# Reported issues for shopify-operations-mcp Pod holds 17 of 27 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user. Back to [shopify-operations-mcp](/mcp/shopify-operations-mcp). ## Most discussed ### DECISIONS.md + AGENTS.md + docs/agents Part of #1 **Goal:** Decision record + agent conventions, consistent with sw-postgres-mcp. **Scope:** DECISIONS.md entries: preview-as-computed-diff (no transactions on Shopify); snapshot rollback scope (reversible ops only); always-approval for irreversible ops; hash-chained audit vs Postgres grants; GraphQL over REST; partial-failure ledger. AGENTS.md pointer + docs/agents/{issue-tracker,triage-labels,domain}.md adapted from sw-postgres-mcp. **Done-when:** Docs consistent with the code and [Read the thread](https://github.com/jpka/shopify-operations-mcp/issues/22) · 2026-08-13 · closed · 2 comments ### Deterministic dev-store seeder Part of #1 **Goal:** A realistic store to point the server at — deterministic, like sw-postgres-mcp's seeder. **Scope:** scripts/seed-store.ts; seeded PRNG (mulberry32, --seed flag); ~300 products x 1-4 variants across vendors/tags, 2 locations with stock, ~20 customers, ~120 Bogus-Gateway orders in mixed states (paid/unfulfilled, fulfilled, discounted); deliberately sized so a store-wide reprice trips hardMaxItems and a single-tag reprice trips approvalRequiredAboveItems; idempotent re-run (r [Read the thread](https://github.com/jpka/shopify-operations-mcp/issues/17) · 2026-08-13 · closed · 2 comments ### GraphQL Admin client (throttle, backoff, pagination, chunking) Part of #1 **Goal:** One client all tools and tests go through. **Scope:** Plain fetch against /admin/api//graphql.json (pinned quarterly version); cost-aware throttling driven by extensions.cost.throttleStatus; jittered backoff with max retries on THROTTLED / 429 / 5xx; cursor pagination helper for connections; mutation chunking helper (conservative batch size); structured errors SHOPIFY_THROTTLED / SHOPIFY_API_ERROR with hint; injectable fetch for tests. **Done-when:** Unit tests w [Read the thread](https://github.com/jpka/shopify-operations-mcp/issues/5) · 2026-08-13 · closed · 2 comments ### demo:prep fails: seeder is broken against Admin API 2026-04 ## Problem `npm run demo:prep` fails at the seed step: the seed-store script uses mutation signatures from an older Admin API version and errors against 2026-04. ## Root causes - `productDelete(productId:)` -> now requires `input: { id }` - `customerCreate(customer:)` -> now takes `input:` with `CustomerInput!` - `ProductVariantsBulkInput`: `sku`/`inventoryManagement` moved under `inventoryItem: { sku, tracked }` - New product model: `productVariantsBulkCreate` redefines the option set (delet [Read the thread](https://github.com/jpka/shopify-operations-mcp/issues/52) · 2026-08-16 · closed · 1 comment ### Address unaddressed review concerns from PR #49 Follow-up from PR #49 (merged 2026-08-16) — CodeRabbit posted 6 actionable comments with `CHANGES_REQUESTED`, but the PR was merged without addressing them. All 6 are still valid against `main` (`6203a4c`). ## Concerns 1. **`scripts/demo-baseline.mjs`** — the failure block checks `count`/`variants`/`saleVariants`/`protectedProducts` but not `data.first === 50`, even though the script's own docstring declares `first: 50` an invariant. A page-size regression can pass while the cursor walk still [Read the thread](https://github.com/jpka/shopify-operations-mcp/issues/50) · 2026-08-16 · closed · 1 comment ### MCP stdio server wiring (server.js) + startServer in index.ts Part of #1 **Goal:** Wire the existing tools into an @modelcontextprotocol/sdk stdio MCP server so `npm run build` emits `dist/server.js` (currently missing — the published package has no MCP server entry) and `startServer` runs alongside the localhost approval server in `src/index.ts`. **Scope:** src/server.ts exposing search_products, list_orders, update_prices, update_inventory, create_discount, refund_order, cancel_order, execute_plan, rollback_plan; shared base-typed PlanStore MCP stdio -> safe-write-mcp-core -> Shopify Admin API; approval UI; audit file); threat model (trusted-but-fallible agent; the killer is a syntactically perfect bulk reprice with a misplaced decimal); tools reference; config reference; limitations stated plainly: order cancels/refunds are irreversible (approval protects them, not rollback); rollback is best-effort snap [Read the thread](https://github.com/jpka/shopify-operations-mcp/issues/21) · 2026-08-13 · closed · 1 comment ## Most recent ### npm publish + MCP Registry publish (manual) Part of #1 **Goal:** Public installability + registry listing. **Scope:** npm run build && npm publish (bin entry); mcp-publisher login github; mcp-publisher publish; verify the listing resolves. **Done-when:** npm view shopify-operations-mcp shows the version; registry lists io.github.jpka/shopify-operations-mcp. Human task: npm 2FA + device-flow login. [Read the thread](https://github.com/jpka/shopify-operations-mcp/issues/23) · 2026-08-13 · closed · 0 comments ### server.json + mcpName + sync test Part of #1 **Goal:** MCP Registry readiness, same as sw-postgres-mcp. **Scope:** server.json per the 2025-12-11 schema as io.github.jpka/shopify-operations-mcp; environmentVariables: SHOPIFY_STORE_DOMAIN (required, not secret), SHOPIFY_ADMIN_TOKEN (required, secret); tests/serverJson.test.ts keeps server.json in sync with package.json (mcpName). **Done-when:** Sync test green. [Read the thread](https://github.com/jpka/shopify-operations-mcp/issues/20) · 2026-08-13 · closed · 1 comment ### Live integration suite (env-gated, manual) Part of #1 **Goal:** Proof against the real Admin API, kept out of CI. **Scope:** vitest.integration.config.ts; every test skipped unless SHOPIFY_STORE_DOMAIN + SHOPIFY_ADMIN_TOKEN are set; proves real API shapes, throttle handling, and refund/cancel flows against the seeded dev store; documented as manual-only — never in CI (no secrets, no rate-limit flakes). **Done-when:** Suite passes against the seeded dev store; README documents how to run it. [Read the thread](https://github.com/jpka/shopify-operations-mcp/issues/19) · 2026-08-13 · closed · 1 comment ### Mocked Admin API + safety-case test matrix Part of #1 **Goal:** The signature test file, mirroring sw-postgres-mcp's safetyCase.test.ts. **Scope:** Fake GraphQL endpoint with a per-operation handler registry + call log; it.each matrix of safety property x write tool: threshold trip, hard-cap refusal, expired/reused/mutated/rejected tokens, protectedTags, STATE_CHANGED, preview-made-zero-mutation-calls (asserted against the call log — the analog of "preview leaves no trace"), rollback-restores-exact-values, audit-trail completeness. ** [Read the thread](https://github.com/jpka/shopify-operations-mcp/issues/18) · 2026-08-13 · closed · 1 comment ### Approval UI wiring + fetch-driven tests Part of #1 **Goal:** The human approval surface running alongside the MCP server, as in sw-postgres-mcp. **Scope:** Start the core approval server alongside MCP stdio in index.ts; Shopify renderPlan: manifest table (item, before, after, reason, flags); port sw-postgres-mcp's approvalUi tests: pending-plan listing, approve unlocks execute_plan, reject tombstones with PLAN_REJECTED, expired plans hidden, loopback-only bind, works with no MCP client connected. **Done-when:** All approval-UI test [Read the thread](https://github.com/jpka/shopify-operations-mcp/issues/16) · 2026-08-13 · closed · 1 comment ### create_discount (reversible, threshold rules) Part of #1 **Goal:** Discount creation under normal threshold rules — reversible, so rollback-supported. **Scope:** discountCodeBasicCreate (percentage | fixed amount, code, optional usage limits); reversible via deactivate/delete, so the snapshot store + rollback_plan cover it; normal item-count thresholds apply. **Done-when:** Safety-matrix rows pass, including rollback deactivating the created discount. [Read the thread](https://github.com/jpka/shopify-operations-mcp/issues/15) · 2026-08-13 · closed · 1 comment ### refund_order (always-approval, irreversible) Part of #1 **Goal:** Refunds that a human must always approve, because they cannot be undone. **Scope:** Preview via refundCalculate (exact suggested amounts — zero writes); execute via refundCreate after human approval; unconditional awaiting_approval; excluded from rollback; audits amounts without PII. **Done-when:** Tests prove calculated preview, approval gating, and ROLLBACK_UNSUPPORTED. [Read the thread](https://github.com/jpka/shopify-operations-mcp/issues/14) · 2026-08-13 · closed · 1 comment ### cancel_order (always-approval, irreversible) Part of #1 **Goal:** Order cancellation that a human must always approve, because it cannot be undone. **Scope:** orderCancel with reason, restock, notifyCustomer; preview shows refund implication and flags — zero writes; unconditional awaiting_approval (thresholds never consulted — the same discipline as sw-postgres-mcp's run_migration); excluded from rollback; audited honestly as irreversible. **Done-when:** Tests prove unconditional approval gating, approval-unlocks-execute, and ROLLBACK_U [Read the thread](https://github.com/jpka/shopify-operations-mcp/issues/13) · 2026-08-13 · closed · 1 comment ### rollback_plan (one-call rollback) Part of #1 **Goal:** Undo a committed reversible plan in one call. **Scope:** Given an executed plan's token, re-apply snapshot before-values as inverse mutations (prices, inventory; deactivate/delete for discounts); no approval needed — restoring prior state is the safe direction; ROLLBACK_UNSUPPORTED for cancel_order / refund_order plans; ROLLBACK_WINDOW_EXPIRED after rollbackTtlMs; audits rolled_back with the per-item ledger. **Done-when:** Tests prove exact-value restoration, unsupported- [Read the thread](https://github.com/jpka/shopify-operations-mcp/issues/12) · 2026-08-13 · closed · 1 comment The remaining reports are on [the project's issue tracker](https://github.com/jpka/shopify-operations-mcp/issues).