MapGraphSeamsCalendarIntroductionDisclosureMethodFor agents and tools

Updated weekly, new versions on Mondays · Corrections: open an issue

Shopify, MCP surfaces for buyer agents, developers and merchants

Industrywork-itemcontext entry

Verified 2026-10-13. Status as of 2026-10-13. All entries.

Seams: S1S4

Status

Three distinct MCP surfaces are documented or published by Shopify: checkout for buyers' agents (server-side Checkout MCP and, since 2026-09-28, Checkout WebMCP), the local developer package @shopify/dev-mcp (latest version 1.16.0, 2026-09-25), and a remote MCP for merchants at setup.shopify.com/mcp. For the merchant surface the source is Shopify's own toolkit repository; no page on shopify.dev was found for it. A fourth surface is for shoppers' agents: the command-line client @shopify/shop (npm, MIT; version 1.0.3 published 2026-10-08, 01:20 UTC, after 1.0.2 on 2026-10-07), whose repository Shopify/shop has its latest commit d1e8c7c on main (2026-10-08, 01:17 UTC); neither the README, the skill file nor the transactions reference declares a beta or preview status or a list of supported countries (not found, 2026-10-13).

Relevance

Buyers' agents: the documentation says "Use Checkout WebMCP when your agent runs in the buyer's browser. If your agent can run on a server, then use Checkout MCP", and that Checkout WebMCP "implements the UCP checkout capability (dev.ucp.shopping.checkout)"; see ucp and browsers-webmcp. Developers: @shopify/dev-mcp is a local npm package (npm registry, read 2026-10-08 and 2026-10-13, version 1.16.0 published 2026-09-25).

Merchants: Shopify-AI-Toolkit v2.1.0 (2026-10-01) states "The Cursor plugin, which Grok Bot also installs from the Cursor Marketplace, now connects to Shopify's remote MCP at setup.shopify.com/mcp"; the file .cursor-plugin/mcp.json at that tag declares an http server with that URL and an auth block with a client id, and v2.1.1 (2026-10-08) changes the plugin description to "Create and manage your store with Shopify". The toolkit release v2.0.1 says "Regenerated agent skills from @shopify/shopify-dev-tools 1.17.1"; the package @shopify/shopify-dev-tools returns E404 on the npm registry (2026-10-08 and 2026-10-13).

Since v2.0.0 the toolkit publishes UCP as a separate skill: the CHANGELOG entry for 2.0.0 reads "UCP ships separately as ucp", and the folder skills/ucp at the tag v2.1.1 (commit 26d0623, 2026-10-08, 00:34 UTC) holds a SKILL.md named ucp whose description begins "Use when the user wants to use the UCP CLI to find, compare, buy, or track products from online merchants" and which requires the binary ucp (read 2026-10-13).

Shopper's agents: the README of Shopify/shop (commit d1e8c7c, read 2026-10-13) says the command-line interface (CLI) "lets agents search millions of stores, build carts, check out and pay with the shopper's Shop account, and track orders" and is a client of Shop's MCP server at mcp.shop.com. It says: "Some stores have no agent checkout API (UCP); the agent has to enter a payment credential into the site's checkout form in a browser." For that case the shopper approves a "spend request" on Shop and the agent receives a one-time credential up to the approved limit; the skill file says "Prefer Shop/UCP checkout when available". The reference skills/shop/references/transactions.md says of the agent's report on the purchase "This records your report, not payment confirmation.", of a credential state "consumed without an instrument does not establish credential delivery or payment.", and of cancelling the request "this does not cancel/refund the purchase or revoke an issued credential." The core of the CLI is a compiled binary (lib/shop.wasm, about 1.9 MB), so its logic is not readable as source; the repository holds nine commits, all of 2026-10-07 and 2026-10-08.

No call was made to any MCP or OAuth endpoint; only documentation, repositories and listings were read.

Committed next

None declared in the sources read.

Author participation

The author of this map opened issue #62 of Shopify/Shopify-AI-Toolkit on 2026-09-26 (release notes and a source link for @shopify/dev-mcp, and two telemetry questions), still without comments on 2026-10-13; see Disclosure.

Sources

Overlaps

Universal Commerce Protocol (UCP), Browser vendor positions on WebMCP (WebKit, Mozilla, Chrome, Edge)

Neighbours in the map

Neighbours of Shopify, MCP surfaces for buyer agents, developers and merchants in the map Each circle is an entry of the map and links to its page; the colour is the kind of body behind it, a filled circle is a core entry and a dashed circle a context entry. The entry in the middle, with the entries it overlaps and the entries named by the same seams. Overlaps (2)Share a seam (22)Browser vendor positions on WebMCP (WebKit, Mozilla, Chrome, Edge) (Independent, core)Browser vendor position… Universal Commerce Protocol (UCP) (Industry, core)Universal Commerce Prot… W3C AI Agent Protocol Community Group (W3C, core)W3C AI Agent Protocol C… S1 DNS for AI Discovery (DNS-AID, draft-mozleywilliams-dnsop-dnsaid) (IETF, context)DNS for AI Discovery S1 IETF DAWN, Discovery of Agents With Names (proposed WG) (IETF, core)IETF DAWN S1 A2A protocol, agent discovery (Linux Foundation, core)A2A protocol S1 AI Catalog (Agent Card Working Group) (Linux Foundation, core)AI Catalog S1 Agent2Agent (A2A) protocol, core specification (Linux Foundation, context)Agent2Agent S1 MCP Server Cards (ext-server-card, SEP-2127) (Linux Foundation, core)MCP Server Cards S1 Model Context Protocol (MCP), core specification (Linux Foundation, context)Model Context Protocol S1 Agentic Resource Discovery (ARD) (Independent, core)Agentic Resource Discov… S1 schema.org vocabulary for products, offers, sellers and lodging (current release) (Independent, context)schema.org vocabulary f… S1 Personal Agent Consent & Trust Protocol (PACT), published by Decagon with Instinct (Industry, core)Personal Agent Consent… S1 S4 Personal Agent Protocol (PAP, "Poppy"), published by Sierra with Meta (Industry, core)Personal Agent Protocol S1 S4 IETF vcon (Virtualized Conversations WG) (IETF, core)IETF vcon S4 Payment HTTP Authentication Scheme (draft-httpauth-payment, Tempo Labs and Stripe) (IETF, context)Payment HTTP Authentica… S4 AAIF Agentic Commerce Working Group (AAIF, core)AAIF Agentic Commerce W… S4 x402 (Linux Foundation, core)x402 S4 EMILIA Protocol (individual drafts and open-source gate) (Independent, context)EMILIA Protocol S4 Agent Payments Protocol (AP2) (Industry, core)Agent Payments Protocol S4 Agentic Commerce Protocol (ACP) (Industry, core)Agentic Commerce Protoc… S4 EMV Agentic Payments Framework for Specifications (draft for public feedback) (Industry, core)EMV Agentic Payments Fr… S4 FIDO Alliance agentic authentication and payments work (Industry, context)FIDO Alliance agentic a… S4 Verifiable Intent (Industry, core)Verifiable Intent S4 Shopify

Solid lines: overlaps declared by one of the two entries. Dashed lines, coloured by seam: entries named by the same seam (S1 to S4) in the seams note. Every node is a link.

Evidence and coverage

Read
Toolkit releases v2.0.0 to v2.1.1 and the two plugin files, shopify.dev pages on Checkout WebMCP, the developer changelog of 2026-09-28 and the MCP developer page, npm registry metadata, issue #62, read 2026-10-08; on 2026-10-13: the list of toolkit releases (latest v2.1.1, 2026-10-08), the CHANGELOG and the folder skills/ucp at the tag v2.1.1, the npm registry entries of @shopify/dev-mcp (1.16.0) and @shopify/shopify-dev-tools (E404), and issue #62 (open, no comments).
Not read
The shopify.dev pages on Checkout WebMCP, the developer changelog of 2026-09-28 and the MCP developer page were not re-read on 2026-10-13 (last read 2026-10-08). help.shopify.com, any merchant-facing page on shopify.com, the telemetry code of the toolkit, the X post of the Shopify product manager on Checkout WebMCP; the compiled binary lib/shop.wasm and the .mjs files of Shop CLI, the server mcp.shop.com (no call made), the plugin files of Shop CLI.
Not found
Not found, 2026-10-08: setup.shopify.com in the shopify.dev pages read (the MCP developer page and the changelog index); a page of Shopify describing the merchant MCP. Not found in the README, SKILL.md and transactions.md of Shopify/shop at d1e8c7c (2026-10-13): beta, preview, experimental, a list of supported countries, and a confirmation sent to the shopper on a durable medium.