Documentation
How it works
MCP Command turns your Shopify store into a set of tools your AI assistant can use through the open Model Context Protocol (MCP). Describe what you want – a price update, a restock, a new collection or a complete landing page – and the AI does the work. You decide per capability whether it may act automatically (Auto), must ask you first (Approval) or is Blocked. Every request is recorded in the activity log. Your Shopify access token never leaves MCP Command; the AI only receives what you allow.
1. Install
Install MCP Command from the Shopify App Store and open it in your admin.
2. Set permissions
Pick the Safe, Balanced or Autonomous preset, then fine-tune individual capabilities.
3. Connect your AI
Add Claude, ChatGPT, Cursor or Gemini from the Connections page.
4. Approve and audit
Review approval cards with before/after diffs and follow everything in Activity.
From one prompt to a whole page
Ask your assistant for “a landing page for our new matcha collection with a hero, three benefits, the products and an FAQ”. The AI creates the products and the collection, writes the theme sections and the page template, adds the page and the navigation entry – each step as a tool call that MCP Command checks against your permissions.
- Pages, blog posts, collections and navigation are written directly (Starter plan) and appear as approval cards when you keep those capabilities on Approval.
- Theme sections, templates and styles are written to a development theme, never to your live theme (Pro plan). The approval card shows the full diff of every file.
- Publishing the development theme is a separate, critical action that always needs your approval.
Nothing changes in your storefront until you have approved it. MCP Command edits the themes you already have installed; for a new theme, use the Shopify Theme Store.
Connect Claude (Desktop, Cowork, claude.ai)
- In MCP Command open Connections → Claude → Add connection and copy the MCP address.
- Open Claude at Customize → Connectors and choose Add custom connector.
- Enter “MCP Command – AI Store Control” and paste the copied address.
- Choose Connect and approve access in Shopify.
- Set normal read and write tools in Claude to “Always allow” and deletion tools to “Needs approval”. MCP Command continues to enforce the authoritative store permissions.
Connect ChatGPT
- In MCP Command open Connections → ChatGPT → Add connection and copy the MCP address.
- Open ChatGPT and choose Settings → Apps → Create.
- Enter “MCP Command – AI Store Control” and paste the copied address.
- Confirm the connection. OAuth returns to your Shopify store for the final approval.
Connect Cursor
- In MCP Command open Connections → Cursor → Add connection and click Install in Cursor.
- Confirm the displayed MCP configuration in Cursor.
- Sign in with OAuth and approve the connection in Shopify.
Connect Gemini or any other MCP client
- In MCP Command open Connections → Gemini → Create configuration.
- Copy the one-time configuration (endpoint and bearer token) into your Gemini or Google agent, or any MCP client that supports bearer tokens.
- The credential can be revoked from the Connections page at any time.
The MCP endpoint is:
https://mcp.mcpcommand.app/mcpRequests are single JSON-RPC calls over HTTPS with Authorization: Bearer <token>; no session handshake is required.
Permission modes and presets
- Auto – the tool runs immediately and is logged.
- Approval – the AI’s request is stored as an approval card with the exact change; nothing happens in your store until you approve it. Cards expire after 24 hours.
- Blocked – the AI receives a clear denial and the attempt is logged.
Safe runs reads automatically, every change needs your approval and destructive actions are blocked. Balanced runs routine changes automatically, high-risk changes need approval and critical actions stay blocked. Autonomous runs everything automatically except critical actions, which still need your approval.
Plans
- Free – read-only access: analyse products, orders, customers and content.
- Starter – all write capabilities for products, content, inventory and orders; pages, blog posts and navigation from a prompt; approvals; 90-day activity log.
- Pro – everything in Starter plus whole pages and storefront sections from one prompt (theme sections, templates and styles on a development theme, published after your approval), refunds, bulk edits, translations, product deletion and a 365-day activity log.
Starter is $19.90 a month or $199 a year, Pro $49.90 a month or $499 a year – yearly billing includes two months free. Paid plans start with a 7-day free trial and are billed through Shopify; you can switch between monthly and yearly billing, upgrade, downgrade or cancel at any time on the Billing page.
Troubleshooting
The app does not load inside the Shopify admin
The app is served from app.mcpcommand.app. If the page stays blank or shows a certificate or “blocked” message, a firewall, web filter or TLS-inspecting proxy on your network is intercepting it (a common reason is that the domain is new and not yet categorised). Ask your IT to allow app.mcpcommand.app and mcp.mcpcommand.app, including an exception from HTTPS/TLS inspection. Opening the admin from a different network (for example a phone hotspot) confirms the cause. Shopify itself and cloud-based AI clients such as Claude and ChatGPT are not affected.
An AI client cannot connect or gets “access denied”
Start the connection from Connections in the app, in the same browser you use for the Shopify admin. For Gemini and other token-based clients, create a fresh configuration; a token that was revoked on the Connections page stops working immediately. Write tools need at least the Starter plan, theme tools need Pro.
A request shows up as “approval required” or “denied”
That is the permission system doing its job: check Permissions for the capability named in the result. Approval cards wait 24 hours under Approvals; denied attempts are listed under Activity with the reason.
Support
Questions or problems? Write to support@mcpcommand.app. Please include your store domain and, if relevant, the entry from the activity log.