# Shopify AI Toolkit: an agent plugin that teaches a CLI or IDE the Shopify platform > The Shopify AI Toolkit is a plugin for AI agents that gives them search over Shopify documentation and API schemas, validation for GraphQL, Liquid and UI extensions, and store management through the Shopify CLI. It installs into Claude Code, Codex, Cursor, Hermes, OpenClaw, Pi and VS Code, and it ships with telemetry on by default. **Shopify/Shopify-AI-Toolkit** — Agent plugins/extensions for CLIs and IDEs - Repository: https://github.com/Shopify/Shopify-AI-Toolkit - Stars: 613 · Forks: 87 - Language: JavaScript - License: MIT - Published: 2026-10-22 · Updated: 2026-10-22 · Language: en - Canonical page: https://hysenlabs.com/projects/shopify-shopify-ai-toolkit ## One plugin, seven hosts, and the same four capabilities The Shopify AI Toolkit is described as agent plugins and extensions for CLIs and IDEs, and the pitch in a single line is connecting your AI tools to the Shopify platform. What the agent gets is described in four bullets. Docs and API schemas, so the agent can search Shopify documentation and API schemas without leaving the editor. Code validation, for GraphQL queries, Liquid templates and UI extensions against Shopify schemas. Store management, through the CLI's store execute capabilities. And auto-updates, so the plugin updates itself as new capabilities are released. The multi-host story is the interesting engineering decision. The same repository is installable as a Claude Code plugin, a Codex plugin, an Antigravity CLI plugin, a Cursor plugin, a Hermes plugin, an OpenClaw plugin, a Pi package and a VS Code agent plugin. The README describes the same set as a native OpenClaw plugin and a compatible Agent Plugins bundle. The repository layout explains how that is possible without eight separate codebases. There are host-specific directories, .claude-plugin/, .codex-plugin/, .cursor-plugin/ and .hermes-plugin/, plus .agents/ and skills/ for the shared skill definitions, a .mcp.json for the MCP server, an openclaw.extension.mjs and openclaw.plugin.json for the OpenClaw surface, and a gemini-extension.json for Gemini. The skills/ directory holds the actual skills, with scripts/ directories inside them. The package manifest is private and named shopify-plugin at version 2.2.0, and the executable files list names the individual scripts that get exposed, including the validation scripts for GraphQL, functions, theme and components, the docs search script, and separate ucp/ variants of the logging scripts. The licence is MIT, the default branch is main, and the last push was on 2026-10-16, with v2.2.0 tagged the same day after v2.1.2 on 2026-10-14 and v2.1.1 on 2026-10-08. ## Installing is a different command in every host, and the npm path is shared The install section is a list of hosts, and the commands differ because each host has its own plugin system. Only one of them is a plain package manager. For Claude Code it is a plugin install. ```bash claude plugin install shopify-ai-toolkit@claude-plugins-official ``` For OpenAI Codex it is a plugin add from a curated registry. ```bash codex plugin add shopify@openai-curated ``` For Antigravity CLI the plugin comes straight from the GitHub URL. ```bash agy plugin install https://github.com/Shopify/shopify-ai-toolkit ``` For Cursor it is a chat command rather than a terminal command. ```bash /add-plugin shopify ``` Hermes takes a downloaded script. ```bash curl -fsSL https://raw.githubusercontent.com/Shopify/Shopify-AI-Toolkit/main/.hermes-plugin/install.sh -o /tmp/shopify-hermes-install.sh bash /tmp/shopify-hermes-install.sh ``` OpenClaw and Pi both install from npm, and both accept a git mirror as an alternative. ```bash openclaw plugins install npm:@shopify/ai-toolkit ``` ```bash pi install npm:@shopify/ai-toolkit ``` ```bash pi install git:github.com/Shopify/Shopify-AI-Toolkit ``` OpenClaw also accepts a ClawHub source, written as openclaw plugins install clawhub:@shopify/ai-toolkit. VS Code is the outlier, because it needs a preview feature enabled first. You have to ensure the Agent plugins preview is enabled in your VS Code settings, then run Chat: Install Plugin From Source from the Command Palette, then enter the repository URL when prompted. The variation across all of these is a cost of the multi-host approach. Eight hosts means eight install commands to document and keep working, and a user on the eighth host is the one who finds the break. ## Telemetry is on by default and it carries your prompts This is the part of the README that deserves a careful read, because the defaults are not what most people assume. The skill scripts, which the README names as scripts/search_docs.mjs, scripts/validate.mjs and scripts/log_skill_use.mjs, send a usage event to https://shopify.dev/mcp/usage on each invocation. The payload includes the tool name, skill name and version, the model name, client name and client version, and the search query text along with the search response or error text. For validation it includes the validation result, the validated code when present, and context such as API name, extension target, filename, file type, theme path and file list. And the most sensitive item of all. The user's most recent message verbatim, truncated to 2000 characters, is included when the agent passes it base64-encoded via --user-prompt-base64. The README explains the reason for the encoding: it keeps untrusted message text out of shell syntax. There is exactly one designated capture point per topic, and search_docs.mjs does not carry a user prompt. There is a second telemetry surface, a PostToolUse hook registered on Claude Code, Cursor and GitHub Copilot through hooks/track-telemetry.sh and a .ps1 variant. It emits a skill_invocation event whenever the agent calls the host Skill tool with a Shopify skill or reads a known SKILL.md under the running hook's own install root. The root is derived from the hook script's physical location, so unrelated repositories that merely mimic an install path suffix do not trigger telemetry. On Claude Code only, and only when a Shopify skill activates, the hook can attach the most recent prompt verbatim, captured out of band through a UserPromptSubmit hook that stashes it locally. The hook honours an OPT_OUT_INSTRUMENTATION environment variable. Other hosts carry no prompt on that surface. The README is explicit about what is not collected. The hook does not report tool inputs, file contents, generated code or other tool arguments. So the honest summary is that a skill invocation can carry your query text, the code you validated, and on Claude Code the prompt you last typed. That is not a trivial telemetry payload, and it is on by default. ## Opting out is one file, and it covers every surface at once There are two ways to opt out, and the README says either is sufficient on its own. The first is a user-level opt-out file, and the README calls it the recommended method because it does not depend on the agent passing your shell environment through to the processes it spawns. ```bash mkdir -p ~/.config/shopify-ai-toolkit && touch ~/.config/shopify-ai-toolkit/opt-out ``` The second is the environment variable approach, which the README notes is less reliable because it depends on the agent forwarding the environment. What opting out covers is stated precisely: telemetry is on by default, and opting out applies to every surface at once, covering the skill scripts, the MCP server and the hooks. It also stops local capture, so no prompt is stashed to disk. That last point matters more than it sounds. On Claude Code the UserPromptSubmit hook stashes your prompt locally, and if the plugin is installed standalone through npx skills add Shopify/shopify-ai-toolkit, the same script is injected into each generated SKILL.md as a hooks frontmatter block. So the behaviour of a standalone skill and a full plugin install converges, and so does the opt-out. The README also documents a deduplication concern that comes with having two surfaces. Events from each source are labeled with hookSource and carry sessionId plus toolUseId inside the body's parameters object, so downstream consumers can dedup on the pair when both surfaces are installed. The file check path table in the README lists the locations per platform, and the hooks/README.md file is the reference for full coverage details. ## Skills, an MCP server and a validation surface The package keywords list mcp, graphql, liquid, storefront, admin-api and plugin, and those map onto the three things the toolkit actually does. The first is retrieval. search_docs.mjs is the script that queries Shopify documentation and API schemas, and it takes an --api flag for a scoped search or a --topic flag for an unscoped one, and that topic is what gets reported as the routing table topic in the telemetry payload. The second is validation. The executable files list names _validate_graphql.mjs, _validate_theme.mjs, _validate_functions.mjs and _validate_components.mjs, and validate.mjs is the entry point that dispatches to them. That covers the three things the README promises to validate: GraphQL queries, Liquid templates, and UI extensions. The telemetry description confirms the shape, since the validation payload carries the API name, extension target, filename, file type and theme path, which is exactly the set of things that distinguishes a GraphQL operation from a Liquid template from an extension component. The third is the MCP server, configured through .mcp.json at the repository root. The telemetry section mentions it alongside the skill scripts and the hooks as one of the three surfaces that the opt-out covers. Store management goes through the Shopify CLI rather than through the toolkit itself. The README is specific that it is the CLI's store execute capabilities, so the plugin is pointing the agent at an existing CLI surface rather than reimplementing API access. That distinction is worth keeping in mind, because it means the authentication and permission model is the CLI's, not the plugin's. There is also a feedback path, since log_feedback.mjs sits alongside the logging scripts in the executable files list, and a mock shop catalog import script, import_mock_shop_catalog.mjs, which suggests the toolkit can populate a local catalog for testing. ## Where the Shopify AI Toolkit is the wrong tool The first wrong-tool case is an organisation with a policy against sending code and prompts to a vendor endpoint. The telemetry payload includes the search query text and the search response, the validation result and the validated code when present, and on Claude Code the most recent user prompt verbatim. That is a design decision with a plausible rationale, since the vendor wants usage data to improve the routing, but it means that installing the plugin puts a Shopify-controlled endpoint in the path of your code and your prompts unless you take the opt-out step first. The second case is a multi-host estate. The plugin registers a PostToolUse hook on Claude Code, Cursor and GitHub Copilot, and the same script is injected into generated SKILL.md files so that standalone skills behave identically. On a machine where several agents run, that is a hook firing in several places, and the file-based opt-out is the only method the README says works everywhere. The third case is a team that wants a different validation approach. The validators here check against Shopify's schemas, which is the right check for a Shopify app, but it is not a general-purpose linter and it does not replace a project's own test suite. A team that wants their own GraphQL rules, or their own Liquid conventions, gets Shopify's opinion only. The fourth case is a developer who does not want a plugin at all. The underlying capabilities are reachable without the agent: Shopify documentation is public, the Shopify CLI can validate and deploy, and the API schemas are documented. What the plugin adds is convenience for an agent, not new capability. If you are working without an agent, the toolkit solves a problem you do not have. On maintenance and versioning, the cadence is fast and the version numbers say so. v2.2.0 landed on 2026-10-16, v2.1.2 on 2026-10-14, v2.1.1 on 2026-10-08, and the last push was on 2026-10-16 as well. Three releases in eight days on a 2.x line is a project changing quickly, and since the plugin auto-updates as new capabilities are released, a team that pins versions of its agent tooling may find the Shopify plugin moving independently of it. The repository also carries a deprecated/ directory, which shows that surfaces have been retired as the supported hosts changed. On licence, the repository is MIT with the LICENSE file at the root, which covers the plugin code itself. It does not change the terms under which Shopify documentation and API schemas are made available, and the store management path runs through the Shopify CLI, so the platform terms of the CLI and of the Admin API apply there. Those are separate from the plugin's own licence and worth reading rather than assuming. ## Conclusion The Shopify AI Toolkit suits a developer building Shopify apps who wants their agent to look up current platform documentation instead of guessing at API shapes, and who wants a pre-deploy check on GraphQL and Liquid before it reaches the store. It does not suit a team that cannot accept a plugin that sends usage data to Shopify by default, because telemetry is on by default and includes search queries and validation results. Before installing, run the opt-out command so the decision is yours rather than the default, then read hooks/README.md, since the PostToolUse hook on Claude Code, Cursor and GitHub Copilot attaches the most recent user prompt to the event payload. ## FAQ ### What is the Shopify AI Toolkit? It is a set of agent plugins and extensions for CLIs and IDEs that connect an AI agent to the Shopify platform. The agent gets search over Shopify documentation and API schemas, validation of GraphQL, Liquid and UI extension code, and store management through the Shopify CLI's store execute capabilities. ### How do I install the Shopify AI Toolkit? The command depends on the host. For Claude Code use claude plugin install shopify-ai-toolkit@claude-plugins-official, for Codex use codex plugin add shopify@openai-curated, for OpenClaw and Pi use the npm package, and for VS Code enable the Agent plugins preview then run Chat: Install Plugin From Source with the repository URL. ### Does the Shopify AI Toolkit send telemetry? Yes, and it is on by default. The skill scripts send a usage event to https://shopify.dev/mcp/usage on each invocation, including the search query text and the validated code when present, and on Claude Code a hook can attach the most recent user prompt verbatim when a Shopify skill activates. ### How do I disable the Shopify AI Toolkit telemetry? Create the opt-out file with mkdir -p ~/.config/shopify-ai-toolkit && touch ~/.config/shopify-ai-toolkit/opt-out. The README calls the file method the recommended one because it does not depend on the agent passing your shell environment to the processes it spawns, and opting out covers the skill scripts, the MCP server and the hooks at once. ### Which AI tools can the Shopify AI Toolkit be installed into? The README lists Claude Code, OpenAI Codex, Antigravity CLI, Cursor, Hermes, OpenClaw, Pi and VS Code. The repository carries a host-specific directory for each of those plus a shared skills/ directory and a .mcp.json for the MCP server. ### What license is the Shopify AI Toolkit released under? The plugin code is released under the MIT license, with the LICENSE file at the root of the repository and MIT declared in the package metadata. The current release is v2.2.0, tagged on 2026-10-16. ## Sources - [Issues](https://github.com/Shopify/Shopify-AI-Toolkit/issues) - [License: MIT](https://github.com/Shopify/Shopify-AI-Toolkit/blob/main/LICENSE) - [README](https://github.com/Shopify/Shopify-AI-Toolkit/blob/main/README.md) - [Releases](https://github.com/Shopify/Shopify-AI-Toolkit/releases) - [Shopify/Shopify-AI-Toolkit on GitHub](https://github.com/Shopify/Shopify-AI-Toolkit) --- Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/shopify-shopify-ai-toolkit