shopify_get_customer

What shopify_get_customer does on AIVA MCP Server

AI agents call shopify_get_customer to retrieve information from AIVA MCP Server without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why shopify_get_customer is rated Low

This tool retrieves customer data from Shopify without modifying, deleting, or executing operations. It is a Read operation. Severity is medium because customer details may include PII (email, address, phone, purchase history) that could be misused if an AI agent retrieves and exfiltrates data without proper authorization or context, though the tool itself performs no destructive or financial action.

From the tool's definition Tool name is 'shopify_get_customer' and description states 'Get Shopify customer details.' The verb 'Get' and lack of any modification language indicate a retrieval operation with no side effects.

The rule that runs shopify_get_customer safely

PolicyLayer is an MCP gateway: it sits between your AI agents and AIVA MCP Server, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For shopify_get_customer, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "shopify_get_customer": {}
  }
}

Questions about shopify_get_customer