PrestaShop MCP Server

A PrestaShop module that turns a shop into an MCP server. Claude, ChatGPT, Le Chat or any MCP-compatible assistant (full list) can then work with the shop's orders and catalogue, through a standard protocol, with OAuth 2.1 and the employee's own back office permissions, instead of a database login or an API key that can do everything.

The module folder is somcp; in the back office it is called O'So MCP Server.

The module documentation - requirements, installation, configuration and how to connect each assistant - is on the wiki.

https://github.com/user-attachments/assets/cf0b0e3f-1172-4ba9-aad1-11a6298aadf7

This repository is looking for PrestaShop developers who want to build it with us. See Where to help.

What it does

• Serves MCP from inside PrestaShop. No separate service, no Node process. The endpoint is a module front controller.

• Runs its own OAuth 2.1 authorization server: discovery documents (RFC 9728 and RFC 8414), PKCE S256, dynamic client registration and client ID metadata documents, refresh token rotation with reuse detection. Tokens are stored hashed and bound to the shop they were issued for.

• Uses PrestaShop permissions as they are. An employee connects an assistant on their own behalf, on a consent screen in the back office. The assistant then holds exactly that employee's rights: each tool is tied to a back office page and one of the four rights PrestaShop already manages, view, add, edit or delete.

• Supports multistore natively. Each shop has its own address, its own tokens and its own settings with the usual inheritance. An employee only reaches the shops they are attached to.

• Lets any module publish tools and prompts through two hooks, by returning arrays. No dependency on somcp's classes, so those modules still pass the Addons validator. See docs/EXTENDING.md.

• Has a built-in assistant in the back office. A chat button at the top right of every page opens a conversation with the AI the merchant connected with their own API key: Claude, ChatGPT, Gemini, Mistral, DeepSeek, Grok or Cohere - each link opens the page where that provider gives out keys - or with an AI running on the merchant's own computer, such as Ollama or LM Studio, linked through O'So AI Relay with no key and nothing opened on their network. It uses the same tools, with the rights of the employee signed in, and asks for approval before any change. Several assistants can share the work by role. Each conversation can switch on deep thinking (Claude, Gemini, OpenAI's reasoning models) and web search (Claude and Gemini on their own, the others through one of them), and switch the memory off, from the + menu. It knows the module it belongs to, and for super administrators reads and, after approval, changes its settings. Runs on Neuron AI.

• Speaks both eras of the protocol from one endpoint: the stateless 2026-07-28 revision, with questions in the middle of a call, and the 2025-11-25, 2025-06-18 and 2025-03-26 revisions.

Related MCP server: MCP Server for Odoo

Screenshots

The settings pages on PrestaShop 9.1, one after the other: configuration, tools and prompts, access and security, connected assistants, built-in assistant, security log, help and updates, and the chat.

Compatibility

The shop has to be reachable over HTTPS, with friendly URLs enabled, and installed at the root of its domain: OAuth anchors one of its discovery documents there. The diagnostic button in the settings checks the certificate, the SSL setting, the friendly URLs, the location and the addresses an assistant calls, from the outside. The full list of requirements is on the wiki.

Tools

Grouped by back office page, each object's reads before its writes. A new tool goes in the table of its page.

Connection

Orders

Catalog - Products

Catalog - Categories

Catalog - Brands

Catalog - Suppliers

Catalog - Attributes

Catalog - Features

Catalog - Files and taxes

Stock

Customers

Statistics

Content

Modules

Appearance

System

SEO

Reads are flagged read-only and safe to repeat. Writes are flagged destructive, which is what MCP clients use to ask the merchant before running them; each write changes one object per call and is never retried on a lost answer.

somcp_ping is outside the permission system on purpose: it reads no shop data and only says what the assistant is connected to (shop, account, language, currency), so an assistant can always tell which account it is using, even one with no rights at all.

Nine prompts ship with the module: checking the connection, finding an order, changing an order status, managing products, checking stock, finding a customer, auditing SEO, reporting sales, and reading content pages. The built-in assistant offers them too, each with its icon: those of the back office page open first, and any of them from the + of its field. Details of every tool are in docs/TOOLS.md.

Install for development

1. Clone the repository into your shop's modules folder, as somcp:

   cd /path/to/prestashop/modules
   git clone https://github.com/novalo-dev/Prestashop-MCP-Server.git somcp

2. Install the module's dependencies, then install it from Modules > Module Manager and open its settings:

   cd somcp && composer install --no-dev

3. Copy the address to give to your assistant. It looks like https://your-shop.example/module/somcp/mcp.

4. Press Run the diagnostic. No line should be red before you connect an assistant; a warning, such as a shop in maintenance, does not stop it.

A local shop needs a public HTTPS address for an MCP client to reach it: use a tunnel such as cloudflared or ngrok and set the shop's domain to it.

Versions are the releases published on GitHub. Between two releases, main may change the database schema; the upgrade for existing shops is written when the next release is published, so on a development shop, reinstall the module when a pull request says its schema changed.

Compatible assistants

Any assistant that connects to a remote MCP server over HTTP with OAuth uses the shop's MCP address, shown on the module's configuration page. The ones below can. Where to paste the address in each of them: Connect an assistant.

• Chat: Claude (web, desktop, mobile), ChatGPT, Le Chat (Mistral), Dust

• Command line: Claude Code, Codex (OpenAI), Gemini CLI (Google), GitHub Copilot CLI

• Code editor: Cursor, VS Code (GitHub Copilot), Windsurf (Devin Desktop), Zed

• Automation: n8n (Cloud and self-hosted), Make

Security model

• OAuth 2.1 with PKCE (S256 only). Authorization codes live 60 seconds, access tokens one hour and refresh tokens thirty days by default, both configurable. Refresh tokens rotate; presenting an old one revokes the grant.

• Scopes say what an assistant may do: mcp.access to connect, mcp.orders.read, mcp.orders.write, mcp.catalog.read, mcp.catalog.write, mcp.stock.read, mcp.stock.write, mcp.customers.read, mcp.customers.write, mcp.seo.read, mcp.seo.write, mcp.stats.read, mcp.content.read, mcp.modules.read, mcp.modules.write, mcp.appearance.read, mcp.appearance.write, mcp.system.read, mcp.system.write. Other modules declare their own scopes rather than borrowing these.

• Back office rights are checked on every call, against the employee's current profile, and the shop always comes from the token, never from the request.

• Redirect URIs must be https, or http on loopback. The merchant can restrict them to a list of hosts, and restrict which profile may grant access.

• Every connection can be withdrawn from the settings, and every refusal is written to a security log that never contains a token or a secret.

Found a vulnerability? Please do not open an issue: see SECURITY.md.

Documentation

• Wiki: the module documentation for merchants - requirements, installation, configuration, connecting an assistant and the built-in assistant.

• docs/ARCHITECTURE.md: how a request travels through the module, OAuth, MCP, multistore, data.

• docs/EXTENDING.md: publish tools and prompts from your own module, with a complete example module.

• docs/TOOLS.md: the conventions every tool follows, and each tool in detail.

• CHANGELOG.md: what each release changed, and what waits under Unreleased for the next one.

Where to help

The protocol layer, OAuth and permissions are in place. What the module needs now is reach: more of PrestaShop exposed as tools, more clients tested, more languages. ROADMAP.md lists concrete pieces of work, and CONTRIBUTING.md explains how to set up, what a pull request needs, and which contributions fit.

Contributors

Everyone who helped build the module, the top contributor first. The pictures come straight from GitHub and follow each profile; the shares of the commits are refreshed at each release. The settings page of the module shows the same list, read from GitHub, under Help and updates > Meet our contributors.

Want to be next? CONTRIBUTING.md explains how.

License

Academic Free License 3.0, like the rest of the Novalo modules.