopify Plus agency
Check a whole theme's Liquid before handing it to a client
In the default full mode validate_theme checks the theme directory in one call, which catches broken tags and filters a reviewer would otherwise find by clicking through previews. Theme code is sent in telemetry unless the opt-out file exists.
A frontend team maintaining checkout extensions
Move checkout and customer-account extensions on API versions before 2025-10 to Polaris web components
Shopify's own worked example: the agent bumps the version in shopify.extension.toml, moves React code to Preact and swaps components and imports, with validation catching bad imports. Local testing is still required.
The head of engineering at a 20-developer Shopify agency
Roll out AI tooling across client projects without sending client code to a vendor
Install the server or plugin free on every machine and ship the opt-out file through managed dotfiles, since telemetry is on by default and environment variables do not reach every host.
Before you commit
- Setup
- claude mcp add --transport stdio shopify-dev-mcp -- npx -y @shopify/dev-mcp@latest, then restart the client; Node.js 18 or later. Shopify documents Claude Code, Codex, Antigravity, Cursor and VS Code, and recommends the plugin where the client supports it.
- Integrations
- Tools include search_docs_chunks, validate (GraphQL, UI extensions, and Liquid in partial mode) and validate_theme, plus API version resolution; all are read-only and none touch a store. Shopify does not publish a full tool list.
- Data and privacy
- No credentials and no store data. Published builds send tool inputs and results, API and package versions, a random conversation ID and client or model names to shopify.dev/mcp/usage unless you opt out.
- Cost at scale
- Free, with no published rate limits; the only running cost is the tokens your own model spends reading returned doc chunks.
- Limits
- Developer-only: no products, orders or customers. Store tasks need the toolkit plus Shopify CLI and its store login, and Shopify does not list which tasks are supported.
What's good
- Validates GraphQL, Liquid, themes and extensions against current schemas
- No account, key or store access needed
- Frequent releases; free
- Builds from source send no telemetry
What's not
- Telemetry on by default and can include validated code
- No store or order data; store tasks need the plugin and Shopify CLI
- Tool list and supported store tasks not documented in full
- Plain server does not auto-update like the plugin
Best for
Developers building Shopify apps, themes or extensions with a coding agent.
Alternatives
Shopify Dev MCP: common questions
- Is Shopify Dev MCP worth it?
- Any coding agent that touches Shopify's dated API versions should have this installed, ideally after creating the telemetry opt-out file. We rate it 4.2 out of 5.
- How much does Shopify Dev MCP cost?
- Free; no Shopify account or authentication needed.
- What are the downsides of Shopify Dev MCP?
- Telemetry on by default and can include validated code; no store or order data; store tasks need the plugin and Shopify CLI; tool list and supported store tasks not documented in full; plain server does not auto-update like the plugin.
- Who is Shopify Dev MCP best for?
- Developers building Shopify apps, themes or extensions with a coding agent.
- How much does Shopify Dev MCP cost for a team or in production?
- Free, with no published rate limits; the only running cost is the tokens your own model spends reading returned doc chunks.
- Is Shopify Dev MCP safe for company data?
- No credentials and no store data. Published builds send tool inputs and results, API and package versions, a random conversation ID and client or model names to shopify.dev/mcp/usage unless you opt out.
- What are the best Shopify Dev MCP alternatives?
- The closest alternatives we have reviewed are Stripe MCP, Square MCP Server and Context7.
Answers checked Oct 22, 2026.
Make Shopify Dev MCP? Show this rating on your site
