This profile is part of our MCP server directory, within The MCP Guide. Profiles are checked against each vendor's own documentation. Need a server built? See MCP development.
commercetools Commerce MCP lets an AI agent work directly with your commercetools Project. It can read and change products, carts, orders, customers, payments and many other resources. commercetools offers it as a managed server it hosts and as an open-source package you run yourself.
Checked against: commercetools' Commerce MCP documentation on 28 October 2026. eSEOspace did not install or test this server.
Key Takeaways
- commercetools has two MCP servers: Commerce MCP for Project data and Knowledge MCP for docs and API specs.
- Commerce MCP comes in a managed version, set up in the Merchant Center, and a self-hosted npm package. Both offer the same tools.
- You choose exactly which tools to enable, from
read_alltoallor a named list. - Field filtering and redaction let you strip data such as customer emails from tool responses.
- commercetools says managed servers enforce your configuration centrally, while a self-hosted user could bypass it.
At a glance
| Item | Detail |
|---|---|
| Publisher | commercetools |
| Official? | Yes |
| Hosting | Both: managed (hosted by commercetools) and self-hosted (@commercetools/commerce-mcp) |
| Transport | Self-hosted: stdio, or streamable HTTP with --remote=true |
| Sign-in | API Client credentials or access token; managed also supports commercetools Identity login |
| Read or write | Both; read-only possible with read_all |
| Price | No separate MCP price listed for Commerce MCP |
| Source code | commercetools/commerce-mcp on GitHub (MIT) |
| Status | Not labeled on the pages we read |
What it can do
commercetools publishes a full tool table. From package version 4, tool names follow a read_products style. Two global options set broad access:
all: every tool, including create and update.read_all: every read-only tool.
Resource tools include, among many others:
- Products:
read_products,create_products,update_products,read_product_search,read_product_projections. - Orders:
read_orders,create_orders,update_orders. The managed docs also mentiondelete_orders. - Payments:
read_payments,create_payments,update_payments, plus payment methods, payment integrations andupdate_payment_intents. - Pricing and discounts:
read_product_discounts,create_product_discounts,update_product_discounts. - Bulk:
create_bulkandupdate_bulk.
Knowledge MCP is separate. commercetools says it is "completely free to use" and covers docs search, GraphQL and OpenAPI schema access and query validation.
How to connect it
Managed. commercetools suggests starting here if you have no preference. You create and configure servers in the Merchant Center or through the API, up to 500 per Project.
Self-hosted. You need Node.js 20 or later and an API Client. The README gives this read-only example:
npx -y @commercetools/commerce-mcp --tools=read_all --clientId=CLIENT_ID --clientSecret=CLIENT_SECRET --projectKey=PROJECT_KEY --authUrl=AUTH_URL --apiUrl=API_URLOr name specific tools:
npx -y @commercetools/commerce-mcp --tools=read_products,create_products --clientId=CLIENT_ID --clientSecret=CLIENT_SECRET --projectKey=PROJECT_KEY --authUrl=AUTH_URL --apiUrl=API_URLThe self-hosted setup page has config files for VS Code, Cursor, Claude, JetBrains IDEs and Codex. You can also authenticate with an existing token using --authType=auth_token. The README says the package supports MCP spec revisions 2026-07-28 and 2025-11-25.
Security notes
commercetools documents more control options than most servers. The Managed MCP Servers overview explains them.
- Least privilege. commercetools says to "include only the specific tools required for your use case." Start with
read_allor a named list. - Field filtering and redaction. You can remove or redact fields, such as tokens or customer addresses, before data reaches the AI.
- Fixed parameters. Managed servers let you fix some parameters to constant values.
- Self-hosted bypass risk. With a self-hosted server, commercetools notes the AI or its user can change local config or call the API directly. It links this to the confused deputy problem. Managed servers block that by exposing only the MCP server.
- Two auth modes.
ClientCredentialsexposes every configured tool.CommercetoolsIdentitylimits tools to what the signed-in user's Merchant Center permissions allow. - Usage tracking. Platform Insights tracks how agents use managed servers.
- What the spec says. The MCP tools specification says there SHOULD always be a human in the loop who can deny tool calls. The spec's security best practices also recommend scope minimization.
See the MCP security center and excessive permissions in MCP servers.
Alternatives
- Shopify MCP servers: UCP catalog, cart and checkout servers for shopping agents.
- Saleor MCP server: read-only headless commerce data, open source.
- BigCommerce MCP server: storefront tools for B2C and B2B buyers.
Next step
Composable commerce teams often run several agents, each with its own narrow server. If you are designing that setup, our MCP development team can help, and our MCP for ecommerce guide covers the basics. See more in the MCP server directory.
Frequently asked questions
What is the difference between Commerce MCP and Knowledge MCP?
Commerce MCP works with data in your Project and needs API access. Knowledge MCP covers documentation and API specs, needs no Project access and is free.
Should I use managed or self-hosted Commerce MCP?
commercetools suggests managed if you have no preference. It enforces your configuration centrally. Self-hosting suits custom tools or embedding the tools in an agent framework.
Can I make Commerce MCP read-only?
Yes. Use the read_all tool option, or list only read tools by name.
Was it renamed?
Yes. commercetools says Commerce MCP was formerly referred to as Essentials MCP.
