Shopify Storefront MCP in 2026: what moved to UCP

October 15, 2026
Shopify Tips
11 min read
Shopify Storefront MCP in 2026: what moved to UCP

Short answer: In 2026 Shopify moved the Storefront MCP’s catalog and cart tools from /api/mcp to the Universal Commerce Protocol endpoint at /api/ucp/mcp, with the old cart tools maintained until August 31, 2026. One tool stayed where it was: search_shop_policies_and_faqs, which still answers on /api/mcp with no authentication. Merchants don’t configure any of it; agents and apps do.

If you built anything against Shopify’s Storefront MCP in 2025, this is the post you wanted in July and probably found in October. If you’re a merchant who has never heard of MCP, you can skip to the last section: there is exactly one thing on this page you should ever touch, and it’s not an endpoint.

We build Octolift, which calls these endpoints hundreds of times a day to score Shopify products the way an agent sees them, so we lived through the migration. Everything below is from shopify.dev’s own pages, quoted, with the one tested command we use ourselves.

In this post

What was Storefront MCP?

MCP is the Model Context Protocol, the open standard that lets an AI agent call tools over a JSON-RPC connection. Shopify’s Storefront MCP, announced with the Summer ’25 Edition, gave every store a public MCP server at https://{shop}/api/mcp with tools to search the store’s products, manage a cart and answer policy questions, so that any agent (a chat widget, a shopping assistant, a custom bot) could talk to a store without a private API. Shopify even shipped a sample app, shop-chat-agent, to show the pattern.

Then the Universal Commerce Protocol arrived. UCP is the open standard Shopify co-developed with Google, announced in January 2026, and Shopify’s agents documentation now describes its MCP servers as UCP-compliant. Once UCP had its own catalog, cart and checkout specs, running a parallel set of tools on /api/mcp made no sense. So most of Storefront MCP moved.

What moved, and where

Shopify’s migration page, titled “Migrate from Storefront MCP,” puts it in one line: “The catalog and cart tools on https://{shop}/api/mcp were removed.” The replacement is UCP at https://{shop}/api/ucp/mcp, and the page says to “use the Universal Commerce Protocol (UCP) instead.” Tool by tool:

JobOld homeNew homeTools now
Search and read products/api/mcp/api/ucp/mcp (Storefront Catalog MCP)search_catalog, lookup_catalog, get_product
Carts/api/mcp (get_cart, update_cart)/api/ucp/mcp (Cart MCP)create_cart, get_cart, update_cart, cancel_cart
Checkout URLReturned by the cartCheckout MCPhandles the checkout the cart used to link to
Policies and FAQs/api/mcp/api/mcp (unchanged)search_shop_policies_and_faqs
Sample appshop-chat-agentdeprecated, with its tutorial

The same three catalog tools exist at the global level too, at https://catalog.shopify.com/api/ucp/mcp, searching across every Shopify merchant rather than one store. That global endpoint is what the AI channels query, and what we explain from the merchant’s side in how to see what ChatGPT sees on your product.

The dates

The migration page itself carries no dates. The developer changelog does. On June 24, 2026, Shopify posted that “get_cart and update_cart on https://{shop}.myshopify.com/api/mcp are deprecated,” and that “the deprecated tools will be maintained until August 31, 2026,” pointing developers at the Cart MCP tools on /api/ucp/mcp. So as of this writing the window has closed: a cart call to /api/mcp has no supported answer, and the catalog tools on /api/mcp are listed as removed outright.

Why so quick? Our guess, and it is a guess: the AI channels (ChatGPT, Google AI Mode and Gemini, Copilot, Meta) all read Shopify through UCP, so the UCP endpoints were the ones getting production traffic. Keeping the older tools alive would have meant two code paths for the same cart, and nobody at Shopify was going to maintain the one the assistants don’t use.

The one tool that stayed

search_shop_policies_and_faqs is “Unchanged on /api/mcp,” per the migration page, and its own documentation page is the clearest thing in this whole area. Endpoint: https://{storedomain}/api/mcp. Authentication: “No authentication is required.” Inputs: a required query (“The question about policies or FAQs”) and an optional context (“Additional context like the current product being viewed or the customer’s situation”). Output: structuredContent with an answer and a list of sources, each with a title and url. The doc’s own example asks “What is your return policy for sale items?” with the context “Customer is looking at discounted winter jackets.”

This tool matters to merchants more than any other on the page, because it is how an assistant answers “do you ship to Ireland” or “what’s your return window” about your store. The answers come from your published policies and from the FAQs stored through Shopify’s free Knowledge Base app. Octolift’s Knowledge base page asks this exact endpoint the ten questions shoppers ask most and shows you the answers word for word, which is how we found that a store with a perfectly good returns page can still answer “I don’t have information about that” because the policy was never published as a policy.

Try the new catalog endpoint in one command

The one thing UCP insists on that the old MCP didn’t is an agent profile: a public JSON file describing what the caller supports, passed in every request as meta.ucp-agent.profile. Shopify hosts example profiles for exactly this, so a plain curl works. We run this against our own demo stores; swap in any store domain.

STORE="https://your-store.com"
PROFILE="https://shopify.dev/ucp/agent-profiles/2026-04-08/valid-with-capabilities.json"

curl -s -X POST "$STORE/api/ucp/mcp" \
  -H "Content-Type: application/json" -H "Accept: application/json" \
  -d '{
    "jsonrpc": "2.0", "id": 1, "method": "tools/call",
    "params": {
      "name": "search_catalog",
      "arguments": {
        "meta": { "ucp-agent": { "profile": "'"$PROFILE"'" } },
        "catalog": { "query": "linen shirt", "pagination": { "limit": 3 } }
      }
    }
  }'

Two things to know about the response. The catalog payload comes back as a JSON string inside result.content[0].text, so decode it before reading products. And the storefront endpoint and the global endpoint differ here: global answers in result.structuredContent as a plain object. Each product carries title, description, url, price_range, options with every value label, variants with price and availability, media, categories and collections. An empty query with a limit of 10 is the fastest way to see which products the catalog holds for a store at all.

A password protected store returns nothing here even though its /.well-known/ucp discovery file still answers, which is a tidy demonstration of the difference between “has UCP” and “is in the catalog.” The eligibility rules behind that are in Shopify products not showing in ChatGPT.

Migration notes for developers

From the June 24 changelog, the four things a cart integration has to change:

  1. Point get_cart and update_cart calls at the Cart MCP tools on https://{shop-domain}/api/ucp/mcp, and add create_cart and cancel_cart where you need them.
  2. Add a meta object carrying ucp-agent.profile to every request. For cancel_cart, also send a UUID in meta["idempotency-key"].
  3. Treat update_cart as PUT: “send the complete line_items array on every update rather than patching individual fields.”
  4. Re-read the request and response schemas for all four cart tools; they are not the old shapes.

And if your bot was built from the shop-chat-agent sample, start from Shopify’s UCP docs instead; the sample and its tutorial are deprecated. One more thing we’d add from experience: the catalog read works at the anonymous tier with the lowest rate limit, which is plenty for a chat widget and not plenty for a crawler. Cache the product reads.

What a merchant should (and should never) touch

Nothing on /api/mcp or /api/ucp/mcp is configurable from the admin. They exist for every store, they read your published products and policies, and there is no switch for them separate from the channel toggles on the Agentic page. If a guide tells you to “enable your store’s MCP,” close it. What you can change is what those endpoints return, and that is ordinary store hygiene:

  • Policies. Refund, shipping, privacy, terms, written and published under Settings, Policies. That is what the FAQ tool answers from.
  • Store FAQs. Shopify’s free Knowledge Base app stores the question and answer pairs the FAQ tool reads. If “do you ship internationally” has no stored answer and your shipping policy doesn’t say, the agent says it doesn’t know.
  • Product data. The catalog tools return your title, description, options, prices and availability exactly as entered. The five signals Shopify grades are the checklist, and they’re in Shopify’s five listing quality signals for AI.
  • Crawler rules. Nothing here reads robots.txt; the catalog is fed by Shopify, not crawled. Blocking bots affects only the open web path, as our rubikify.com post on whether to block AI bots explains. Check yours with the AI bot checker.
  • Product structure. Each product is one catalog record. Colours sold as separate products are separate records, which is fine as long as each is complete; an app that groups them with swatches on the storefront doesn’t change what the endpoint returns.

Run the page side through the AI readiness checker if you want a second opinion on markup, with the caveat that the endpoints on this page never look at your markup at all.

Frequently asked questions

Is Shopify Storefront MCP deprecated?

Mostly. Shopify’s migration page says the catalog and cart tools on /api/mcp were removed in favour of the UCP endpoint at /api/ucp/mcp, and the June 24, 2026 changelog set August 31, 2026 as the end of support for the old cart tools. The search_shop_policies_and_faqs tool is unchanged on /api/mcp.

Does /api/ucp/mcp need an API key?

Not for catalog reads. It needs an agent profile URL in every request’s meta, and Shopify hosts example profiles you can use. The policies and FAQs tool on /api/mcp needs no authentication at all.

Do I need to enable MCP or UCP on my Shopify store?

No. Both endpoints exist for every store and read your published products and policies. The only related switches are the AI channel toggles under Sales channels, Agentic, which control whether Shopify Catalog shares your products with each assistant.

Where do the answers from search_shop_policies_and_faqs come from?

From your published store policies and the FAQs stored through Shopify’s Knowledge Base app. The tool returns an answer plus the source pages it used. If a question has no answer in either place, the agent has nothing to say.

What is the difference between the store endpoint and catalog.shopify.com?

The store endpoint at /api/ucp/mcp searches one store and returns its payload as a JSON string inside result.content. The global endpoint at catalog.shopify.com/api/ucp/mcp searches every Shopify merchant and returns a plain object in result.structuredContent. Both use the same three tools and the same agent profile requirement.

The endpoints moved; what they return didn’t. If you want to know what yours return today without writing a line of JSON, the four free views of your catalog record get you there in ten minutes.

Co-Founder at Craftshift

You may also like

Available on the Shopify App Store