shopware-mcp

Introducing shopware-mcp

A Shopware 6 shop is about two hundred entities behind one Admin API. Ask an assistant "is everything okay with the shop?" and the honest answer takes seven searches with Criteria filters, three state machines by their technical names, a couple of aggregations, and an OAuth token it must never repeat back to you. Wire a model straight to that API and it gets all of it, including the right to PATCH a price because a prompt said so.

The Model Context Protocol turned "give the model real tools" into a one-line config change. It says nothing about what a good tool for a shop looks like: which of the two hundred entities matter on a Tuesday morning, what "stuck order" means, or that a stock correction should be shown before it is sent.

shopware-mcp is that layer. One small server that speaks MCP to the host and the Admin API to the shop, and knows Shopware well enough to answer in one call what used to take an afternoon in the admin. It also notices when orders stop coming, and tries the checkout the way a customer would to find out why:

Shops are not identical, so the tool list is not either: at startup the server looks up which extensions are installed and registers extra tools for the ones it knows. A plain shop gets the core set. A shop with more plugins gets a bigger agent, without configuration.

Related MCP server: Web Shop MCP Server Proxy

See it work

Six hours without an order, and why. Sunday evening. The pulse compares the silence with the same hours of the last eight Sundays, which always brought three to seven orders, and puts the odds of chance at about one in 170. The agent then tries to buy something the way a customer would and finds the storefront in maintenance mode. Nothing was ordered, nothing changed.

The checkout as a customer sees it. A customer in Switzerland says a code does not work. A throwaway cart through Shopware's own Store API explains both problems at once: Switzerland is not a country of that channel, and the code's promotion ended in August. Then the search explains why a product never shows up.

Every morning, one page. shopware-mcp brief --html brief.html writes the pulse, the audit and the last seven days as one self-contained page that loads nothing from anywhere and follows the reader's dark mode. From cron, with --slack for a one-paragraph summary in a channel. Open a real one.

Least privilege in one command. shopware-mcp setup logs in as an admin once, creates a role with exactly the privileges the tools need, measured against a real shop and not guessed, and an integration that is not an administrator. It shows the secret once, verifies both and prints the host config. Run it again after an upgrade and it brings the role up to date while the keys stay.

Every recording on this page is real output from the server against a Shopware 6.7.13 test shop with generated demo data, replayed from the transcripts in docs/demo/. Tool calls and results are verbatim, shortened to fit the screen. The prose is what an MCP host says with them.

One question, one call. Three paid orders are still waiting for shipment, the storefront is in maintenance, a summer promotion outlived August. The answer names order numbers and amounts, and offers the safe next step.

Numbers the shop computed itself. Totals, channels, states, a monthly timeline and the top product for eight months, from one call. No order was paged through; Shopware's aggregations did the work.

No tool for that? There is a schema for that. Manufacturers have no dedicated tool. The agent reads the entity's schema, spots mediaId, and filters on it. The same path reaches every other entity, custom ones included.

Writes show their hand first. With --allow-write, a stock correction comes back as the request it would send. Only an explicit dryRun: false touches the shop, and the result is re-read from Shopware.

Ship it, then prove it. A delivery transition is two requests, shown before they are sent: the tracking code onto the delivery, then the state change. The order's history afterwards names the transition, the states and who made it.

A product and its launch code, from one sentence. product_create picks the shop's default tax and derives the net price, and says so in the dry run. The promotion arrives inactive, so nobody sees a code before it was checked.

Moderation with a reply. Two reviews wait for approval. The spam stays hidden, the complaint is approved together with the shop's public answer, and the model never had to touch the admin.

People, not just revenue. New accounts by group, how many customers ordered and how many came back, the guest share, and the top customers with their share of the period, next to the period before.

A shop with more plugins gets a bigger agent. The core tools are ready immediately. The extension lookup finishes in the background, four tools appear, the host is told to refresh its list, and a compliance question has an answer.

Reorder before it hurts. stock_forecast reads six months of line items through one aggregation, joins them with the current stock, and says per product how many days are left, when it hits zero, and how much to order. Nine of these are already oversold; two are still fine today and will not be in October.

The same audit, no host in sight. shopware-mcp audit prints the findings as Markdown and exits non-zero when something is critical (or, with --fail-on warning, when anything is off). Put it in cron and read the mail; put it in CI and let the job fail. shopware-mcp report does the same for the numbers.

A shop with an operations plugin gets an operations agent. FroshTools is the open-source toolbox many Shopware hosters install. When it is there, three more tools appear: the platform's health checks, the message queue with its worker, and the dependency advisories. The agent tells stale search results apart from a dead worker.

Fifty-six invoices, three at a time. order_documents_bulk_create finds the paid orders that never got an invoice, oldest first, and shows the single request that would create them before it does. Every order counts against the write budget. Then scheduled_tasks_list explains how the backlog grew: 31 of 33 tasks overdue, none ever run, the scheduler is not running. tag_assign marks the order for the team, creating the tag on the way.

Know before the agent finds out. shopware-mcp doctor probes what the integration may read, reads its role for the write privileges where it can, and names the missing one per tool. An administrator gets a wall of ticks; a support-desk role gets told exactly what to grant.

What's in the box

Who it is for

• You run a shop and want to ask it questions instead of clicking through the admin. Stuck orders, low stock, last month's numbers, one prompt each.

• You run an agency and look after many shops. The core here covers one shop per server; the multi-shop, audited, hosted version is what the author builds for clients (see Open core).

• You build Shopware plugins and want your custom entities reachable by an agent today, and your own tools registered tomorrow. entity_search does the first; one file under src/extensions/ does the second.

• You build agents and want an MCP server that behaves: compact output, honest totals, dry runs, no surprises in the schema.

60 seconds

1. Let setup create the integration. It logs in as an admin once (the password is never stored), creates a read-only role with exactly the privileges the tools need and an integration using it, verifies both and prints or writes the host config:

npx shopware-mcp setup --url https://shop.example.com --user admin --for claude-desktop --write

Add --allow-write for the write tools and --settings for shop_settings; --dry-run shows the role's privileges first. After an upgrade, run the same command again: it updates the role and keeps the keys. Rather click it yourself? Create an Integration under Settings → System → Integrations, give it a role (see permissions) and continue with step 2.

2. Or let the wizard test existing credentials and write the host config for you:

npx shopware-mcp init                  # asks for URL, key and secret, tests them, prints the config
npx shopware-mcp init --for claude-desktop --write   # or merges it into the host's config file
npx shopware-mcp doctor                # which tools can this integration use, and what is missing
npx shopware-mcp audit --fail-on warning   # the shop audit as Markdown, exit 1 when something is off
npx shopware-mcp report --interval week    # the sales report of the last 30 days as Markdown
npx shopware-mcp brief --html brief.html   # pulse, audit and the last 7 days as one HTML page

Or run the server by hand:

export SHOPWARE_URL=https://shop.example.com
export SHOPWARE_CLIENT_ID=SWIA...
export SHOPWARE_CLIENT_SECRET=...

npx shopware-mcp                       # stdio (default)
npx shopware-mcp --http --port 3333    # Streamable HTTP on http://127.0.0.1:3333/mcp
npx shopware-mcp --allow-write         # also register the guarded write tools

3. Connect a host (or let init --write do it):

Download shopware-mcp.mcpb from the latest release and double-click it, or add this to claude_desktop_config.json:

{
  "mcpServers": {
    "shopware": {
      "command": "npx",
      "args": ["-y", "shopware-mcp"],
      "env": {
        "SHOPWARE_URL": "https://shop.example.com",
        "SHOPWARE_CLIENT_ID": "SWIA...",
        "SHOPWARE_CLIENT_SECRET": "..."
      }
    }
  }
}

claude mcp add shopware \
  -e SHOPWARE_URL=https://shop.example.com \
  -e SHOPWARE_CLIENT_ID=SWIA... \
  -e SHOPWARE_CLIENT_SECRET=... \
  -- npx -y shopware-mcp

They all take the same three fields. Cursor reads .cursor/mcp.json, VS Code .vscode/mcp.json (under servers instead of mcpServers), Windsurf ~/.codeium/windsurf/mcp_config.json, Gemini CLI ~/.gemini/settings.json, Codex CLI a [mcp_servers.shopware] table in ~/.codex/config.toml, Zed its context_servers block. init --for <host> --write writes each of them:

{
  "mcpServers": {
    "shopware": {
      "command": "npx",
      "args": ["-y", "shopware-mcp"],
      "env": {
        "SHOPWARE_URL": "https://shop.example.com",
        "SHOPWARE_CLIENT_ID": "SWIA...",
        "SHOPWARE_CLIENT_SECRET": "..."
      }
    }
  }
}

Hosts that read the official MCP registry find it as io.github.bnymnDev/shopware-mcp.

docker run --rm -p 3333:3333 \
  -e SHOPWARE_URL=https://shop.example.com \
  -e SHOPWARE_CLIENT_ID=SWIA... -e SHOPWARE_CLIENT_SECRET=... \
  ghcr.io/bnymndev/shopware-mcp

The image serves Streamable HTTP on http://127.0.0.1:3333/mcp. Point any HTTP-capable host at that URL. Add -e SHOPWARE_MCP_HTTP_TOKEN=<random secret> and the endpoint requires Authorization: Bearer <secret>; without a token, keep it on localhost or behind a proxy that authenticates (self-hosting notes).

4. Ask. The first useful question is usually "Is everything okay with the shop?"

Ask it anything

Filters, in one screen

Every search tool takes the same filter array, and every entry is a Shopware Criteria filter:

{ "type": "equals",    "field": "active",                                    "value": true }
{ "type": "range",     "field": "stock",                                     "value": { "lt": 5 } }
{ "type": "range",     "field": "orderDateTime",                             "value": { "gte": "2026-06-01" } }
{ "type": "equals",    "field": "transactions.stateMachineState.technicalName", "value": "paid" }
{ "type": "contains",  "field": "name",                                      "value": "shirt" }
{ "type": "equalsAny", "field": "id",                                        "value": ["…", "…"] }
{ "type": "equals",    "field": "manufacturer.name",                         "value": "Acme" }

Anything you can filter in the Admin API works here too, associations included. Need a raw field that the compact output leaves out, such as customFields, ean or weight? Pass fields: ["customFields", "ean"] and it is added to every item. Reading a shop in another language? Set SHOPWARE_LANGUAGE_ID. The full cheat sheet has more.

Tools

Every parameter of every tool: docs/tools.md. Searches return { total, page, limit, items } with exact totals, limit is capped at 50, and errors come back as { error: { status, code, detail } } so the model can react instead of guessing.

Resources: shopware://shop, shopware://sales-channels, shopware://order/{orderNumber}, shopware://product/{productNumber}. Prompts: order_summary, low_stock_report, weekly_review.

Plugin-aware tools

At startup the server asks the shop which extensions are installed and active, in the background, and registers extra tools for the ones it knows. A shop that does not answer simply keeps the core tools. --no-extensions turns the whole mechanism off.

Two packs ship today. FroshTools, the open-source operations plugin, adds frosh_health (platform health and performance checks), frosh_queue (message queue transports, waiting messages, worker) and frosh_composer_audit (dependency advisories); all read-only, the plugin's own maintenance actions are never called. Merqo adds merqo_health, merqo_einvoice_inbox, merqo_returns_search and merqo_abandoned_carts. Shops without a plugin never see its tools, and nothing in the core tools changes either way. Support for another vendor's extensions is one file under src/extensions/, tested against the installed plugin; a pack names the ACL privileges its plugin's routes need, and shopware-mcp setup grants them when that plugin is installed. Pull requests are welcome.

Safety

• Read-only by default. Without --allow-write (or SHOPWARE_MCP_ALLOW_WRITE=true) the write tools are not registered. An agent cannot discover what it cannot call.

• Every write is a dry run first. All fifteen write tools, from stock_set to tag_assign, default to dryRun: true and return { dryRun: true, wouldSend: { method, url, body } }, a list when one call needs several requests. A real write returns the re-fetched entity.

• A write budget. SHOPWARE_MCP_MAX_WRITES=20 refuses the twenty-first real write of a process with WRITE_BUDGET_EXHAUSTED; dry runs stay free. No prompt can lift it.

• Narrow writes. product_update touches name, description, active and one currency's price; product_create makes a simple product and nothing else; product_cover_set adds one picture (JPEG, PNG, WebP, GIF or AVIF, never SVG) that the shop itself downloads. promotion_create creates one cart discount, inactive unless told otherwise. customer_update touches the active flag and the group. The transition tools only move state machines; nothing moves money. Documents come from Shopware's own generator and are never sent by this server; order_documents_bulk_create makes at most fifty per call and charges the write budget once per order. tag_assign adds or removes tags by name and leaves the rest of the record alone. Nothing deletes. Nothing else is writable.

• A simulated cart is not an order. checkout_simulate and storefront_search go through Shopware's own admin proxy to the Store API with a random context token no visitor holds. The order route is never called and the cart is deleted afterwards; what remains is a context row Shopware expires by itself. Simulating as a customer does not touch that customer's own session or saved cart. Extensions that react to saved carts, such as abandoned-cart mailers, do see the simulated cart as that customer's, so simulate as a real customer only where that is fine.

• Least privilege by default. shopware-mcp setup grants each tool exactly the privileges it was measured to need against a role that had nothing else, and never administrator rights. Two privileges reach further than their tool and stay out unless you ask: reading the whole system config, SMTP passwords and payment keys included (--settings), and installing extensions (--plugin-updates). Setup only changes a role it created, names every privilege it adds or removes, and shows the new secret before anything else can fail. The admin password is used for one login over https, or plain http to this machine only, and never stored.

• Scrubbed reads. entity_search strips passwords, keys, tokens and hashes from every payload and refuses entities that exist to hold credentials or system internals: users, integrations, ACL roles, apps, system config.

• No secrets anywhere. Credentials never appear in output, logs or error messages. Logs go to stderr only, at error level unless you ask for more.

• No telemetry. The server talks to your shop and to your host. Nothing else.

• HTTP transport. Set SHOPWARE_MCP_HTTP_TOKEN and every call to /mcp needs that bearer token, compared in constant time. Without it, bind to localhost (the default) or put it behind a reverse proxy that authenticates; the server warns when it is reachable further without a token.

• Requests time out. A shop that stops answering costs one request 30 seconds (SHOPWARE_MCP_TIMEOUT_MS), not the whole session.

Found something? See SECURITY.md.

Configuration

CLI flags override the environment: --allow-write, --max-writes <n>, --no-extensions, --http, --port <n>, --host <addr>, --log-level <level>. Commands: setup, doctor, init, brief, audit and report; npx shopware-mcp --help lists their options.

The Integration needs read permissions on the entities the tools touch and write permissions for the write tools. shopware-mcp setup grants exactly those; Administrator is the quick path for a dev shop (which permissions).

Design principles

1. Shopware's vocabulary, not ours. Filters, field paths, state names and entity names are Shopware's. A tool call reads like the Admin API request it becomes, and a Shopware developer needs no second dictionary.

2. Compact by default, complete on request. Items carry what a model needs to reason and page. Raw fields come with fields, more rows with page, and long text is truncated rather than dumped.

3. Reading is free, writing is explicit. Write tools exist only when asked for, default to a dry run, and return the exact request. The model sees the consequence before the shop does.

4. Let the shop do the maths. Totals, timelines and top products are Shopware aggregations with exact counts, not client-side sums over pages.

5. Vendor-neutral core. Extension packs live in their own files, are registered only when the shop has the extension, and never change how the core tools behave. No telemetry, no phone-home.

The reasoning behind individual choices is in docs/decisions.md.

Documentation

Open core

Everything in this repository is MIT and stays that way. It covers one shop, one operator, interactive use.

The same author builds Merqo, a commercial suite of Shopware extensions for EU compliance and daily operations. This server detects them and adds matching tools, but it never requires them, and the core tools behave the same either way.

Agencies and merchants running this at scale usually need more, and that is what I build and operate for clients:

• Multi-shop: one MCP endpoint that routes to dozens of shops with per-shop credentials and permissions

• Hosted with audit trail: every tool call logged with who, what and when, role-based access, SLA

• Bulk operations and migrations: mass price and stock updates, catalogue imports, safe rollbacks

• Custom agents and Shopware plugins: workflows tailored to your ERP, PIM or support desk

Interested? Open an issue with the consulting label or reach out via github.com/bnymnDev. Using shopware-mcp in production and want it to stay maintained? Sponsoring helps.

Building from source

pnpm install
pnpm dev          # stdio server via tsx
pnpm test         # vitest + msw-mocked Admin API
pnpm build        # tsup → dist/ (npm) and dist/bundle/ (self-contained)
pnpm pack:mcpb    # Claude Desktop bundle → shopware-mcp.mcpb
pnpm inspect      # MCP Inspector against dist/
pnpm docs:tools   # regenerate docs/tools.md and the tool tables in both READMEs
pnpm docs:demos   # re-render the recordings in docs/demo/ from their transcripts

End-to-end tests against a real Shopware (dockware/dev, or any shop you point them at) run with pnpm test:e2e; see CONTRIBUTING.md.

Status

v0.8. Everything on this page is implemented, covered by unit tests against mocked Admin API responses, and exercised nightly end-to-end against a real Shopware. The recordings above come from Shopware 6.7.13; 6.6 is supported too.

Not in it, on purpose: user management for the HTTP transport (one static token, or a proxy), multi-shop routing and audit trails (the commercial part), and write tools beyond the fifteen that a support desk and a shop manager need on a normal day.

Ideas that fit: more extension packs, more cart errors explained in plain words, a products_search example gallery. The good first issues are a fine place to start.

License

MIT