High-risk tools in Shopify Graphql

High severity Shopify Graphql MCP Server 4 of 319 tools

4 of the 319 tools in Shopify Graphql are classified as high risk. This page profiles those tools specifically, with recommended policy actions and the attack patterns that target them.

Every operation listed below is an action PolicyLayer recommends controlling at the transport layer. Open any tool to see the full profile, risk score, and YAML policy snippet.

Tools at high risk

cancel_bulk_operation Execute

Cancel a running bulk operation. There may be a short delay from when cancellation starts until the operation is actually canceled.
run_bulk_mutation Execute

Run a bulk mutation operation to import data asynchronously. Each line in the JSONL file is processed as a separate mutation execution. Upload file using staged uploads first.
run_report Execute

Run a report and get its results
run_shopifyql_query Execute

Execute a ShopifyQL query for custom analytics and reporting

Attacks that target this class

High-risk tools in any server share these documented attack patterns. Each links to the full case and the defensive policy.

High-risk tools in Shopify Graphql

Tools at high risk

Attacks that target this class

More on Shopify Graphql

Enforce policy on every Shopify Graphql tool call.