dynoweb-shopify-mcp

Connect Claude, Cursor, or ChatGPT to a Shopify store's real visitor data — heatmaps, session replays, funnels, revenue attribution — with ~70 tools that also write back: edit products, launch popups, apply SEO fixes.

A remote MCP server that puts your store's analytics and controls into Claude, Cursor or ChatGPT — 66 tools, the same approval gates as the in-app agent.

If you would rather not open another dashboard, don't. DynoWeb runs a remoteModel Context Protocolserver, so your store's behavioural data and its controls become tools inside whatever AI client you already work in.

The practical difference: instead of navigating to a report, you ask in the place you are already thinking — and the answer arrives next to your code, your notes, or the rest of the conversation.

In your Shopify admin, open DynoWeb and go toSettings → MCP. Everything below happens on that one screen: your endpoint URL, token creation, OAuth credentials, and the list of what is currently connected.

Settings → MCP. Your endpoint, a token generator, OAuth credentials for Claude.ai, and every active connection with a revoke button.

Your endpoint is the URL shown at the top of that page, ending in/api/mcp. It is per-deployment, so copy it from the app rather than from here. The transport isStreamable HTTP, stateless — every request builds a fresh tool surface.

Pick the path that matches your client. Both end up as revocable records on the same settings page.

Claude.ai on the web — use OAuth credentials

Claude.ai's custom connector form does not accept a raw bearer token. It asks for an OAuth Client ID and Secret, so generate a pair instead.

InSettings → MCP → OAuth credentials, name the pair and pressGenerate OAuth credentials. Copy both values immediately — the secret is shown once and never again.

Then in Claude.ai, go toSettings → Connectors → Add custom connector, paste your endpoint URL, openAdvanced settings, and paste the Client ID and Secret. The connection completes in one click — no consent popup and no hop back into the Shopify admin.

Create a token inSettings → MCP → Create a token, copy it, then run:

claude mcp add dynoweb "https://your-endpoint/api/mcp" \ --transport http \ --header "Authorization: Bearer YOUR_TOKEN"

Launchclaude, and confirm it registered withclaude mcp list— you should seedynowebin the output. The app shows this command pre-filled with your real endpoint and token the moment you create one, so there is nothing to assemble by hand.

Add the server to your Cursor MCP config, viaSettings → Cursor Settings → MCPor by editing~/.cursor/mcp.jsondirectly:

{ "mcpServers": { "dynoweb": { "url": "https://your-endpoint/api/mcp", "transport": "http", "headers": { "Authorization": "Bearer YOUR_TOKEN" } } } }

Restart Cursor after saving. The tools appear in Cursor's chat.

Create or edit aCustom GPT, thenConfigure → Actions → Add MCP server. Use your endpoint as the server URL, set authentication toAPI Key → Bearer, and paste your token.

To call tools directly and watch the raw JSON-RPC traffic:

Set transport toStreamable HTTP, paste your endpoint, and use your token as the bearer credential. This is the fastest way to tell a server problem from a client problem.

66 toolson a store with the full Shopify scope set. The exact list depends on which permissions you have granted — a category you have not authorised simply does not appear — and any client can enumerate the live set itself viatools/list.

Standard OAuth 2.0, discoverable. A compliant client configures itself from the endpoint URL alone:

- Authorization server metadata(RFC 8414) andprotected resource metadata(RFC 9728) are served from the conventional.well-knownpaths.
- PKCE withS256is the only code challenge method accepted.
- Two grant types:authorization_codefor interactive clients, andclient_credentialsfor the shop-bound credential pairs you generate in the admin.
- Scopes aremcp:readandmcp:write.
- Redirect URIs are checked against an exact allow-list held in the codebase rather than accepted from the request.

Tokens are stored hashed — the plaintext is returned once and never persisted, the same model as a GitHub personal access token. Every token carries an expiry; there is deliberately no way to mint one that never expires, and the default lifetime is one year. Auth codes live for ten minutes and are single-use, consumed atomically so a replayed exchange fails rather than races.

Tokens and OAuth clients each appear in their own list on the settings page, with the name you gave them, the scopes they hold, when they were created, and when they were last used — or "Never used", which is usually the first sign a setup did not take.

Revoking is immediate. Revoking an OAuth client invalidates every access token that client has ever obtained, not just the newest one. Token issue and revoke events are audit-logged, and so is every individual tool call, with the client identity attached.

An external client does not get a wider blast radius

Tokens are shop-scoped and bound to a single store server-side. Clients never pass a shop identifier in tool arguments, so a token issued by your store can only ever read and write your store's data.

- You are a developer.Reading conversion data next to the theme code you are about to change beats alt-tabbing to a dashboard and back.
- You want your own analysis.The query tools return structured data. Compose, join and chart it however you like, in a client that already does that well.
- You are building something.An internal report, a Slack digest, a weekly-summary agent — the tools are the API.
- You keep asking the same question.Save it as an insight, or wire it into a scheduled prompt in your client.

- A token is a credential.It grants a client read and write access to your store's analytics, products, pages, discounts, themes and popups — the same scope as the in-admin agent. Issue one per client, name them so you can tell them apart, and revoke on suspicion rather than on proof.
- Bounded by your plan, like everything else.MCP calls consume the same daily action allowance and AI budget as in-app use, and there is a separate per-minute rate limit. A busy scripted loop will exhaust a daily allowance — seepricingfor what each plan includes.
- GETon the endpoint is not supported.The server runs stateless, so there is no server-initiated SSE channel to open. A client that expects one is misconfigured.
- Client quality varies.Tool discovery, argument handling and error surfacing differ substantially between MCP clients. A tool that behaves well in one client can be awkward in another.
- Data availability is unchanged.MCP is a different door onto the same data. If a page has no traffic, the tools will say so — they cannot query what was never tracked.
- Interactive OAuth needs a browser.A fully headless environment should use a manually issued token.

](https://dynoweb.app/features/revenue-attribution)

Run positioning, messaging, competitive analysis and launch planning from Claude or ChatGPT with a hosted product marketing MCP server.