shopify-operations-mcp

{
  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
  "name": "io.github.jpka/shopify-operations-mcp",
  "description": "Safe-write Shopify operations: plan-before-execute writes with out-of-band approval and audit.",
  "title": "shopify-operations-mcp",
  "repository": {
    "url": "https://github.com/jpka/shopify-operations-mcp",
    "source": "github"
  },
  "version": "0.1.2",
  "packages": [
    {
      "registryType": "npm",
      "identifier": "shopify-operations-mcp",
      "version": "0.1.2",
      "transport": {
        "type": "stdio"
      },
      "environmentVariables": [
        {
          "description": "The myshopify.com store domain, e.g. my-store.myshopify.com. Overrides shopify.storeDomain from the config file.",
          "isRequired": true,
          "format": "string",
          "name": "SHOPIFY_STORE_DOMAIN"
        },
        {
          "description": "Shopify Admin API access token. Required and only ever read from the environment — never from the config file.",
          "isRequired": true,
          "format": "string",
          "isSecret": true,
          "name": "SHOPIFY_ADMIN_TOKEN"
        },
        {
          "description": "Path to a config.json with shopify/plans/approvalServer/protectedTags settings. Defaults to ./config.json in the working directory.",
          "format": "string",
          "name": "SHOPIFY_CONFIG"
        },
        {
          "description": "How long a plan token stays valid before it must be executed or expires, in milliseconds. Default 60000.",
          "format": "string",
          "name": "SHOPIFY_PLAN_TTL_MS"
        },
        {
          "description": "Port the localhost human-approval HTTP server binds to (127.0.0.1 only). Default 4319.",
          "format": "string",
          "name": "SHOPIFY_APPROVAL_SERVER_PORT"
        },
        {
          "description": "Comma-separated tags that plans may never modify; any plan touching an item carrying one is refused. Default do-not-touch.",
          "format": "string",
          "name": "SHOPIFY_PROTECTED_TAGS"
        },
        {
          "description": "Identity recorded as the caller on every audit log row. Default unknown.",
          "format": "string",
          "name": "SHOPIFY_CALLER_ID"
        },
        {
          "description": "File path for the tamper-evident JSONL audit log. Default shopify-operations-audit.jsonl in the working directory.",
          "format": "string",
          "name": "SHOPIFY_AUDIT_PATH"
        }
      ]
    }
  ]
}