- 13 of 14 tools are read-only; update_product_attribute is the sole write tool.
- get_revenue and get_revenue_by_country hard-code currency: 'USD' at mcp-server.js:911 and :1228, mislabeling every revenue figure on non-USD stores.
- fetchAllPages() (mcp-server.js:258-299) pages Magento orders 100 at a time with no cap, and backs all four analytics tools.
- Auth is a single MAGENTO_API_TOKEN from Magento Admin → System → Integrations; install requires a build step (npm run build) per the record's install string, not a bare npm install.
- The repo's default branch hasn't been committed to since 2025-04-22.
01 What magento2-mcp is and who ships it
The Magento MCP server worth installing right now is boldcommerce/magento2-mcp — the only community project bridging MCP clients to a Magento 2 store's admin REST API — and the fact that should shape how you use it sits inside its own source: get_revenue and get_revenue_by_country hard-code currency: 'USD', with the in-source comment "This should be dynamically determined from the store configuration" still unresolved (mcp-server.js:911, :1228), so every revenue, AOV and tax figure the server returns is mislabelled on any non-USD store. Use it for read-only catalog, stock and product-attribute lookups over MCP. Don't use it for revenue or financial reporting on a non-USD store, and don't expect order or customer writes — the only mutation tool in the whole surface is update_product_attribute.
Bold Commerce ships magento2-mcp as a community project, not a first-party Adobe/Magento release — the repo describes itself simply as "A MCP server for Magento 2." Public record and source read on 2026-07-28 puts it at 60 GitHub stars, 24 forks, 2 open issues, not archived, licensed GPL-3.0, with the default branch last committed on 2025-04-22. That's the last commit anyone has made to this project as of today.
02 Tools it exposes: the 14-tool surface, read vs. write
The server registers 14 tools total. Thirteen are reads; update_product_attribute is the only tool that writes anything back to Magento — no order or customer mutation tool exists anywhere in the surface.
| Tool | What it does | Read/Write |
|---|---|---|
get_product_by_sku | Looks up a single product by SKU | Read |
get_product_by_id | Looks up a single product by internal ID | Read |
search_products | Searches the catalog | Read |
advanced_product_search | Runs a filtered/multi-criteria product search | Read |
get_product_categories | Returns a product's category assignments | Read |
get_related_products | Returns related-product associations | Read |
get_product_stock | Returns stock/inventory data for a product | Read |
get_product_attributes | Returns a product's attribute set | Read |
update_product_attribute | Writes a new value to a product attribute | Write |
get_customer_ordered_products_by_email | Returns products a customer has ordered, by email | Read |
get_order_count | Counts orders via fetchAllPages() | Read |
get_revenue | Sums order revenue via fetchAllPages(); hard-codes currency: 'USD' | Read |
get_revenue_by_country | Sums order revenue by country via fetchAllPages(); hard-codes currency: 'USD' | Read |
get_product_sales | Sums per-product sales via fetchAllPages() | Read |
Nine tools cover the product catalog, one covers customer order history, one is the sole write path, and four are order/revenue analytics — the last group is also the group with the source-level problems covered in section 04.
03 Install and auth: stdio transport, token setup
Transport is stdio — the client spawns node mcp-server.js as a child process rather than connecting over HTTP or SSE. Auth is a single Magento integration token: MAGENTO_API_TOKEN — integration token from Magento Admin → System → Integrations. The install string, quoted verbatim from the record, is:
clone + npm install + npm run build; set MAGENTO_API_URL and MAGENTO_API_TOKEN
That means a build step is required: clone the repo, run npm install, then npm run build, then set the MAGENTO_API_URL and MAGENTO_API_TOKEN environment variables before the client spawns the server.
04 What the source shows: hard-coded USD and unbounded pagination
This is the reason to read the code instead of the README. Public record and source read on 2026-07-28, against mcp-server.js:851-935 and mcp-server.js:1149-1250, shows that both get_revenue and get_revenue_by_country build their result objects with a literal currency: 'USD' field — at mcp-server.js:911 and mcp-server.js:1228 — each carrying the same trailing comment: "This should be dynamically determined from the store configuration." The dollar amounts those fields label aren't test data; they're sums of Magento's own order.grand_total and order.tax_amount values, pulled straight from the store's order records. On any Magento store that doesn't invoice in US dollars, every number get_revenue and get_revenue_by_country return is labeled with the wrong currency while the underlying figure is correct in the store's actual currency. The README presents get_revenue as a plain revenue-analytics tool and says nothing about this.
The second finding sits in mcp-server.js:258-299: fetchAllPages(), the function backing all four analytics tools, pages Magento orders 100 at a time (const pageSize = 100;) inside a do { ... } while (true); loop with no page cap and no timeout — it only stops once the accumulated item count reaches the API's reported total_count or a short page comes back. Every call to get_revenue, get_order_count, get_product_sales, or get_revenue_by_country runs through this same unbounded loop, so a wide date-range query on a store with a large order history issues one Magento REST call per 100 orders with nothing in the code to bound how many pages that becomes.
05 Quirks, gaps and the honest verdict
- Abandoned — the default branch has had no commits since 2025-04-22, the stalest server in this category.
- No order or customer writes —
update_product_attributeis the only mutation tool in the entire 14-tool surface. - Revenue tools mislabel currency —
get_revenueandget_revenue_by_countryboth hard-codecurrency: 'USD'(mcp-server.js:911, :1228), with the fix left as a source comment rather than shipped. - Unbounded pagination —
fetchAllPages()(mcp-server.js:258-299) has no page cap, and every analytics tool depends on it.
Adobe's own first-party MCP tooling doesn't close this gap — its App Builder developer agent and dropins MCP server target extension developers and storefront components, not the Magento 2 admin REST/GraphQL surface store operators want an assistant querying. That leaves boldcommerce/magento2-mcp as the only option on that axis, abandoned repo and all.
The verdict stands: use boldcommerce/magento2-mcp for read-only Magento 2 catalog, stock and product-attribute lookups over MCP. Don't use it for revenue or financial reporting on any non-USD store, and don't expect order or customer writes. Unless your store invoices in USD and you only need catalog and stock reads — then the abandoned-repo risk and the currency bug are both moot, and the 13 read tools cover the ground cleanly.
07 Frequently asked questions
- Is there a first-party Magento MCP server from Adobe?
- No. Adobe ships first-party MCP surfaces — an App Builder developer agent and storefront drop-in tooling via a dropins MCP server — but none of them is a store-operations MCP over the Magento 2 admin REST/GraphQL surface; that gap is filled only by the community project boldcommerce/magento2-mcp.
- Can magento2-mcp write orders or customers?
- No. Of its 14 tools, only update_product_attribute performs a write; there is no order or customer mutation tool in the surface.
- Is get_revenue safe to use for financial reporting?
- Not on a non-USD store. Both get_revenue and get_revenue_by_country hard-code currency: 'USD' in their result objects (mcp-server.js:911, :1228), with an in-source comment noting the value should come from store configuration instead.
- What auth does magento2-mcp require?
- A single MAGENTO_API_TOKEN, generated as an integration token from Magento Admin → System → Integrations.
- How actively maintained is magento2-mcp?
- As of the 2026-07-28 read, the default branch has had no commits since 2025-04-22, with 2 open GitHub issues and 60 stars.