Best MCP Servers for Shopify: 4 Community Servers, Source-Read

The best Shopify MCP server for Admin API work is cob-shopify-mcp from Callobuzz — but the first thing to know about this whole category is that none of it is drop-in. Reading the install and auth path of all four Shopify community Admin MCP servers on 2026-07-25, no zero-credential install exists: three require an OAuth app you create yourself in the Shopify Dev Dashboard, and shopify-partner-agent requires a Partner API token from the Partner Dashboard. There is no drop-in option at any price. Shopify does ship two first-party MCP surfaces of its own — @shopify/dev-mcp for developer documentation and schema lookup, and the per-store Storefront/Catalog MCP — and they are excluded from this comparison for one reason: neither one operates the Admin API on a merchant store, which is the job every server below is here to do.

01 The pick

cob-shopify-mcp is the one to install for Admin API work. It is the most recently released of the four with a versioned artifact behind it — the GitHub API reported release v0.6.6 on 2026-05-24, matching npm's 0.6.6 publish of the same date — and it is the only server of the four with a documented read-only mode. It also supports three auth methods and carries the widest tool surface at 59 tools. If you want a maintenance argument at all, state it the way the record supports it: it is the only one of the four with a tagged release in the record.

02 How we compared them

Public record and source read on 2026-07-25. Four community servers were in scope — geli2001-shopify-mcp, callobuzz-cob-shopify-mcp, cesarjoquin-shopify-mcp and shopify-partner-agent — because Shopify's own first-party MCP servers cover developer docs and the storefront catalog, not Admin write operations on a merchant store. Nothing here was run, invoked or timed. For each server we read the repository README, the GitHub repository metadata, the npm or PyPI registry entry, and — for three of the four — the server's own source files. Every claim below that carries a path:line citation came out of that source read, and every one of those files is public, so a reader with a browser can open the same line and check it.

03 The shortlist compared

Star counts, repository push dates and tool counts below are as read from the GitHub API, the npm/PyPI registries and each README on 2026-07-25. The freshness column is one quantity throughout: the date of the repository's most recent push as the GitHub API reports it, which for two of these repos is later than the default branch's own HEAD commit date. Pick one basis and stay on it, or you will compare two different numbers under one heading.

On that one basis, two of the four have been quiet for more than three months — geli2001-shopify-mcp since 2026-04-05 and shopify-partner-agent since 2026-04-17 — while Shopify versions its Admin API quarterly. The other two are current.

† cesarjoquin-shopify-mcp's README states a count of 40 tools but never names them — it documents capability categories instead, so the 40 cannot be checked tool by tool the way the other three can. Yes, the pick has the lowest star count in the table but one — that number is printed here rather than buried, because the case for it rests on release discipline and scope control, not popularity.

04 cob-shopify-mcp: why it wins

• Widest surface, narrowest blast radius — 59 tools across products, orders, customers, inventory and analytics, with a read-only mode toggled by COB_SHOPIFY_READ_ONLY=true, which the README documents alongside a 14-scope read-only scope set. It is the only Admin-API server of the four with a documented read-only mode — shopify-partner-agent is read-only throughout, but it is Partner API only and cannot touch a store.
• Three auth methods — static token, OAuth client credentials, and OAuth authorization code. The widest of the four.
• Versioned and shipping — the GitHub API reported release v0.6.6 on 2026-05-24, and npm's latest dist-tag is 0.6.6, published the same day. It is the only one of the four with a tagged release in the record.
• A context-cost story with its own framing — Callobuzz's README puts its 59 tool schemas at ~19,000 tokens per prompt on connect and its single activate_tools meta-tool at ~300, and derives its ~82% reduction from a typical conversation costing ~2,800 tokens instead of ~19,000 — the ~300 is the connect-time cost of the meta-tool, not the conversation total. That mode is opt-in: advertise_and_activate defaults to false in the config schema (src/core/config/schema.ts:32).

Two things the source shows that the README does not. Six read tools — get_order, list_orders, get_product, list_products, get_customer, list_customers — declare an outputFields projection that the MCP server never applies: it is declared at src/core/engine/types.ts:15, consumed only by the CLI's --schema printer at src/cli/converter/tool-to-command.ts:218-220, and absent from the whole MCP execution path at src/core/engine/tool-engine.ts:8-47. And any tool activated through the meta-tool is wrapped in a handler that hard-codes isError: false (src/core/engine/advertiser.ts:88-95), so a dynamically loaded tool cannot signal an error to the client at all — failures come back as ordinary data.

The documented install:

npm install -g cob-shopify-mcp
claude mcp add cob-shopify-mcp -- cob-shopify-mcp start

And the documented read-only toggle:

COB_SHOPIFY_READ_ONLY=true

05 Runners-up and when each beats the winner

Unless you want the most-adopted option and can live with a stale dependency — then geli2001-shopify-mcp, at 229 stars the highest-star community Shopify Admin server, with 31 hyphen-cased tools and six scopes (read_products, write_products, read_customers, write_customers, read_orders, write_orders). Know what you are accepting: its get-products document hard-codes media(first: 1) at src/tools/getProducts.ts:74 and variants(first: 5) at src/tools/getProducts.ts:87, and get-orders hard-codes lineItems(first: 10) at src/tools/getOrders.ts:104 — with no pageInfo selected inside any of those sub-connections. A twelve-variant product and an eleven-line order come back truncated and look complete, and the model has no way to notice. The README also warns the package is shopify-mcp, not shopify-mcp-server, and that creating a product with productOptions registers all option values but creates only one default variant — you must follow up with manage-product-variants using strategy: REMOVE_STANDALONE_VARIANT. Per the same README, as of 2026-01-01 new apps use OAuth client credentials, which the server exchanges for a token valid roughly 24 hours.

npx shopify-mcp --accessToken <SHOPIFY_ACCESS_TOKEN> --domain <store>.myshopify.com

Unless you are an app developer rather than a merchant — then shopify-partner-agent, which is the only Partner API server of the four. Its 25 read-only tools cover MRR movement, cohorts, payouts and churn risk, and it cannot touch a merchant store at all. Treat its derived numbers as the server's model, not Shopify's: shopify-partner-agent's get_merchant_health A–F grade is a rubric hard-coded in the author's own Python whose revenue component saturates at $100 of lifetime revenue — that finding belongs to our shopify-partner-agent write-up, which covers it in full. The churn score is flat point addition — +30 for any deactivation, +20 for any reinstall, +25 for a cancellation in the last 30 days (src/shopify_partner_agent/analytics.py:1422-1444). Install with uvx shopify-partner-agent; it authenticates with a Shopify Partner API access token from the Partner Dashboard.

06 What we'd skip, and the verdict

Skip cesarjoquin-shopify-mcp — and skip it despite the fact that it carries the cohort's most recent repository push, 2026-07-06. Recent activity is not the same as knowing what you are wiring up, and here you do not. Its README states 40 tools but never names one of them — it documents capability categories instead — so you cannot know what it exposes until after you have connected it to a store. Its CLI flags — --accessToken, --clientId, --clientSecret, --domain, --apiVersion — override environment variables, a precedence its README documents at line 191 and a reliable way to point an agent at the wrong store. And it defaults to Admin API version 2026-01 via SHOPIFY_API_VERSION, so if you do run it, pin that explicitly rather than inheriting a default that will drift. Its genuinely distinct feature — optional Redis-backed OAuth token persistence, so restarts do not force re-authentication — is real and useful, but not enough to buy an unknown tool surface and flag precedence that can quietly redirect writes.

The verdict stands: cob-shopify-mcp for Shopify Admin API work, on the strength of a tagged v0.6.6 release on 2026-05-24 matched by an npm publish the same day, a documented read-only mode, three auth methods and 59 tools. Whichever you pick, budget the credential step first — across all four, on the public record and source read on 2026-07-25, there is no server you can start without creating your own Shopify app or Partner token, and check the push date in section 03 before you commit to one, because two of these repositories have been quiet since April.

07 Frequently asked questions

Is there a first-party Shopify MCP server for the Admin API?

Not for merchant-store Admin write operations. Shopify's own first-party MCP servers cover developer docs and the storefront catalog, not Admin write operations on a merchant store. Every server compared here is community-built.

Which Shopify MCP server should I install?

cob-shopify-mcp for Admin API work — 59 tools, a documented read-only mode, three auth methods, and the only tagged release in the cohort (v0.6.6 on 2026-05-24, matched by an npm publish the same day). Use shopify-partner-agent instead if you are an app developer reading Partner API business metrics rather than touching a store.

Can I try any of these without setting up a Shopify app?

No. Reading all four install and auth paths on 2026-07-25, every one requires a credential you create first: a Dev Dashboard OAuth app for the three Admin servers, or a Partner API access token for shopify-partner-agent.

Why does the most-starred server not win?

geli2001-shopify-mcp has 229 stars but its repository has not been pushed to since 2026-04-05, and its source hard-codes variants(first: 5), media(first: 1) and lineItems(first: 10) with no pageInfo on those sub-connections — so oversized products and orders come back truncated while looking complete.

Does cob-shopify-mcp really cut token use by 82%?

Callobuzz's README puts its 59 tool schemas at ~19,000 tokens per prompt on connect and its single activate_tools meta-tool at ~300, and derives its ~82% reduction from a typical conversation costing ~2,800 tokens instead of ~19,000 — the ~300 is the connect-time cost of the meta-tool, not the conversation total. That mode is opt-in — advertise_and_activate defaults to false at src/core/config/schema.ts:32.