Shopify (kockatoos) MCP Server
@kockatoos/shopify-mcp
npm
v1.0.9
Published by @kockatoos — no publish provenance, so origin is unverified, but the source is public: the repository link below is self-declared yet readable, so you can inspect the code before adopting it.
MCP server for Shopify Admin API — lets AI agents manage a Shopify store
The grade answers one question — how safe is this server for you to adopt — so it is computed in two auditable stages. Nothing below is an opinion or an LLM's guess; every line is a real term the deterministic engine applied, and the same input always yields the same number.
1. Threat score — 100 − 0 = 100. What the published surface and source actually contain:
The deterministic scan raised no scored threat in the surface it inspected — the threat score stayed at 100. Capability observations and advisory notes are recorded but never lower it.
2. Client adoption risk — 100 − 11 = 89. Three small, subtract-only factors that reflect your risk in adopting it — a clean scan proves less on a powerful, unverified or barely-inspectable package, so the grade says so plainly:
| Points | Adoption-risk factor |
|---|---|
| −10 | capability blast radius (critical) — client exposure if the model is manipulated |
| −1 | publisher verification (public source) — no provenance, but the source is public and inspectable |
Capability observations and info notes are shown under Findings but never scored.
Open any row's finding below for the file, line and evidence behind a deduction.
Findings 7
critical Completed toxic-flow trifecta across toolsMTC-FLOW-002
This server (without client built-ins) exposes a complete data-exfiltration chain: get_bundle → list_files → create_webhook. Untrusted input is ingested, private data is read, and it can be sent to an external sink via the agent composing the tools (→). Static analysis proves the primitive exists, not that a specific run will occur.
Fix: Remove one leg of the trifecta: isolate untrusted-input tools from secret-reading tools and from egress tools, or require human approval between them.
Location: flow get_bundle → list_files → create_webhook
high Shell/command execution in server code (dist/get-token.js)MTC-SRC-002
In the server's implementation (`dist/get-token.js:29`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: require("http")); const child_process_1 = require("child_process"); // Load .env from CWD first, then package dir fallba
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server dist/get-token.js
medium Hardcoded egress to an external endpoint (dist/get-token.js)MTC-SRC-003
In the server's implementation (`dist/get-token.js:82`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: { const res = await fetch(`https://${shop}/admin/oauth/access_token`, { method: "POST", headers: {
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server dist/get-token.js
medium Tool "create_file" can modify the filesystemMTC-CAP-002
Tool "create_file" can write, overwrite or delete files (keyword "create_file" in tool name). Verify it is scoped to a safe directory.
Fix: Constrain file operations to an explicit, non-sensitive root; reject path traversal.
Location: tool create_file
medium Tool "delete_files" can modify the filesystemMTC-CAP-002
Tool "delete_files" can write, overwrite or delete files (keyword "delete_file" in tool name). Verify it is scoped to a safe directory.
Fix: Constrain file operations to an explicit, non-sensitive root; reject path traversal.
Location: tool delete_files
low Mutating tool "create_file" declares no destructiveHintMTC-CAP-005
Tool "create_file" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.
Fix: Declare accurate annotations, and gate destructive tools on user confirmation regardless.
Location: tool create_file
low Mutating tool "delete_files" declares no destructiveHintMTC-CAP-005
Tool "delete_files" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.
Fix: Declare accurate annotations, and gate destructive tools on user confirmation regardless.
Location: tool delete_files
Tools 136
Each tool and what it can reach — statically extracted from the published source.
create_filewrites filescreate_webhooknetwork egressdelete_fileswrites filesdelete_webhooknetwork egressget_bundleingests untrusted inputget_bundle_operationingests untrusted inputget_pageingests untrusted inputlist_filesreads sensitive dataupdate_webhooknetwork egressactivate_automatic_discountno sensitive capability
Show 126 more tools ↓
activate_code_discountno sensitive capabilityadd_product_to_collectionno sensitive capabilityadjust_inventoryno sensitive capabilitycancel_fulfillmentno sensitive capabilitycancel_orderno sensitive capabilityclose_orderno sensitive capabilitycomplete_draft_orderno sensitive capabilitycreate_automatic_discount_basicno sensitive capabilitycreate_automatic_discount_bxgyno sensitive capabilitycreate_automatic_discount_free_shippingno sensitive capabilitycreate_bundleno sensitive capabilitycreate_code_discount_basicno sensitive capabilitycreate_code_discount_bxgyno sensitive capabilitycreate_code_discount_free_shippingno sensitive capabilitycreate_custom_collectionno sensitive capabilitycreate_customerno sensitive capabilitycreate_discount_codeno sensitive capabilitycreate_draft_orderno sensitive capabilitycreate_fulfillmentno sensitive capabilitycreate_menuno sensitive capabilitycreate_metafield_definitionno sensitive capabilitycreate_pageno sensitive capabilitycreate_price_ruleno sensitive capabilitycreate_productno sensitive capabilitycreate_product_imageno sensitive capabilitycreate_smart_collectionno sensitive capabilitycreate_themeno sensitive capabilitycreate_variantno sensitive capabilitydeactivate_automatic_discountno sensitive capabilitydeactivate_code_discountno sensitive capabilitydelete_automatic_discountno sensitive capabilitydelete_code_discountno sensitive capabilitydelete_custom_collectionno sensitive capabilitydelete_customer_metafieldno sensitive capabilitydelete_discount_codeno sensitive capabilitydelete_draft_orderno sensitive capabilitydelete_menuno sensitive capabilitydelete_order_metafieldno sensitive capabilitydelete_pageno sensitive capabilitydelete_price_ruleno sensitive capabilitydelete_productno sensitive capabilitydelete_product_imageno sensitive capabilitydelete_product_metafieldno sensitive capabilitydelete_themeno sensitive capabilitydelete_theme_filesno sensitive capabilitydelete_variantno sensitive capabilityget_app_installationno sensitive capabilityget_automatic_discountno sensitive capabilityget_code_discountno sensitive capabilityget_custom_collectionno sensitive capabilityget_customerno sensitive capabilityget_customer_metafieldno sensitive capabilityget_draft_orderno sensitive capabilityget_locationno sensitive capabilityget_menuno sensitive capabilityget_orderno sensitive capabilityget_order_metafieldno sensitive capabilityget_price_ruleno sensitive capabilityget_productno sensitive capabilityget_product_imageno sensitive capabilityget_product_metafieldno sensitive capabilityget_shop_infono sensitive capabilityget_smart_collectionno sensitive capabilityget_themeno sensitive capabilityget_theme_filesno sensitive capabilityget_variantno sensitive capabilityget_webhookno sensitive capabilitylist_app_installationsno sensitive capabilitylist_automatic_discountsno sensitive capabilitylist_code_discountsno sensitive capabilitylist_collection_productsno sensitive capabilitylist_custom_collectionsno sensitive capabilitylist_customer_metafieldsno sensitive capabilitylist_customersno sensitive capabilitylist_discount_codesno sensitive capabilitylist_draft_ordersno sensitive capabilitylist_fulfillment_ordersno sensitive capabilitylist_fulfillmentsno sensitive capabilitylist_inventory_levelsno sensitive capabilitylist_locationsno sensitive capabilitylist_menusno sensitive capabilitylist_metafield_definitionsno sensitive capabilitylist_order_metafieldsno sensitive capabilitylist_ordersno sensitive capabilitylist_pagesno sensitive capabilitylist_price_rulesno sensitive capabilitylist_product_imagesno sensitive capabilitylist_product_metafieldsno sensitive capabilitylist_productsno sensitive capabilitylist_smart_collectionsno sensitive capabilitylist_theme_filesno sensitive capabilitylist_themesno sensitive capabilitylist_variantsno sensitive capabilitylist_webhooksno sensitive capabilitypublish_themeno sensitive capabilityremove_product_from_collectionno sensitive capabilityreorder_collection_productsno sensitive capabilitysearch_customersno sensitive capabilitysend_draft_order_invoiceno sensitive capabilityset_customer_metafieldno sensitive capabilityset_inventoryno sensitive capabilityset_order_metafieldno sensitive capabilityset_product_metafieldno sensitive capabilitystage_uploadno sensitive capabilityupdate_automatic_discount_basicno sensitive capabilityupdate_automatic_discount_bxgyno sensitive capabilityupdate_automatic_discount_free_shippingno sensitive capabilityupdate_bundleno sensitive capabilityupdate_code_discount_basicno sensitive capabilityupdate_code_discount_bxgyno sensitive capabilityupdate_code_discount_free_shippingno sensitive capabilityupdate_custom_collectionno sensitive capabilityupdate_customerno sensitive capabilityupdate_draft_orderno sensitive capabilityupdate_fileno sensitive capabilityupdate_fulfillment_trackingno sensitive capabilityupdate_menuno sensitive capabilityupdate_orderno sensitive capabilityupdate_pageno sensitive capabilityupdate_price_ruleno sensitive capabilityupdate_productno sensitive capabilityupdate_product_imageno sensitive capabilityupdate_smart_collectionno sensitive capabilityupdate_themeno sensitive capabilityupdate_variantno sensitive capabilityupsert_theme_filesno sensitive capability
Toxic flows 1
Cross-tool combinations that form a data-exfiltration primitive (untrusted input → sensitive source → external sink).
What this scan could not see
- Tools were statically extracted from the published source (136 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command "npx -y <package>".
Versions 1
Scan history per published version. The engine is deterministic — the same version always yields the same score, so a changed score means the package itself changed.
| Version | Score | Findings | Engine | Scanned |
|---|---|---|---|---|
v1.0.9 latest |
B 89/100 | 7 | 1.13.0 | 2026-09-07 |
Embed this score
Show this server's live Trust Score in your README, docs or website. The badge is served straight from the registry and updates automatically after every rescan — no API key needed. It links back to this page, so anyone who sees the grade can also read the findings behind it instead of taking a number on faith.
Verify this score yourself
The score above is reproducible: the same package version always yields the same result. Run it locally or over the free API — no account, no LLM, fully deterministic.
npx mcptrustchecker scan @kockatoos/shopify-mcp --onlineOther implementations of Shopify 14
Independent packages implementing the same tool, scanned with the same engine. Compare all 15 side by side →
Model Context Protocol server for the Shopify Admin GraphQL API
MCP Server for Shopify API, enabling interaction with store data through GraphQL API
Shopify Admin GraphQL API MCP server by AIWerk - manage products, orders, customers, inventory, and more from your AI agent
MCP Server for Shopify API, enabling interaction with store data through GraphQL API
MCP server for shopify integration
Shopify MCP Pack — wraps the Shopify Admin REST API (2024-01)
More in Business & CRM
Free public tax reference data — GST/VAT, income, company and capital-gains tax rules for 50+ countries.
The approval gate for unattended UCP buying agents — a policy/approval MCP proxy in front of a merchant's UCP checkout endpoint.
Autotask PSA MCP server. Generic entity query/get/create/update across the full REST API plus convenience tools for tickets, companies, contacts, projects, tasks and time entries. AI-safe with readonly mode and destructive-action confirmation. stdio + opt
MCP server for B2C Commerce developer experience tools
Search, compare and contact real-world companies through a public MCP business directory.
Norwegian business register (Brønnøysundregistrene) as an MCP server — companies, roles, subunits and annual accounts, with the register's silent traps encoded as guards.