run_shopifyql_query

What run_shopifyql_query does on Shopify Graphql

AI agents invoke run_shopifyql_query to trigger actions in Shopify Graphql. What it does depends on the arguments the agent supplies, and its effects often reach beyond the immediate call: builds kicked off, notifications sent, workflows started.

Why run_shopifyql_query is rated High

This tool falls under Execute rather than Read because it actively runs/executes queries whose effects and data access scope depend entirely on the query arguments provided by the AI agent. While it may appear read-only (analytics/reporting), ShopifyQL execution can access and retrieve sensitive business data at scale, and in some contexts query execution itself can have side effects or resource implications.

From the tool's definition Tool description states 'Execute a ShopifyQL query' — the verb 'Execute' combined with the capability to run arbitrary ShopifyQL queries indicates this tool runs user-supplied code/queries against the Shopify backend.

The rule that runs run_shopifyql_query safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Shopify Graphql, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For run_shopifyql_query, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "run_shopifyql_query": {
      "limits": [
        {
          "counter": "run_shopifyql_query_rate",
          "window": "minute",
          "max": 10,
          "scope": "grant"
        }
      ]
    }
  }
}

Questions about run_shopifyql_query