Shopify

The six MCP tools for a connected Shopify store, why all six need the publish scope including the reads, and what no revision history means.

Six MCP tools work on a connected Shopify store: three that read it and three that change it. All six require the publish scope, including the three that only read, so a read-only credential cannot call any of them. Every write dry runs first and is verified by reading the value back, because Shopify keeps no revision history and there is no undo.

Tool	Scope	What it does
`shopify_create_redirect`	publish	Creates a URL redirect on a live Shopify store, so an address that now returns not found sends readers and search engines to the right page. Shopify only follows a redirect while the old address is genuinely gone and deletes it again by itself if that address starts working, so pass what the old address currently returns and let the tool refuse a redirect for a page that still loads. It dry runs by default and reads the redirect back to confirm it.
`shopify_describe_store`	publish	What a connected Shopify store is, and what RankX AI is actually permitted to change on it. Call this before any other Shopify tool: a Shopify app is granted its permissions when it is installed, so a store can be connected and still refuse every write, and this is the only way to know before trying.
`shopify_diagnose`	publish	Everything RankX AI can see wrong with a connected Shopify store: products invisible to shoppers and assistants, missing or over-long SEO titles and descriptions, thin descriptions, missing categories and brands, and images with no alt text. Every count states what it was measured against, so report the denominator beside it rather than the bare number.
`shopify_list_products`	publish	Lists products on a connected Shopify store with their SEO title, meta description, category, vendor and whether they are really published to the online store. It reads and never writes, and it still needs the publish scope like every other Shopify tool, so a read-only grant cannot call it.
`shopify_update_alt_text`	publish	Sets the alt text of an image in a connected Shopify store, which is the only description of that image an assistant or a screen reader can read. Shopify keeps no version history for files, so the previous text survives only in RankX AI's own record. It dry runs by default and reads the value back to confirm the write. A decorative image should be cleared explicitly rather than sent an empty string, which is refused.
`shopify_update_seo`	publish	Sets the SEO title or meta description of a Shopify product, collection, page or article, on a live and publicly visible store. Shopify keeps no revision history, so there is no undo beyond writing the old value back, and a write whose current value cannot be read first is refused. It dry runs by default and reads the value back to confirm the write.

The table above is generated from RankX AI itself rather than written by hand, as at 8 September 2026 (source 43d562be). When the product changes, this page changes with it.

Call `shopify_describe_store` first

A Shopify app is granted its permissions when it is installed, so a store can be connected and still refuse every write. shopify_describe_store reports the scopes the store's app actually granted and says plainly which capabilities they do and do not cover.

This is the only way to know before trying. Without it, an assistant discovers a missing permission as an access-denied failure three tool calls into a job, which reads as a bug in RankX AI rather than as a reinstall the merchant needs to do.

All six need the `publish` scope, including the reads

shopify_list_products and shopify_diagnose change nothing, and they still sit behind publish. That is deliberate, and it is the same rule the WordPress tools follow.

Scopes are immutable at issue. A token granted before these tools existed was granted on the understanding that everything it could do was reversible and happened inside RankX AI. These tools reach a live, publicly visible store using the merchant's own stored credential, and one of them enumerates a whole catalogue. Folding the reads into read would have handed every token already in the wild a capability its owner never agreed to and which could not be withdrawn without revoking the token.

The practical consequence is worth stating, because it looks like a bug and is not: a client holding only read will be told shopify_list_products does not exist. A tool outside a token's scopes is omitted from the tool list entirely rather than refused, so the fix is a credential carrying publish, not a retry.

Shopify keeps no revision history, so there is no undo

WordPress writes can point at a native revision, and wp_list_revisions will show you what an edit can be rolled back to. Shopify has no equivalent. Once a value is overwritten on a Shopify store, the previous value exists only in RankX AI's own record of the write.

Three consequences, all of which the tools enforce rather than merely warn about:

Writes dry run by default. The dry run reports the exact before and after, and applying it is a second, deliberate call.
A write whose current value cannot be read first is refused. Without a reliable read, RankX AI cannot record what to put back, so it does not proceed.
Every write is verified by reading the value back, and the result says whether that verification succeeded rather than assuming a successful API call means a changed store.

What `shopify_diagnose` measures, and against what

shopify_diagnose is the read that finds work worth doing: products invisible to shoppers and to assistants, meaning unpublished, draft, archived or out of stock; missing or over-long SEO titles and descriptions on products and collections; thin descriptions; missing categories and brands; and images with no alt text.

Every count states what it was measured against, and the denominator is part of the answer rather than a footnote. "Twelve products missing a meta description" means something different out of 15 than out of 1,500, and a bare number invites the wrong one.

A Shopify redirect only works on an address that is really gone

shopify_create_redirect is the one capability of its kind on any platform RankX AI connects to, because Shopify exposes redirects as readable objects. Two platform rules change what success means, and both are stated in the tool's own output:

Shopify only follows a redirect while the original address genuinely returns not found. A redirect created for a page that still loads is inert, and must never be reported as a fix.
Shopify deletes a redirect by itself if its path starts working again. So a redirect verified today is not verified forever.

Pass what the old address currently returns and the tool will refuse to create a redirect for a page that still loads. Without that, nothing checks, and the redirect may be created and then removed by Shopify as soon as it notices. Redirect targets must be on the same store.

Alt text is the one field with a route through the empty-value guard

shopify_update_alt_text sets the alt text of an image in the store's files, which is the only description of that image an assistant or a screen reader can read. Describe what is in the picture rather than repeating the product name.

An empty value is refused on every writable field, alt text included, because on Shopify an empty string does not mean "leave it alone", it means "delete what was there". A blank description wipes a product's whole description; a blank SEO title reverts the page title to the theme's default.

Alt text is the field where clearing is nonetheless a legitimate thing to want, because a purely decorative image should have none. So it is the one with a deliberate route through the guard: ask for the clear explicitly rather than sending an empty string. The distinction that route exists to preserve is that a model which returned nothing and a person deliberately clearing a field look identical at the moment of the write, and only one of them should succeed.

Shopify keeps no version history for files either, so the previous alt text survives only in RankX AI's record.

Example prompts

"What is RankX AI actually allowed to change on my Shopify store?"

"Find every product on my Shopify store with no meta description, and tell me how many products that is out of."

"Show me the before and after for setting the SEO title on this collection, but do not apply it yet."

"Which images in my Shopify files have no alt text?"

Where to go next

WordPress and WooCommerce, the other surface that edits a live public website, and the five rules both obey.
Authentication, for what publish reaches and why a missing tool is almost never a bug.
Integrations, for what each connection covers outside the MCP surface.
Examples, for whole tool sequences rather than single calls.

Last updated 8 September 2026

Shopify

On this page