# PrestaShop MCP (Legacy WebService)

An [MCP](https://modelcontextprotocol.io) server that lets an AI assistant (Claude,
Cursor, …) read and manage a PrestaShop catalog through the **legacy WebService API
(XML)** — the API that older and current shops alike still expose. Works on
**PrestaShop 1.6, 1.7, 8, and 9**.

45 tools: categories, features, attributes, products, combinations, stock,
warehouses, plus read-only access to **any** resource the API key allows
(customers, orders, cart rules, …).

## Why this one — and when to use the official MCP instead

PrestaShop ships an official MCP built on the **PS 9 Admin API (OAuth2)**. That's
the right choice for a modern PS 9 shop you fully control. This server is for the
cases it doesn't cover:

| | This server (legacy WebService) | Official MCP (Admin API) |
|---|---|---|
| Transport | Legacy WebService API (XML) | PS 9 Admin API (API Platform / OAuth2) |
| PrestaShop versions | **1.6 → 9** | PS 9+ only |
| Auth | WebService API key (per-resource permissions) | OAuth2 client |
| Warehouse stock (`/stocks`) | ✅ incl. PShowAdvancedStockWarehouses | varies |
| Setup | one API key + a `.env` | OAuth2 app registration |

**Use the official MCP** if you're on PS 9 and want the supported, forward-looking
path. **Use this** if you're on PS 1.6/1.7/8, or you already have a WebService key,
or you need the legacy `/stocks` warehouse flow.

## Install

Requires Python 3.10+.

```bash
git clone https://github.com/Breczek/prestashop-mcp-legacy
cd prestashop-mcp-legacy
pip install -r requirements.txt
cp .env.example .env      # then fill in PS_SHOP_URL and PS_API_KEY
```

The server reads `.env` from the **current working directory**, so each shop/project
keeps its own credentials.

**Claude Code** — run it from the project directory that holds the `.env`, and register the server (e.g. in `~/.claude/settings.json` or via `claude mcp add`):

```json
{
  "mcpServers": {
    "prestashop": { "command": "python3", "args": ["/abs/path/prestashop-mcp-legacy/server.py"] }
  }
}
```

**Claude Desktop / Cursor** — same config, but set the working directory to the
folder containing `.env` (these clients launch the server themselves):

```json
{
  "mcpServers": {
    "prestashop": {
      "command": "python3",
      "args": ["/abs/path/prestashop-mcp-legacy/server.py"],
      "cwd": "/abs/path/to/your/shop-project"
    }
  }
}
```

## Security & permissions — read before connecting a live shop

This server can **write to your shop** — create, update, and delete categories,
prices, stock, and combinations — and the AI assistant decides when to call those
tools. Treat it accordingly:

- **Use a least-privilege API key.** Grant only the resources you actually need.
  The key's permissions are the real security boundary — the generic `ps_query`
  tool can read *any* resource the key allows.
- **Prefer a staging shop** for anything experimental. Deletes are permanent.
- **Generic access is read-only.** `ps_query` / `ps_get_record` are strictly GET;
  there is no generic write tool. Writes go only through the specific, named tools.
- **Sensitive fields are redacted** before they ever reach the model: `passwd`,
  `secure_key`, `reset_password_token`, `api_key`, `checksum`.
- **Your API key is never logged.** The optional local log records only
  action / resource / id / HTTP status.
- Requests use a 30s timeout and verify TLS by default.

## Tools (45)

- **Catalog:** categories, features + values, attribute groups + values,
  products (list/find/get/activate/price), combinations (list/get/find/update/
  assign image).
- **Stock:** `stock_available` get/update; warehouse `/stocks` list/create/update.
- **Reference:** warehouses, manufacturers, languages.
- **Generic (read-only):** `ps_api_resources`, `ps_schema`, `ps_query`,
  `ps_get_record`, `ps_search`, `ps_resource_guide`, `ps_product_images`, plus
  convenience readers for customers, orders, and cart rules.

Run `ps_verify` first to confirm the connection and see which resources your key
exposes.

## Requirements

- Python 3.10+, `mcp[cli]`, `requests` (see `requirements.txt`).
- A PrestaShop shop with the WebService enabled and an API key.
- Warehouse `/stocks` tools assume the PShowAdvancedStockWarehouses setup.

## Contributing

PrestaShop's WebService varies across versions and plugins — corrections and
additions welcome. Open an issue or PR with your PS version.

## License

[MIT](LICENSE).

## Author

Marcin Bręczewski ([@Breczek](https://github.com/Breczek)) — PrestaShop
development and AI tooling.