The Permission column is what you have to approve for the tool to be offered. A dash means it has no permission of its own and is checked per record instead:
search_resources is offered to everyone, but only finds what you approved.The last column says whether the tool reads or writes. A write asks your client to confirm before it runs.Finding and reading
Reporting
Catalog
Orders and payments
Fulfilment
Stock and purchasing
Sellers
Files
Creating, changing and deleting records
Three tools cover everything your store can write — 38 kinds of record, from products and orders to markets, tax rates and delivery methods — rather than one tool each. Creating an order through an assistant does exactly what creating one in the dashboard does.
The dash is the point: each call is gated on the resource being written, so a
connection approved for products can create a product and is refused a market.
Call
describe_resource for what a resource accepts.
Resources
Beyond tools, the server offers MCP resources — files a client can fetch rather than operations it can run.
A product’s media, an order’s purchase order and an import’s own file are things an assistant puts there rather than reads back, so they are uploads rather than files it can fetch.
What no tool will do
Some things are out of reach whatever you approve.- Keys and codes. API keys, integrations, webhooks and gift card codes are never shown. A gift card code is the money itself, and an integration’s settings hold the passwords for another service.
- Making another way in. An assistant cannot create API keys, roles, staff accounts or register another assistant — so it can never widen its own reach.
- Erasing a customer. GDPR erasure is irreversible and is not something to put behind a single confirmation prompt. Do it in the dashboard.
- Codes that spend money. A gift card or coupon export carries live codes, so no tool creates or reads one. Download it from the dashboard.
Writing records
Two things worth knowing about the generic writes: Nested records travel with their parent. A product’s variants carry their own options, prices and stock levels in the same write, so creating a product with two sized variants is one call rather than four.describe_resource reports what fits inside each list.
A list replaces rather than appends. Sending one variant leaves a product with one variant. Send every row you want to keep.
See also
Permissions and consent
What you approve, and what an assistant can never reach.
Custom tools
Add your own, or expose a workflow your extension ships.