Our grade: 4 checks
Based on public data, not a full audit. See how we grade. Something changed? Request a re-grade.
Community rating
- 5 0
- 4 4
- 3 3
- 2 0
- 1 0
Trust in production
- Trust it - 14%
- With caveats - 57%
- Wouldn't - 29%
57% would recommend this server
How reviewers scored it
- Setup & docs 3.9
- Auth experience 3.1
- Reliability 3.6
- Maintainer responsiveness 4.3
Why it got a C
Shopify's own developer server, run locally over stdio. It searches shopify.dev docs and API schemas and checks GraphQL, Liquid, theme and UI extension code. It never touches a store and needs no login. Shipped releases are frequent (1.18.0 in October 2026) with no advisories on record. Watch out: published builds send usage events to Shopify by default, and these can include your tool inputs and results. Opt out with OPT_OUT_INSTRUMENTATION=true. Biggest deduction: there's no auth at all, and no public source repo, only the npm package.
How to connect
// Cursor Settings > Tools and MCP > New MCP server
{
"mcpServers": {
"shopify-dev-mcp": {
"command": "npx",
"args": ["-y", "@shopify/dev-mcp@latest"]
}
}
}// user mcp.json (Command Palette > MCP: Open User Configuration)
{
"servers": {
"shopify-dev-mcp": {
"command": "npx",
"args": ["-y", "@shopify/dev-mcp@latest"]
}
}
}# Shopify AI Toolkit guide; restart Claude Code afterwards
claude mcp add --transport stdio shopify-dev-mcp -- npx -y @shopify/dev-mcp@latestIs Shopify Dev MCP safe?
Is Shopify Dev MCP safe to use?
Shopify Dev MCP grades C (usable with care). There is no login: anything that can start or reach it gets its full access. It runs locally over stdio, so it acts with your machine's access.
Does Shopify Dev MCP have known vulnerabilities?
Not in our current data: it has no open CVEs or advisories. We re-check as new ones are published.
Does Shopify Dev MCP support authentication?
No. It has no login of its own, so limit who and what can start it.
Alternatives in Developer Tools
- A Atlassian Rovo MCP ServerOfficial hosted Atlassian server for Jira, Confluence, Jira Service Management, Compass, Bitbucket, Loom, Goals, Projects, and Teams, with OAuth 2.1 sign-in.
- A Buildkite MCP ServerOfficial Buildkite server for pipelines, builds, jobs, logs, annotations, and Test Engine data, hosted or local.
- A Dynatrace Remote MCP ServerDynatrace's hosted MCP server, running inside your Dynatrace SaaS environment, to run and explain DQL, look into problems, vulnerabilities and Kubernetes events, and forecast time series.
- A GitHub MCP ServerOfficial GitHub server for repos, issues, pull requests, Actions, and code security, hosted or local.
- A GitLab MCP ServerGitLab's built-in MCP server for projects, merge requests, work items, code, and CI pipelines, on GitLab.com or your own instance.
Embed this badge
[](https://trustedmcp.io/servers/shopify-dev-mcp)<a href="https://trustedmcp.io/servers/shopify-dev-mcp"><img src="https://trustedmcp.io/badge/shopify-dev-mcp.svg" alt="TrustedMCP grade C" height="80"></a>Community reviews
Recommended it to two teams already
Simple to set up in Cursor, simple to reason about. Runs locally over stdio, so startup is instant and nothing leaves my machine unless a tool calls out.
Used for Looking up Shopify Dev data without leaving the editor
- Setup & docs 5/5
- Auth experience 3/5
- Reliability 4/5
- Maintainer responsiveness 3/5
Fine once configured properly
It does the job, but it took some tweaking. Nice to use something maintained by Shopify rather than a random fork. No access control at all, it runs with my permissions. Fine on my laptop, not on a shared box. Keep permissions tight and it is a good tool.
Used for Internal developer assistant
- Setup & docs 3/5
- Auth experience 3/5
- Reliability 3/5
- Maintainer responsiveness 4/5
Exactly what I needed from Shopify Dev
Hooked Shopify Dev MCP into Claude Code and it worked on the first try. Nice to use something maintained by Shopify rather than a random fork. Worth it, just do not skip the hardening steps.
Used for Generating boilerplate from existing patterns
- Setup & docs 4/5
- Auth experience 3/5
- Reliability 4/5
- Maintainer responsiveness 4/5
Good, but read the permissions first
Useful tool, though I would not hand it to a junior unsupervised. Nice to use something maintained by Shopify rather than a random fork. Nothing stops a misbehaving agent from using every tool it exposes, so I trimmed the tool list. Releases come often and the changelog is clear. Not something I would put in production yet.
Used for Onboarding new devs with an agent that answers repo questions
- Setup & docs 4/5
- Auth experience 3/5
- Reliability 3/5
- Maintainer responsiveness 5/5
Does what it says, no drama
Started with it as an experiment, now it is a fixture. You can tell it is actively maintained, the rough edges keep getting fixed.
Used for Automating release notes
- Setup & docs 4/5
- Auth experience 3/5
- Reliability 5/5
- Maintainer responsiveness 5/5
Surprisingly polished
Our agents call this dozens of times a day. Runs locally over stdio, so startup is instant and nothing leaves my machine unless a tool calls out.
Used for Code review summaries for pull requests
- Setup & docs 4/5
- Auth experience 4/5
- Reliability 4/5
- Maintainer responsiveness 5/5
Works, just lock it down
Good for experimenting, still deciding about production. Nothing stops a misbehaving agent from using every tool it exposes, so I trimmed the tool list. Being official from Shopify counts for a lot when I pitch it to security. I will check back in a few releases.
Used for CI failure investigation
- Setup & docs 3/5
- Auth experience 3/5
- Reliability 2/5
- Maintainer responsiveness 4/5
Write a review
Ran this server? Tell other teams how it went. You get one review per server. We email you a link to confirm it, then an editor checks it before it goes up. We never show your email.