What it can do: shopify-plugin
Plugin bundle · Shopify
What shopify-plugin declares, asks for and runs, according to the marketplaces we read. Its MCP server runs on your machine: the AI tool starts this npm package locally: @shopify/dev-mcp. None of the marketplaces we read publishes its tools or the settings it asks for. As of our marketplace pass on 2026-10-12.
This is not a security audit. We list what the marketplaces publish about this plugin: what it declares, what it asks for and what it runs. We do not run or inspect its code, and a verified mark is the marketplace's statement, not ours.
Where it runs
- Its MCP server runs on your machine: the AI tool starts this npm package locally:
@shopify/dev-mcp
What it declares
None of the marketplaces we read publishes a list of tools for it.
Prompts and resources: the marketplaces we read do not publish them.
What it asks for
None of the marketplaces we read lists environment variables for it.
Names only: we keep no values, examples or descriptions of these variables. OAuth scopes and install-time settings are not published by the marketplaces we read.
What it runs besides MCP
None of the marketplaces we read lists hooks, commands, agents or language servers for it.
Who answers for it
Shopify
- No marketplace we read marks it or its publisher as verified.
- License: MIT.
- The repository github.com/shopify/shopify-plugins belongs to the account the publisher is listed under on Claude Code: claude-plugins-community.
How it has changed
Its tools, settings, hooks and composition have not changed since we started watching it.
In context
- Median number of secrets a plugin bundle asks for on the marketplaces we read: 0.0. This one asks for: 0.
- Share of plugin bundles that run on a remote server: 17%.
Where it is published and how its figures have moved
Compare it side by side with similar plugins
Data comes from the public marketplace file https://github.com/anthropics/claude-plugins-community/blob/HEAD/.claude-plugin/marketplace.json. Figures come from our own regular passes over the marketplaces, last read on . We publish no contact details for plugin publishers.