Connect Shopify to AI agents over MCP (with Stepper Skill Sets)

Let your AI agent look up orders and create or update products in your Shopify store through a Stepper Skill Set, limited to the actions you choose.

A Skill Set is a toolkit you build in Stepper: you connect your apps, pick which actions an agent may call, and Stepper serves them as one MCP endpoint. The agent never sees your Shopify password or API keys, and every call is logged.

Last checked:

What you can let an agent do in Shopify

These are the Shopify actions you can add to a Skill Set. They're the same actions Stepper workflows use, listed on Stepper's Shopify page. You choose which ones the agent gets.

For example, you could ask

  • Find order 1042 and tell me what was in it and where it's shipping.
  • Update the description of the Speckled Mug product with this new copy.
  • Create Product Creates a new product in your Shopify store.
  • Create Order Creates a new order in your Shopify store with comprehensive order details.
  • Update Product Updates an existing product in your Shopify store.
  • Find Order Finds an order by order number, email, or customer ID.
  • Find Product by Title or Handle Finds a product by title or handle.
  • Make HTTP Request Make an HTTP request to any URL with full control over method, headers, and body.

Set it up in 5 steps

You need a Stepper account, a Shopify account, and an AI client that supports remote MCP servers, such as ChatGPT, Claude, Cursor or VS Code. Your own agent works too, using a Skill Set token.

  1. Connect Shopify to Stepper

    In Stepper, connect your Shopify account. Use an account that can do what you want the agent to do, and no more.

  2. Create a Skill Set

    Go to Skill Sets in Stepper, create a Skill Set for this agent, and use Add Entry to add your Shopify connection.

  3. Restrict the actions

    Choose only the Shopify actions the agent needs. An entry with no actions chosen allows every Shopify action, so a short list is safer. To pin a value, such as one channel, table or calendar, hardcode that parameter so the agent can't change it.

  4. Add the Skill Sets server to your AI client

    Add this URL as a remote MCP server:

    https://mcp.stepper.io/skill-sets/mcp

    Then sign in to Stepper when your client asks. On the Stepper screen that follows, pick the Skill Set this agent should use. To switch to a different Skill Set later, remove the server and connect again.

    Chat apps (ChatGPT, Claude and others): add it as a custom connector or app, wherever your client lists remote MCP servers.

    Code editors (Cursor, Windsurf and others that use an mcpServers config):

    {
  "mcpServers": {
    "stepper": {
      "url": "https://mcp.stepper.io/skill-sets/mcp"
    }
  }
}

    Your own agent or script: generate a Skill Set token in Stepper and send it as Authorization: Bearer sst_….

  5. Test it

    Ask the agent what it can do (it checks the Skill Set's list of skills) and make sure only the Shopify actions you chose appear. Then run one request using the lowest-risk action you allowed, such as a lookup or a draft, and check the call in the Skill Set's call log in Stepper.

Shopify's own MCP server, and when to use it instead

Shopify's AI Toolkit is for building on Shopify. It gives a coding assistant Shopify's docs and API schemas, checks code against them, and can run some store tasks through Shopify CLI. The Dev MCP server is one way to install it. Read Shopify's AI Toolkit and Dev MCP for setup.

Use Shopify's AI Toolkit when you're building a Shopify app, theme or extension. Use a Skill Set when you want an agent working in your own store's orders and products.

A Skill Set fits when the agent needs Shopify alongside other apps through one endpoint, or when you want to choose exactly which actions it can call, lock parameter values, and check a log of every call.

Guardrails

An agent can misread a request, and some Shopify actions change or remove real data. Set these up before you rely on it.

Scope

An agent that answers order questions only needs Find Order and Find Product by Title or Handle. Leave Create Order and Make HTTP Request off unless you need them.

Use a separate Skill Set for each agent or role, so each one gets only its own actions and tokens.

Audit

Every skill call is logged with the tool name, status, how it authenticated, and when. Call logs are kept for 30 days and are visible in Stepper, so you can check what the agent did in Shopify.

Revoke

Revoke a Skill Set token from Stepper to cut off a script or client straight away. To stop an agent using one action, remove it from the Skill Set; that applies from the agent's next call, with no need to reconnect. You can also remove the server from your AI client.

Add with care: Make HTTP Request. Make HTTP Request can call any URL with your connection, so it gives the agent far more reach than the other actions.

Related

Connect other apps to AI agents over MCP:

Shopify is a trademark of its owner. Stepper isn't affiliated with or endorsed by Shopify; its name is used here only to describe the integration.