Free Shopify MCP server launches with per-scope access control and 45-minute token rotation
shaafiee · reddit · 2026-11-09
A developer released Datanexus for Shopify: a free hosted MCP server that gives any MCP client (Claude, ChatGPT, Cursor, etc.) access to a store's Admin GraphQL API.
How it works
- Merchants install the app from the Shopify App Store; it runs embedded in the Shopify admin.
- Every Admin API scope Shopify offers is a separate read/write switch, all off by default.
- The app exposes an OAuth client ID/secret to add as a custom connector; the agent runs GraphQL operations and can query which scopes are granted before acting.
Security choices
- The access token rotates every 45 minutes and is reissued on scope changes.
- Only the store name is stored; store data passes through unsaved. Uninstalling wipes everything.
One prompt ("launch a winter range, new collection, gift guide page, welcome discount") goes from nothing to live. Off-Shopify devs can fetch the rotating token via a signed endpoint instead of building their own Shopify app. Free, no paid tier. The author is soliciting feedback on tool-surface design: one generic GraphQL tool vs task-specific tools.
More from coding & agent
- Vercel's agent-browser hits 48k stars: a Rust CLI that reads pages as accessibility trees for AI agents — sven_ai · 2026-11-09
- Same AI, different game: getting answers vs directing engineering work — burhop · 2026-11-09
- Dev builds full-screen voice face for Mac that drives Codex coding agents hands-free — Ok-Suspect-9855 · 2026-11-09
- DeepSeek agent harness wired to a Grok x_search plugin pulls live X posts, demo shows — teortaxesTex · 2026-11-09
- Agent passed its own tests while wrong: lessons from a 2-bit local model building a Unity game — Stunning-Sherbet1853 · 2026-11-09
- 12 GitHub repos poisoned with CLAUDE.md prompt injection tricking AI coding agents into running malware — cyb3rops · 2026-11-09