Shopware MCP Server

What is an MCP server for Shopware?

If you run a Shopware shop with several thousand items, your own custom fields and multiple sales channels, you know the bottleneck: checking stock, maintaining category SEO and answering order status requests costs daily back-end clicks and staff time — and every new AI experiment quickly ends up in its own script or a fragile Zapier flow. This is exactly where an MCP server for Shopware comes in: it lets AI models such as Claude, GPT or Copilot act on the Shopware Admin API via the Model Context Protocol, so that an agent accesses products, categories, orders, customers and themes in a standardised way — for reading and writing, through a single clean interface instead of many isolated solutions. You can find a general introduction to the protocol in the article "What is an MCP server?".

Shopware now ships a native MCP server in the core: from Shopware 6.7.11.0 it is included behind the feature flag MCP_SERVER, and the flag is dropped with 6.7.14.0. The endpoints are /api/_mcp (Admin API, login via integration or OAuth) and /store-api/_mcp (Store API). Until Shopware 6.8 the server is considered experimental, so tool names and interfaces may still change (Shopware docs). The former repository shopware-admin-mcp has been archived since July 2026 (GitHub). As soon as it comes to your specific workflows — your own custom fields, B2B suite structures, multi-channel sales channels or the connection to your own agent — we supplement the native server with a tailor-made integration with its own tools, fixed rights, approval steps and a log that maps exactly your data models and permissions.

Typical users are shop owners and e-commerce managers with real revenue, for whom manual product and content maintenance noticeably costs staff time. Anyone maintaining hundreds or thousands of items gains above all time back from an MCP server — and consistency across all sales channels.

Use cases: what can a Shopware MCP server do in concrete terms?

1. Stock queries in natural language "Which products have fewer than 5 units in stock?" or "Show me all items without an image in the Winter Jackets category." The agent pulls the data via the Admin API and answers directly — without filter clicks in the back end.
2. SEO meta copy per category and product The agent generates meta titles, meta descriptions and category introductions to match the range and tone. In setups known to us, this runs as a draft workflow: suggestions are generated, a human approves, and only then does the server write back.
3. Order status information "How many open orders are waiting to be shipped?" or "Which orders are stuck in the status payment pending?" The agent reads the order status and delivers a compact analysis — also as the basis for a daily stand-up briefing.
4. Content and master data maintenance The agent spots missing product descriptions, inconsistent attributes or empty custom fields. It proposes corrections and, after approval, applies them as a change — instead of someone going through them line by line.
5. Multi-channel and B2B consistency With multiple sales channels or a B2B suite, the agent checks whether prices, visibility and assignments are right per channel — and reports deviations before a customer sees them.
6. Campaign and range reporting "Which products of a brand were ordered most often last month?" The agent condenses order and product data into an answer, without you having to build an export and prepare it in Excel.

How the integration works

Architecture for Shopware:

AI agent ↔ MCP server (your EU host) ↔ Shopware Admin API (OAuth 2.0, REST/JSON)

Concrete technical steps:

• OAuth setup & integration credentials: You create an integration with defined permissions in Shopware. The MCP server authenticates via OAuth 2.0; the credentials are stored encrypted on the EU host, with rotation.
• Tool mapping: We define MCP tools such as list_low_stock_products, get_order_status, update_category_seo or create_product_draft — each with a JSON schema, validated inputs and clear error messages.
• API scopes instead of a blanket power of attorney: The agent receives only the rights a use case really needs. Read access to products and orders can be strictly separated from write rights.
• Separating read and write: By default the agent reads or creates drafts. Publishing, price changes or status updates require human approval — configurable per tool.
• Logging: Every API action is logged with timestamp, executing tool and diff — important for traceability in a live shop.

Whether a connection to a CRM such as Salesforce or another back end makes sense alongside is something we clarify in the audit — many shops benefit from several clearly separated MCP tools instead of a single mega-integration. The fundamental difference between MCP and classic API function calling is explained in the guide MCP vs. API & function calling.

GDPR, hosting & security

A shop processes order and customer data — so the data chain has to be handled with corresponding care. To make sure an MCP server for Shopware can be operated in line with data protection, we pay attention to:

• EU hosting of the MCP server (Hetzner or the Azure region Germany West Central in Frankfurt) — ideally in the same region as your Shopware instance, so that product and order data do not leave the European processing path.
• Shopware integration with minimal scopes: The OAuth credentials of the Admin API integration are stored encrypted and carry only the permissions the respective use case needs — with a rotation and revoke strategy in case a key is compromised.
• DPA with the AI provider with EU data residency (Claude via AWS Bedrock in the EU Frankfurt region, OpenAI Enterprise EU, Azure OpenAI in an EU region).
• Data minimisation for order data: For order and customer queries, the server filters the Admin API response down to the necessary fields — real names, delivery addresses or payment data of shoppers stay out when the task (such as a pure status or unit count analysis) does not require them.
• Sales channel and B2B separation: If several sales channels or B2B suite clients run through one Shopware instance, the agent is delimited per channel so that it never sees prices, customers or visibility settings from other channels.

More on this topic in the guide MCP server: security & GDPR.

What does it cost?

Because Shopware offers a documented Admin API with OAuth, getting started is comparatively quick. Concretely, that means:

• Read-only use cases first, write use cases afterwards — for example stock and order queries as a safe, low-risk start.
• Clear scope per use case, no hourly guessing game. Write workflows follow in small, clearly delimited steps.
• Incremental expansion: You start with one delimited tool and expand only where the time savings show — no big-bang project.

We name the concrete figure in the initial consultation — depending on range size, number of sales channels, desired tools and whether write actions such as SEO maintenance are included. The MCP integration agency page describes the service as a whole; the MCP cluster bundles the full tool overview.

Frequently asked questions

Which Shopware version and API do I need for this?

A custom MCP server builds on the Shopware 6 Admin API (REST/JSON, OAuth 2.0). The native MCP server is available from Shopware 6.7.11.0 (behind a feature flag up to 6.7.14.0, experimental until 6.8). Cloud and self-managed shops can both be connected, as long as API access with integration credentials can be set up. We clarify the exact constellation in the audit.

What is the difference from Shopware's native MCP server?

The native MCP server is included in the core from Shopware 6.7.11.0, is considered experimental until Shopware 6.8 and provides Shopware's own tools via /api/_mcp and /store-api/_mcp; the former repository shopware-admin-mcp is archived. A tailor-made integration connects exactly your workflows, custom fields, B2B suite structures and your own agent — with API scopes tailored to the use case, approval steps and a log.

Can the AI change orders or prices on its own?

By default the agent reads or creates drafts. We limit write actions such as price changes or order status updates to narrow API scopes and human approval — for a revenue-generating shop in particular, this is the recommended configuration.

What does a realistic example project look like?

As an anonymised, realistic sketch (not a specific reference): a fashion shop starts with read-only stock and order queries, then adds a draft workflow for category SEO copy and finally enables reviewed master data maintenance. Each step is its own delimited use case.

Is Shopware with an MCP server GDPR-compliant?

Yes, if the chain is right: the shop is hosted in the EU, the MCP server runs on an EU host and the AI provider is chosen with EU data residency and a DPA. Then the data chain stays in Europe.

How quickly is a Shopware MCP integration productive?

We set the timeline after the AI Check. Read-only use cases such as stock and order queries come first because they need no write rights. Write content and maintenance workflows follow in further increments.

Which AI models work?

Because the MCP server connects on the protocol side and not the model side, it does not matter whether Claude, ChatGPT, Gemini or Microsoft Copilot is working in the background — all MCP-capable models address the same Shopware tools. You can switch provider later without rebuilding the integration.