validate_theme
This tool validates Liquid codeblocks, Liquid files, and supporting Theme files (e.g. JSON locale files, JSON config files, JSON template files, JavaScript files, CSS files, and SVG files) generated or updated by LLMs to ensure they don't have hallucinated Liquid content, invalid syntax, or incor...
This record as markdown: /tools/dev/validate-theme.md
What validate_theme does on Dev
AI agents call validate_theme to retrieve information from Dev without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.
| Parameter | Type | Required | Description |
|---|---|---|---|
conversationId | string | Yes | 🔗 REQUIRED: conversationId from learn_shopify_api tool. Call learn_shopify_api first if you don't have this. |
absoluteThemePath | string | Yes | The absolute path to the theme directory |
filesCreatedOrUpdated | array | Yes | Array of files with path and optional artifact metadata |
Parameters from the server's own tool schema.
Why validate_theme is rated Low
This is a validation/linting tool that analyzes code and provides feedback without making changes. It performs static analysis on Liquid, JSON, JavaScript, CSS, and SVG files to check for syntax errors and invalid references. The output is informational (validation results with artifact IDs), with no side effects or state modifications.
From the tool's definition The tool description states it 'validates' and 'returns a comprehensive validation result' with details about whether code blocks are valid or invalid. Key verbs: 'validates', 'returns', 'ensures'.
Risk signalsAccepts file system path (filesCreatedOrUpdated[].path)
Attacks that exploit this kind of access
The rule that runs validate_theme safely
PolicyLayer is an MCP gateway: it sits between your AI agents and Dev, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For validate_theme, this is the rule to start with:
validate_theme is read-only, so it stays allowed. Everything else on the server is denied unless you say otherwise.
The button opens the PolicyLayer dashboard: create your workspace, connect Dev, apply this rule, and every validate_theme call is checked against it from then on.
Questions about validate_theme
This tool validates Liquid codeblocks, Liquid files, and supporting Theme files (e.g. JSON locale files, JSON config files, JSON template files, JavaScript files, CSS files, and SVG files) generated or updated by LLMs to ensure they don't have hallucinated Liquid content, invalid syntax, or incorrect references It returns a comprehensive validation result with details for each code block explaining why it was valid or invalid. This detail is provided so LLMs know how to modify code snippets to remove errors. It also returns an artifact ID and revision number for each code block. This is used to track the code block and its validation results. When validating an iteration of the same code block, use the same artifact ID and increment the revision number. Do not pass your own artifact ID to this tool, the tool will generate one for you.. Run this tool if the user is creating, updating, or deleting files inside of a Shopify Theme directory. It is categorised as a Read tool in the Dev MCP Server, which means it retrieves data without modifying state.
validate_theme accepts 3 parameters: conversationId, absoluteThemePath, filesCreatedOrUpdated. Required: conversationId, absoluteThemePath, filesCreatedOrUpdated. The full parameter table on this page comes from the server's own tool schema.
Register the Dev MCP server in PolicyLayer and add a rule for validate_theme: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Dev. Nothing to install.
validate_theme is a Read tool with low risk. Read-only tools are generally safe to allow by default.
Yes. Add a rate_limit block to the validate_theme rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.
Set action: deny in the PolicyLayer policy for validate_theme. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.
validate_theme is provided by the Dev MCP server (@shopify/dev-mcp). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.
More on Dev, and thousands of servers like it.
This server
Across the catalogue