Dev

Unverified

NPM@shopify/dev-mcp

DRisk gradehigh blast radius

Catalogue entry updated 50 days ago

Auth postureNot probedno remote endpoint probed yet

Tools55 Read

Worst categoryReadgrade tracks the peak, not the average

Capability mix

What it can reach

Ingests untrusted inputTouches secretsReaches networkRuns codeTouches filesChanges permissionsSends external commsPersistsDeletes dataMoves money

Tools 5

Change history

No change history on record for this server.

Recommended policy

Read-only toolsallow

This record as markdown: /tools/dev.md — append .md to any tool or server page.

// RUNNING THIS SERVER

DIRECT INSTALL npx -y @shopify/dev-mcp

Installed this way, nothing enforces the recommended policy above — calls run exactly as the agent makes them.

// LOOK UP ANOTHER SERVER

Every MCP server has a record like this.

Type a name, get the same breakdown: verified identity, auth posture, risk grade, capabilities, recommended policy.

Teams ship this data inside their own products. See what a licence covers →