Add your Magento store to Claude as a connector

I've released a Magento module that lets you add your store to Claude as a connector. You paste one URL into Claude's connector settings, Claude sends you to your own Magento admin to log in and approve access, and that's it. It uses OAuth, so there are no API keys to generate, no integration tokens to copy around and nothing to install on anyone's laptop.

Once it's connected, you can ask Claude about your store in plain English. Which products in this category have no images, what did this customer order last month, how many orders are sitting in processing. Until now, answering questions like those meant clicking through admin grids, exporting a CSV, or asking a developer to write a query. Most of the questions never got asked because the effort wasn't worth it.

What it is

The module turns a Magento 2 or Adobe Commerce store into a Model Context Protocol server. MCP is the open standard Claude uses to talk to outside systems, and a connector is simply an MCP server that Claude reaches over the web. With the module installed, Claude can run read-only GraphQL queries against your product, category, customer and order data, acting as the admin who connected it and limited by that admin's existing Magento permissions.

Add it to Claude as a connector

This is the part I most wanted to get right, because it decides whether anyone beyond the developer ever uses it. After the module is installed, connecting takes about a minute:

1. 01In the Magento admin, go to Stores > Configuration > Advanced > AI Connector (MCP) and set the Public Base URL to your store domain, for example https://your-domain.com. It needs to be HTTPS, with no path on the end.
2. 02Under System > Permissions > User Roles, grant the "AI Connector (MCP)" permission to the role that should be allowed to connect. No role has it by default.
3. 03In Claude, open Settings > Connectors, choose to add a custom connector, and paste in your connector URL.
4. 04Claude sends you to your own Magento admin. Log in as usual and approve the access request.
5. 05Go back to Claude and ask it something about your store.

The connector URL is your store domain with /mcp on the end:

https://your-domain.com/mcp

The login in step 4 is OAuth 2.1, the same kind of flow you've used every time you've clicked "Sign in with Google". Claude registers itself with your store, you consent in the Magento admin, and Magento issues Claude a token that only works against the connector. Your password never goes near Claude, and you never see or handle the token.

That matters more than it sounds. Because each person connects with their own admin login, everyone on the team can add the store to their own Claude account, and each of them acts under their own Magento role. Your merchandiser sees what a merchandiser can see. There's no shared API key in a password manager, and when somebody leaves you disable their admin account the way you already would.

Installing the module

This is the one step that needs a developer. It's a standard Composer install:

composer require upturnstudio/module-mcp
bin/magento module:enable UpturnStudio_Mcp
bin/magento setup:upgrade
bin/magento cache:flush

If the store runs in production mode, run bin/magento setup:di:compile before the cache flush.

Or run it locally

If you're a developer working in Claude Code or Claude Desktop, you can skip the web connector and run the server over stdio instead. There's no OAuth in this mode, because you name the admin user it should act as:

bin/magento mcp:serve --admin-user=<username>

There's also bin/magento mcp:inspector --admin-user=<username>, which opens an interactive inspector so you can see what the server exposes and try calls by hand.

Two tools, on purpose

The module gives Claude two tools. The first, introspect_graphql_schema, returns your store's full GraphQL schema. The second, execute_graphql, runs a query. That's the whole surface area.

I could have written a tool per question: one for orders, one for stock, one for customers. Instead Claude reads the schema, works out what your store offers, writes a query, looks at the result and refines it. Nobody has to write integration code for each new question, and anything your other modules add to the schema is available without extra work.

If you do want something more specific, other modules can register their own tools by implementing UpturnStudio\Mcp\Api\ToolInterface.

The security model

Connecting an AI to a store that holds customer data is a fair thing to be nervous about, so here's exactly what the module does:

• It is read-only. Mutations are refused whatever role the admin has, so Claude cannot change a price, edit a customer or cancel an order.
• Nobody can connect until you say so. The "AI Connector (MCP)" permission is not assigned to any role by default.
• Tokens only work against the connector. A leaked token is useless against Magento's /rest or /graphql endpoints.
• Admin access is checked again on every call. Disable an admin account and their connector stops working immediately.
• Refresh tokens rotate each time they are used. If an old one is replayed, every token in that chain is revoked and the admin has to approve access again.

The short version

• Your Magento store can be added to Claude as a connector: paste https://your-domain.com/mcp into Settings > Connectors and approve access in your Magento admin.
• It uses OAuth 2.1, so there are no API keys to manage and each person connects under their own admin permissions.
• Claude gets read-only GraphQL access to products, categories, customers and orders. It cannot change anything.
• Developers can run it locally over stdio for Claude Code and Claude Desktop.
• It is MIT licensed and on GitHub at github.com/brideo/magento-mcp.

If you'd like a hand installing it, setting up a properly scoped role, or building custom tools for the questions your team asks most, get in touch.