Shopify MCP Explained: How AI Assistants Read Your Catalog

"Storefront MCP" is the name Shopify first gave to its MCP endpoints for stores. If you search for it today, you will find guides that describe tools which no longer work the way they were described. This article explains what the name covers now, how an AI shopping assistant reads a catalog through it, and what merchants can do with that knowledge.

A quick definition first. MCP (Model Context Protocol) is an open standard that lets AI assistants connect to external tools and data. A store exposes an MCP server, and an AI app (the client) calls the tools that server offers. If you want the basics, see our guide What Is MCP? A Plain-English Guide for E-commerce Merchants.

Is Shopify Storefront MCP still the right name?

Partly. According to Shopify's migration documentation, the catalog and cart tools that lived on https://{shop}/api/mcp were removed. Shopify points developers to the Universal Commerce Protocol (UCP) instead. The same capabilities now sit at https://{shop}/api/ucp/mcp.

A practical way to read the situation:

• Storefront MCP is the original name.
• Storefront Catalog MCP and Cart MCP on the UCP endpoint are its successors.
• Checkout MCP is documented under Shopify's "Agentic commerce" section.
• A shop policies and FAQs tool remains on the legacy endpoint, according to a third-party source.

Shopify now documents catalog, cart and checkout tools under agentic commerce rather than under the old Storefront MCP pages. When a guide mentions search_shop_catalog, treat it as out of date. A third-party crawl found that this tool returns "Tool not found".

How does an AI assistant read your catalog?

The assistant does not browse your theme. It sends structured requests to a catalog endpoint and gets structured data back. Shopify offers two catalog interfaces, both conforming to UCP:

	Global Catalog	Storefront Catalog
Scope	All Shopify merchants	A single store
Endpoint	https://catalog.shopify.com/api/ucp/mcp	https://{storeDomain}/api/ucp/mcp
Authentication	Agent profile, no API key needed	Agent profile, no API key needed
Typical use	Cross-store product discovery	Shopping inside one merchant's store

Both expose three tools, per Shopify's documentation:

1. search_catalog: free-text search with filters. On a single store it uses cursor-based pagination, with a limit between 1 and 250 results (default 10).
2. lookup_catalog: fetches products by ID. The Global Catalog resolves up to 50 identifiers per request, the Storefront Catalog up to 10.
3. get_product: returns the details of one product.

The Global Catalog clusters results by Universal Product ID (UPID), so the same product sold by several merchants can be grouped together. Storefront search is limited to one shop.

What product data does the assistant actually see?

Shopify's documentation says search responses carry a UCP metadata envelope, and each product includes:

• Title and description
• Price range (in minor units, so cents rather than dollars)
• Media
• Variants

The Global Catalog also supports filters. Shopify's example includes ships_to, ships_from, price, available, attributes, rating and price_tier. Rating filters use a 0 to 5 scale with a minimum score and a minimum review count.

Requests can also carry context, such as a shopper's country (address_country) and a free-text intent, which describes what the shopper is trying to do. The doc examples show both.

The consequence for merchants is simple. The assistant can only work with what is in your Shopify data. A product with a thin description, unclear variants or missing attributes gives the assistant little to match against a shopper's request.

What is an agent profile, and why does it matter?

Every request to the /api/ucp/mcp endpoint must include a meta.ucp-agent.profile value. This is a URL that points to the agent's UCP profile, a document in which the AI agent describes who it is and which capabilities it supports. The tools returned depend on the capabilities the agent advertises.

For developers, Shopify says they do not apply for UCP access. They register an agent profile in the Developer Dashboard and call the public endpoint. A third-party test found that a call without a profile returned HTTP 422 "Missing profile uri", and that no bearer token was needed.

Some third-party sources describe rate-limit tiers (anonymous traffic at the lowest limits, a signed tier using HTTP signatures). Check the tier names in Shopify's official documentation before relying on them.

For a merchant, this means you do not hand out credentials to let an assistant read your public catalog. It also means agents are identifiable by profile, not anonymous scrapers.

What about the cart and checkout?

Reading a catalog is the first step. Shopify's Cart MCP on the UCP endpoint covers the next one. According to the changelog, it implements dev.ucp.shopping.cart (version 2026-04-08) with four tools: create_cart, get_cart, update_cart and cancel_cart.

Details worth knowing:

• update_cart uses PUT semantics. Each request replaces the full cart state, so the agent must send the complete line_items array. Sending only a changed line would overwrite the cart.
• Every request needs the meta object with the agent profile.
• cancel_cart also needs an idempotency key (a UUID). This prevents the same cancellation from being applied twice if a request is repeated.

A community demo repository lists a Checkout MCP tool set (create, get, update, complete and cancel checkout). That repository is not official, so confirm tool names against Shopify's Checkout MCP documentation.

How do agents find the endpoint?

For the Customer Accounts MCP, Shopify documents discovery through /.well-known/customer-account-api, which returns an mcp_api value such as https://{shopDomain}/customer/api/mcp.

For catalog and cart, the community demo repo says Cart MCP is discovered via /.well-known/ucp. That is not an official statement, and one third-party claim about advertised UCP versions was not something we could verify. Check Shopify's UCP documentation for the current discovery method.

What about deprecation dates?

Sources disagree, so stick to the official one. Shopify's changelog says the deprecated get_cart and update_cart tools on /api/mcp would be maintained until August 31, 2026, and after that "will no longer be supported". Other guides give different dates (April, May, or August), and we do not rely on them.

The official wording leaves one question open: whether the tools stop responding after that date or are merely unsupported. A third-party crawl on 15 September saw old tools still answering with a deprecation notice, but that is a snapshot, not a guarantee. If you or an agency built anything on the old endpoint, move it to the UCP endpoint rather than waiting to see what breaks.

The policies and FAQs tool is a separate case. A Shopify forum reply indicated the UCP spec did not define a policies capability, so that tool had no migration path at the time. This may have changed, so verify it.

What should a merchant do about this?

You probably do not need to configure anything to be readable. The work is mostly about data quality and awareness:

1. Audit product titles and descriptions. Write them so a machine can match them to a request: materials, sizes, use cases, compatibility.
2. Check variants and availability. Accurate options and stock status matter because filters like available exist.
3. Fill in attributes. Structured attributes are easier for an agent to filter than text buried in a description.
4. Review shipping and policy pages. Shoppers ask about returns and delivery. Keep this information clear and current.
5. Ask your agency or developer which endpoint any custom integration uses. If it still calls /api/mcp for catalog or cart, it needs migration.

For a comparison with conventional integrations, see MCP vs API: What Changes for Online Stores and Agencies.

What can this not do?

• It does not guarantee your products appear in an AI assistant's answers. How an assistant ranks or chooses products is up to the assistant.
• It does not give the assistant access to private data such as your margins or customer lists through the catalog tools.
• It does not replace your own tracking. Whatever sales come from AI assistants still need to be measured properly.
• Whether and how a store is included in the Global Catalog, and what controls merchants have, should be checked in Shopify's documentation. We have not confirmed it.

The tooling is moving quickly, and names, versions and dates have changed within months. Treat any guide, including this one, as a snapshot and check shopify.dev before building.