| Question | Answer |
|---|---|
| Is it safe? | Yes, through an official OAuth connection with the right access and you approving changes |
| Safest way to connect | Shopify's own connector in Claude, or a read-only MCP server |
| Riskiest way | Sharing your Shopify login, or pasting a long-lived admin token into a tool you don't know |
| What Shopify blocks for AI tools | Refunds, cancelling orders, payments, gift cards, your live theme, store settings |
| How to revoke | Uninstall the integration in Shopify admin, then disconnect it in your AI tool |
The short answer
Connecting AI to Shopify is about as safe as installing an app, because it works the same way. You approve a list of permissions, the tool gets a token limited to that list, and you can take it back.
The risk sits in two places. The access you hand over (write access lets the AI change things, and AI makes mistakes). And the route you use (a password or a raw token skips every guardrail Shopify built).
What can actually go wrong
It changes the wrong thing. With write access, an AI tool can edit products, prices, inventory and discount codes. Shopify says plainly that "AI outputs can contain errors" and that you're responsible for any change the tool makes (Shopify Help). Its own connector changes items one at a time, so a large batch can stop halfway.
Someone else's text steers it. This is prompt injection: an attacker hides instructions in text the AI reads, hoping it follows them (Claude Code docs). Anthropic warns that a malicious MCP server "may include hidden instructions that try to make Claude perform unintended actions" (Claude Help). A store is full of text other people wrote, from customer notes to product data from suppliers. Read-only access limits what a steered agent can do.
Your data leaves Shopify. Once you share data with an AI tool, Shopify says it's "no longer processed by Shopify" and falls under that company's terms. You stay responsible for GDPR and CCPA compliance on your customers' data.
A token leaks. Custom apps made in Shopify admin hand you an admin token, shown once (Shopify.dev). You can't create new ones anymore, but old ones still work, and a non-expiring token stays valid until the app is uninstalled or its credentials are revoked (Shopify.dev). Paste one into the config file of an MCP server you found on GitHub, and that code runs on your machine with your store's keys. The MCP spec lists arbitrary code execution and data exfiltration as the risks of untrusted local servers (MCP spec).
Too much access, granted once. On Shopify, any write scope also grants read access to that data (Shopify.dev). A tool that asks for write access to everything "just in case" turns a small mistake into a big one.
Safe vs risky ways to connect, side by side
| Way to connect | Risk | Why |
|---|---|---|
| A read-only MCP server over OAuth | Low | It can read, never change. Revoke any time |
| Shopify's connector in Claude | Low to medium | OAuth, limited by your permissions, risky actions blocked. Write access is up to you |
| Shopify AI Toolkit in Claude Code | Medium | You pick the scopes. Changes are off unless a command runs with --allow-mutations (Shopify CLI) |
| A third-party MCP server from GitHub with an admin token | High | Long-lived token with broad scopes, in a file, run by code you didn't review |
| Your Shopify login given to an AI or a person | Highest | Shopify says to keep credentials private and add staff accounts instead (Shopify Help) |
| Any connection with every write tool on "Always allow" | High | No human sees a change before it happens |
Shopify blocks the riskiest actions for AI tools whatever you approve: refunds, cancelling or capturing orders, marking orders as paid, returns, gift cards, editing or publishing your live theme, and changing your plan, payments, taxes or domains (Shopify Help). A password or a raw admin token doesn't come with those blocks.
How to do it safely
1. Use an official route
Connect Shopify from Claude's directory, or a vendor's own MCP server that signs you in with OAuth. Anthropic's advice is to "only connect Claude to servers built and hosted by organizations and applications you trust." Shopify asks the same: use its official integrations, not its MCP endpoint added by hand (Shopify).
2. Read the approval screen
When you connect, Shopify shows the access the tool requests and makes you approve it in your admin. Read-only access lets the tool view data. Write access lets it edit data and act on your behalf (Shopify Help). If you only want answers, don't approve write access. If the tool asks for more later, Shopify prompts you again.
3. Connect with the right staff account
The tool can never do more than the person connecting it. Shopify's example: a user who can read product data but can't edit it can't give the tool the ability to edit it. A staff account with narrow permissions makes a safer connection than the owner account.
4. Keep a human on every write
The MCP spec says there should always be a human in the loop who can deny a tool call (MCP spec). In Claude, set each tool to Always allow, Needs approval or Blocked (Claude Help). Put write tools on Needs approval, and only click "Allow always" for tools you trust.
5. Never share a password or paste a token
Shopify Support never asks for your password, and neither should an AI tool. Turn on two-step authentication. If an old custom app holds an admin token you've pasted somewhere, uninstall it.
6. Check what it did, then revoke what you don't use
In Shopify admin, go to Settings, then Apps, and open the app. "Activity and permissions" shows which areas it can view or edit, when it last touched each one, and access it hasn't used in 30 days (Shopify Help). Settings, then General, then Store activity log shows which person or app made each change, up to the last 250 entries (Shopify Help). To revoke, uninstall the integration from your admin and disconnect it in Claude under Customize, then Connectors. After an uninstall, Shopify sends the developer a request to erase your customers' personal data within 48 hours (Shopify Help).
What Anry can and can't touch
Anry is a remote MCP server for Claude, Claude Code and Cursor. You sign in with OAuth 2.1, and it has 16 tools. Every one is read-only and declares it in its MCP metadata (Anry docs).
| Anry can read | Anry can't |
|---|---|
| Visits, pages and traffic sources | Edit products, prices, inventory or discounts |
| Meta and Google spend per campaign and ad, next to the orders it brought | Touch orders, refunds, customers or your theme |
| Where money leaks, and what each leak costs | Change a campaign, budget or ad |
| Visitor sessions, scroll depth and clicks on a page | Change any setting, in Anry or in your ad accounts |
The 16 tools: list_sites, get_site_status, get_analytics_overview, get_top_pages, get_traffic_sources, get_campaign_spend, get_paid_waste_summary, get_revenue_leaks, get_issue, list_opportunities, get_report, list_reports, list_questions, list_sessions, get_session, get_heatmap_summary.
When Anry finds a leak, it writes the suggested fix and hands it to your own agent ("Ask Anry"). Your agent proposes the change, you approve it. Anry never pushes a change itself. To revoke it, disconnect it in your MCP client.
Where Anry fits
Anry follows each ad click to the visit and the order, finds where money leaks, and prices each leak in your store's own orders. Because it can't change anything, the write-access risks above don't apply, which matters when you connect it to every client store. If you only want to manage products and orders from a chat, Shopify's own connector is enough and you don't need Anry.
Frequently asked questions
Can an AI tool change my Shopify store?
Only if you approve write access. Then it can edit products, inventory, collections and discount codes. Shopify blocks refunds, order cancellations, payments, gift cards, the live theme and store settings for AI tools either way.
How do I see which apps and AI tools have access to my store?
In Shopify admin, go to Settings, then Apps, and open an app. "Activity and permissions" shows what it can view or edit and when it last used that access.
How do I remove an AI tool's access to Shopify?
Uninstall the integration from your Shopify admin, then disconnect it in the AI tool. To reduce access without removing it, Shopify says you have to uninstall and reconnect.
Should I give an AI agent my Shopify password?
No. Shopify says to keep login credentials private and to add staff accounts instead of sharing yours. A password gives whoever holds it everything your account can do, with no permission screen.
What is prompt injection?
Text written to steer an AI into doing something you didn't ask, hidden in a web page, a document or a tool's output. Read-only tools and human approval on every change limit the damage.
Sources
- Considerations for using third-party AI tools and Authorizing AI tool access, Shopify Help Center
- Managing apps, App personal information and Store activity log, Shopify Help Center
- Account security best practices, Shopify Help Center
- Access scopes, access tokens and store execute, Shopify.dev
- Shopify merchant onboarding skill, Shopify
- Tools and Security best practices, Model Context Protocol specification
- Custom connectors using remote MCP and Use connectors, Claude Help Center
- Security, Claude Code docs
- Anry MCP server docs
See which ad clicks leave your store before they buy.
14-day free trial, no card. Works in Claude, Claude Code and Cursor.