# Connect AI tools with MCP

> Use ShopFast from Claude, ChatGPT, Cursor, VS Code and any MCP client: setup, sign-in and what the AI can do.

Source: https://shopfa.st/docs/ai/mcp

ShopFast runs a remote [MCP](https://modelcontextprotocol.io) server. Connect it once and your AI tool can read and
run your store: products and stock, orders and refunds, customers, discounts, analytics, support tickets, themes and
webhooks. It works as you, inside one store, and only does what your role allows.

| | |
| --- | --- |
| **Server URL** | `https://api.shopfa.st/mcp` |
| **Transport** | Streamable HTTP (MCP 2026-07-28, and 2025-06-18 / 2025-11-25 for older clients) |
| **Sign-in** | OAuth 2.1 in your browser, or an API key |
| **Who can connect** | The store owner, and teammates the owner turned **Use AI** on for |

## Connect your AI tool

You only paste the URL. The tool opens ShopFast in your browser, you pick the store and approve, and it is connected.

### Claude (claude.ai and Claude Desktop)

1. Open **Settings → Connectors** and choose **Add custom connector**.
2. Name it `ShopFast` and paste `https://api.shopfa.st/mcp`.
3. Choose **Connect**, sign in to ShopFast and approve.

### Claude Code

```sh
claude mcp add --transport http shopfast https://api.shopfa.st/mcp
```

Then run `/mcp` inside Claude Code and choose **shopfast** to sign in.

### ChatGPT

In **Settings → Connectors**, add a custom connector with the URL `https://api.shopfa.st/mcp` (developer mode for
actions that change your store). Approve it in the browser window that opens.

### Cursor

Use the **Add to Cursor** button in **Settings → Headless & MCP**, or add this to `~/.cursor/mcp.json`:

```json
{
  "mcpServers": {
    "shopfast": { "url": "https://api.shopfa.st/mcp" }
  }
}
```

### VS Code

Use the **Install in VS Code** button in **Settings → Headless & MCP**, or add this to `.vscode/mcp.json`:

```json
{
  "servers": {
    "shopfast": { "type": "http", "url": "https://api.shopfa.st/mcp" }
  }
}
```

### Any other client

Any client that supports remote MCP servers with OAuth connects with the URL alone. It finds everything else on its
own:

- `https://api.shopfa.st/.well-known/oauth-protected-resource/mcp` (RFC 9728)
- `https://api.shopfa.st/.well-known/oauth-authorization-server` (RFC 8414)
- Dynamic client registration at `https://api.shopfa.st/v1/oauth/register` (RFC 7591), or a client ID metadata document

### Clients that only run local servers (stdio)

The [ShopFast CLI](https://shopfa.st/docs/cli) relays stdio to the remote server with your API key:

```sh
shopfast login --key sk_live_…
shopfast mcp
```

In the client's config, run the command `shopfast` with the arguments `mcp`.

## What you approve

The consent screen shows the AI tool's name, where your browser goes next, and what it asks for. Choose:

- **Read only**: it can look at everything its scopes cover and change nothing.
- **Read and change**: it can also make changes. Risky ones still wait for you (see below).

A tool that registered itself shows as **Unverified**, with the address it sends you back to. If you did not just
start connecting from that tool, cancel.

You can disconnect any AI tool at any time in **Settings → Headless & MCP → AI connections**. Its tokens stop working at
once.

## Use an API key instead

For clients that cannot do OAuth, create a key in **Settings → Developers → API keys** and send it as a header:

```json
{
  "mcpServers": {
    "shopfast": {
      "url": "https://api.shopfa.st/mcp",
      "headers": { "Authorization": "Bearer sk_live_…" }
    }
  }
}
```

The key acts as the teammate who created it, so the same AI access rule applies: it needs **Use AI**.

## Keep the tool list short

Some clients cap how many tools they load. Ask for only the groups you need:

```text
https://api.shopfa.st/mcp?toolsets=catalog,orders,support
```

Groups: `store`, `catalog`, `orders`, `customers`, `discounts`, `analytics`, `support`, `storefront`, `money`,
`webhooks`, `api` and `docs`. The [tools reference](https://shopfa.st/docs/ai/mcp-tools) lists what is in each.

## What it can and cannot do

- It works through the same API and permissions as the dashboard. A teammate whose role cannot see finance gets no
  finance tools.
- Changes that move money back to a buyer, delete something, email buyers or go live ask for your confirmation every
  time, with a preview first.
- It **never** moves money out of your store or touches sign-in: no payouts, withdrawals, payout wallet, billing, AI
  credits, API keys, apps, two-factor or ownership. Those stay in the dashboard.
- Every call shows in **Settings → Headless & MCP → Activity**, and every change in the audit log marked **via MCP**.

Read [AI permissions and safety](https://shopfa.st/docs/ai/safety) for the details.

## Troubleshooting

| What you see | What to do |
| --- | --- |
| The connector shows no tools | Your role may not include AI. The owner turns on **Use AI** in **Settings → Team & Roles**. |
| `invalid_token` | The token expired or was disconnected. Reconnect; clients refresh tokens on their own. |
| `This token was not issued for https://api.shopfa.st/mcp` | The client asked for a REST API token. Update the client; MCP clients send `resource` themselves. |
| A tool answers `confirmation_required` | That is on purpose: the AI shows you a preview, and runs it only after you agree. |
| `Too many tool calls` | 120 calls (30 changes) a minute per connection. Wait a moment. |