Saleor MCP Server: Tools, Setup and Security

The Saleor MCP server lets an AI app read data from a Saleor Commerce store, including products, customers and orders. Saleor publishes the server and runs a production instance at mcp.saleor.app.

Checked against: Saleor's MCP server README on 28 October 2026. eSEOspace did not install or test this server.

At a glance

What it can do

The README says the server lets AI assistants "fetch data about products, customers, and orders." It does not print a tool list.

The repository's source code has tool modules for channels, customers, orders and products. The functions in those modules cover channels, customers, orders, order counts, products, stock levels and warehouse details. Treat that as a guide to coverage, and check the live tool list in your client after you connect.

Typical uses include:

• Answering "how many orders did we get last week?"
• Finding a customer's recent orders.
• Checking stock for a product across warehouses.

Because it is read-only, it cannot change prices, create orders or refund payments.

How to connect it

Saleor documents a VS Code / GitHub Copilot config using mcp.json:

{
  "servers": {
    "saleor-mcp": {
      "type": "http",
      "url": "https://mcp.saleor.app/mcp",
      "headers": {
        "X-Saleor-Auth-Token": "eyJhb...",
        "X-Saleor-API-URL": "https://example.saleor.cloud/graphql/"
      }
    }
  }
}

Saleor says any AI assistant that supports custom MCP servers over streamable HTTP with custom headers can use it.

Self-hosting. You need Python 3.12 or later and the uv package manager. Saleor's steps:

git clone git@github.com:saleor/saleor-mcp.git
cd saleor-mcp
uv sync
uv run saleor-mcp

The server starts on http://localhost:6000. Set the ALLOWED_DOMAIN_PATTERN environment variable to a regex of Saleor API URLs it may connect to. If you do not set it, any domain is allowed.

Security notes

• Read-only, but a powerful token. The server makes no mutations. However, the token it needs has MANAGE_PRODUCTS and MANAGE_ORDERS permissions. If that token leaks, someone could use it directly against your Saleor API to change data. See secrets and credential leakage in MCP.
• Token passes through a hosted server. With the hosted instance, your token travels in a header to mcp.saleor.app. Self-host if your policy forbids that. Our page on token passthrough explains the trade-offs.
• Customer data. Customer and order reads include personal data. Decide which AI tools and models may see it.
• Domain allowlist. When self-hosting, set ALLOWED_DOMAIN_PATTERN. Saleor says that without it, any domain is allowed. In our view, that opens a server-side request forgery risk.
• License. The code is AGPL-3.0. Check the license terms before you modify and offer it as a service.
• What the spec says. The MCP tools specification says there SHOULD always be a human in the loop who can deny tool calls. The spec's security best practices also recommend scope minimization.

For the wider picture, see the MCP security center.

Alternatives

• commercetools MCP server: managed or self-hosted, with read and write tools and field redaction.
• WooCommerce MCP server: product and order abilities in developer preview.
• Shopify MCP servers: developer docs, shopper-facing UCP servers and customer account tools.

Next step

A read-only server is a safe first step for store reporting with AI. If you need write actions or tighter token scopes, our MCP development team can build a custom server on top of Saleor's API. Browse the MCP server directory for more.

Frequently asked questions