Shopify Dev MCP — Watchlist

MCP100 Assessment

Watchlist / Tracking

Why we’re tracking it

Track this specific mcp_server implementation and its adoption, setup drift, privilege model, and source activity.

Reviewed Oct 9, 2026 · Documentation review; complete setup workflow not independently tested

Best fit

Validate Shopify GraphQL, Liquid and extension code

What we know

Official local documentation/validation MCP for Shopify developers, with API schema lookup and GraphQL and theme checks.

Maintenance / activity evidence

207350 npm downloads during 2026-09-08 through 2026-10-07 for @shopify/dev-mcp

Tracking evidence observed Oct 9, 2026. These dated signals do not establish current maintenance. Reviewed enrichment confidence: high.

Verification gaps / watch-outs

Installation and comprehensive security have not been independently audited.
Primarily reads docs and validates developer assets Complete write authority is not verified.
No authentication for local server
Sensitive access: Developer code, Tool inputs/results in telemetry

Opt out with OPT_OUT_INSTRUMENTATION=true or documented opt-out file
Developer MCP may emit telemetry; verify documented instrumentation opt-out and current CLI requirements.
Shopify developer docs and validation MCP is run over local stdio; publisher discloses telemetry may include tool inputs and results and provides explicit opt-out.
Unknown vulnerabilities, deployment environment and client privileges not exhaustively reviewed.

Full authority, access and evidence limits are available in Review context and Access & risk.

Popularity

· 207.4k package downloads / 30 days

Downloads observed Oct 9, 2026.

Exact npm package @shopify/dev-mcp; provider interval 2026-09-08–2026-10-07 (inclusive); observed 2026-10-09.

All limitations / Review context

What changed in documented permissions, distribution and MCP integration of Shopify Dev MCP before the next review?

No substantiated blocker to accurately qualified PUBLIC RADAR TRACKING observed in the scoped cited documentation; material caveats are required on the public page.

Opt out with OPT_OUT_INSTRUMENTATION=true or documented opt-out file
Developer MCP may emit telemetry; verify documented instrumentation opt-out and current CLI requirements.
Shopify developer docs and validation MCP is run over local stdio; publisher discloses telemetry may include tool inputs and results and provides explicit opt-out.
Primarily reads docs and validates developer assets
No authentication for local server
Depends on configured local process, connected account and remote APIs; review first-party privacy terms for any hosted component.
Sensitive access: Developer code, Tool inputs/results in telemetry
Complete write authority is not verified.
Installation, client compatibility and comprehensive security have not been independently audited. Authentication and access depend on the configured services.
Unknown vulnerabilities, deployment environment and client privileges not exhaustively reviewed.
Exact dated attributable activity evidence
Write actions/tool inventory not confirmed against exact tool documentation; listed action classes remain illustrative or context-dependent. Empty inventory does not establish read-only.
Developer reference tool, not direct store administration
Released builds send telemetry that may include tool inputs/results unless opted out
Published npm build telemetry may include tool inputs and outputs; opt out with OPT_OUT_INSTRUMENTATION=true or DO_NOT_TRACK=1.
No independent release lifecycle audit; do not claim precise activity date.

Original activity observations

207350 npm downloads during 2026-09-08 through 2026-10-07 for @shopify/dev-mcp

Technical identity

npm/@shopify/dev-mcp

Exact implementation source: https://www.npmjs.com/package/@shopify%2Fdev-mcp ↗
Reviewed resource type: MCP Server
Package identity: npm:@shopify/dev-mcp

Evidence & Sources

Evidence basis: Recorded source evidence
Setup runtime verification: Not independently runtime-tested by MCP100 for this setup workflow.

Reviewed Oct 9, 2026 · Latest source observation Oct 9, 2026

Package registry ↗
@shopify/dev-mcp
Recorded package identity, distribution or download evidence.
Includes references whose attribution is not established.

Setup · Watchlist

Install & Agents

Publisher instructions.

Source evidence observed Oct 13, 2026.

Additional setup details required — see the specific gaps below.

Install / connect
Publisher instructions
Shopify development docs/tool server; configure MCP client command and verify documentation retrieval.
For local stdio with Node.js 18+: `npx -y @shopify/dev-mcp@latest`. Register that command in the MCP client. Publisher README says no authentication is required.
stdio mcp launcher · Publisher instructions
npx -y @shopify/dev-mcp@latest
Configure / authenticate
MCP100 setup guide
Shopify-owned example config uses mcpServers.shopify-dev-mcp with command npx and args [-y,@shopify/dev-mcp@latest], and optional POLARIS_UNIFIED/LIQUID flags. No API key documented in this example; require Node.js 18+ per Shopify plugin README.
Optional environment: {"LIQUID":"true","POLARIS_UNIFIED":"true"}
Check connection
Suggested check
After MCP initialization inspect Shopify developer tools, then use read-only documentation lookup rather than GraphQL mutation.
Remove / uninstall / revoke
MCP100 setup guide
Generic client guidance (not publisher-specific uninstall): unregister MCP entry in the chosen client. If installed globally, remove the npm package separately. Revoke provider access separately through account controls, where supported. This does not erase local data or revoke funds/credentials automatically.
Unregister the named MCP entry from the actual host separately from removing a global npm install; no claim that either revokes remote credentials.
No Shopify API key required for the documented developer-docs MCP; credential revocation is not applicable to this local keyless route.

Official Documentation & Sources

What it does

Official local documentation/validation MCP for Shopify developers, with API schema lookup and GraphQL and theme checks.

Capability: Developer Tools
Resource type: MCP Server
Industry: Retail & E-commerce
Best fit: Validate Shopify GraphQL, Liquid and extension code

Representative uses

Search Shopify docs
Validate GraphQL
Check Liquid/theme
Validate UI extensions

Limitations

Developer reference tool, not direct store administration
Released builds send telemetry that may include tool inputs/results unless opted out
Published npm build telemetry may include tool inputs and outputs; opt out with OPT_OUT_INSTRUMENTATION=true or DO_NOT_TRACK=1.
Opt out with OPT_OUT_INSTRUMENTATION=true or documented opt-out file
No independent release lifecycle audit; do not claim precise activity date.

Reviewed access

Access & risk

Review the exact access boundary before connecting this MCP to accounts, credentials, or sensitive data.

Authentication: No authentication for local server
Permissions: Primarily reads docs and validates developer assets
Data handling: Depends on configured local process, connected account and remote APIs; review first-party privacy terms for any hosted component.
Cost: unknown
Risk and cautions: Opt out with OPT_OUT_INSTRUMENTATION=true or documented opt-out file

Access scope and cautions

Write actions: Not verified
Sensitive access: Developer code Tool inputs/results in telemetry
Risk level: moderate
Security notes: Developer MCP may emit telemetry; verify documented instrumentation opt-out and current CLI requirements. Shopify developer docs and validation MCP is run over local stdio; publisher discloses telemetry may include tool inputs and results and provides explicit opt-out.

The reviewed evidence does not establish the complete write authority of this MCP. Consult the unresolved evidence before granting write access.

FAQ

Based on reviewed evidence as of 2026-10-09. Watchlist tracking is not a recommendation or a security certification.

Which tasks are documented for this implementation?

The reviewed tasks include: Search Shopify docs; Validate GraphQL; Check Liquid/theme; Validate UI extensions.

What setup and authentication are documented?

Recorded installation/entrypoint step: npx -y @shopify/dev-mcp@latest. Recorded transport: stdio. Prerequisites: Compatible MCP client. Client notes: Source docs and package may evolve; install according to confirmed release. These are the documented setup details, not a claim that installation or client compatibility was independently tested. Authentication: No authentication for local server

Can it modify data or perform write operations?

Not verified. The available evidence does not establish the complete write authority. Recorded permission context: Primarily reads docs and validates developer assets

What data-handling boundary should I consider?

Depends on configured local process, connected account and remote APIs; review first-party privacy terms for any hosted component. Recorded sensitive-access context: Developer code; Tool inputs/results in telemetry.

What limitations and risks should I check before use?

Opt out with OPT_OUT_INSTRUMENTATION=true or documented opt-out file. Developer reference tool, not direct store administration. Released builds send telemetry that may include tool inputs/results unless opted out. Published npm build telemetry may include tool inputs and outputs; opt out with OPT_OUT_INSTRUMENTATION=true or DO_NOT_TRACK=1. No independent release lifecycle audit; do not claim precise activity date. Developer MCP may emit telemetry; verify documented instrumentation opt-out and current CLI requirements. Shopify developer docs and validation MCP is run over local stdio; publisher discloses telemetry may include tool inputs and results and provides explicit opt-out. Unknown vulnerabilities, deployment environment and client privileges not exhaustively reviewed.