Short answer
AI connects to Shopify through Sidekick for merchants, the Inbox agent for shopper chat, the GraphQL Admin API, and the Universal Commerce Protocol MCP endpoints that replaced Storefront MCP’s catalogue and cart tools. For New Zealand retailers, the key design rule for product support is to answer only from live catalogue fields and hand anything else to staff.
- Shopify removed Storefront MCP’s catalogue and cart tools; UCP at /api/ucp/mcp replaces them.
- The Inbox agent needs the Basic, Grow, Advanced or Plus plan and new customer accounts.
- read_orders covers only the last 60 days; older orders need approved read_all_orders.
- Misleading product answers are your conduct under the Fair Trading Act.
What Shopify’s built-in AI does today
Shopify has two native AI products that matter here. Sidekick is the merchant’s assistant in the admin; its most recent update, dated 13 October 2026, added help customising checkout and customer accounts (Sidekick). The old Shopify Magic address now redirects to Sidekick. For shoppers, Shopify Inbox includes an Inbox agent that chats with store visitors using your product catalogue, policies, pages and knowledge base, hands complex or sensitive questions to staff with the AI’s context, and shows a notice that the customer is chatting with AI, which merchants cannot remove (Shopify Help, checked 20 October 2026). It is available on the Basic, Grow, Advanced and Shopify Plus plans and does not work with legacy customer accounts.
Integration routes and when to use each
| Route | What it gives you | Use it when |
|---|---|---|
| Inbox agent | No-code shopper chat with staff handoff | A first assistant on a standard store |
| GraphQL Admin API | Products, variants, metafields, inventory and policies | A custom assistant with your own checks and logs |
| UCP MCP (/api/ucp/mcp) | Catalogue search, product lookup, carts and checkout for agents | Third-party AI shopping assistants and agentic checkout |
| Policy and FAQ tool (/api/mcp) | Shop policies and FAQs over MCP | Answering delivery and returns questions |
| Customer Accounts MCP | Customer-authenticated account and order access | Order questions from signed-in customers |
| Product and inventory webhooks | Notice when products or stock change | Keeping a cache honest |
| n8n, Make or Zapier | Shopify triggers plus AI steps | Back-office tasks such as tagging or alerts |
The REST Admin API has been legacy since 1 October 2024, and new public apps must use GraphQL only (Shopify). Shopify also ships a Dev MCP server for developers, which runs locally without authentication; keep it off production data. Our guide to MCP for business systems covers where UCP fits.
Automation 1: product answers from the live catalogue
- Inputs
- A shopper’s question plus the product page they are on.
- Retrieval
- Product, variants, prices, metafields (materials, care, sizing) and inventory by location from the Admin API, cached and refreshed by product and inventory webhooks; delivery and returns from shop policies.
- Model step
- Answer only from the retrieved fields, in two or three sentences, linking the product page. If the data does not cover it, say so and offer a person.
- Checks in code
- Every price or stock figure in the answer must match the live variant; claims about safety, allergens, compatibility or certification are blocked unless a metafield states them.
- Human review
- Unanswered, warranty and safety questions go to staff with the transcript; staff review a weekly sample.
- Write-back
- None to Shopify. Unanswered questions are logged for Automation 2.
| Shopper asks about | Shopify source | Watch for |
|---|---|---|
| Price | Variant price for the shopper’s market | NZD and AUD prices differ; quote what the shopper’s market shows |
| Stock | Inventory levels per location | One size in stock is not the product in stock |
| Sizes and colours | Product options and variants | Discontinued variants still in data |
| Materials, care, fit | Metafields | Empty metafields mean “not known”, never a guess |
| Delivery and returns | Shop policies | Policy text changes; re-fetch on update |
It is the Shopify version of our customer question answering workflow, and the patterns in structured outputs and validation are what make the price check reliable.
Automation 2: closing catalogue gaps
- Cluster. Weekly, group unanswered questions by product, such as “is this machine washable?”
- Propose. The model drafts missing metafield values or FAQ text from supplier spec sheets the merchandiser uploads, citing the page used.
- Approve. The merchandiser accepts or edits each value.
- Write. Approved values are written through the Admin API with the previous value logged, so any change can be reversed.
This is our product catalogue enrichment workflow, fed by real shopper questions.
Permissions, scopes and approval design
Give the shopper-facing assistant read_products and read_inventory only. Do not give it read_orders or read_customers: Shopify says “by default, apps don’t have access to any protected customer data”, and that review is separate from scope approval (access scopes). If you add order questions later, use customer-authenticated access and remember read_orders covers only the last 60 days. Only the gap-filling service, after approval, holds write_products.
Costs and limits
The GraphQL Admin API is limited by calculated query cost using a leaky bucket whose size and restore rate depend on your plan; Shopify recommends backing off for one second when throttled (API limits). Caching product data keeps you well inside it. We could not confirm Sidekick or Inbox agent charges on Shopify’s pages on 19 October 2026, so check your admin. Illustrative example: 5,000 questions a month at 4,000 input and 200 output tokens costs about US$50 on Claude Sonnet 5.5 or US$2.50 on Claude Haiku 5.5 (list prices on 19 October 2026). Use the cheaper model only if it passes the same test set.
Where it goes wrong
- Platform changes. Assistants built on Storefront MCP’s catalogue tools stopped working when Shopify removed them. Watch the developer changelog.
- Stale cache. A sale price changes and the assistant quotes the old one. The live price check catches it.
- Web answers. Shopify says the Inbox agent may cite web search results as a secondary source for product questions. Test what it says about your products.
- The law. The Fair Trading Act 1986 prohibits misleading conduct in trade, and MBIE’s guidance applies that to AI outputs. The assistant’s answer is your answer.
- Manual recovery. Keep a switch that routes every chat to staff, and keep before-values for every metafield write.
On WooCommerce instead? See AI and WooCommerce. For shopper-facing assistants with handoff and testing, see our AI customer support systems.
Sources
- Storefront MCP (removed) and migration to UCP, Shopify Developers, accessed 19 October 2026
- GraphQL Admin API reference, Shopify Developers, accessed 19 October 2026
- REST Admin API (legacy), Shopify Developers, accessed 19 October 2026
- API limits, Shopify Developers, accessed 19 October 2026
- Access scopes, Shopify Developers, accessed 20 October 2026
- Assigning your Inbox agent to conversations, Shopify Help, accessed 20 October 2026
- Sidekick, Shopify NZ, accessed 19 October 2026
- Fair Trading Act 1986, New Zealand Legislation, version as at 1 July 2026
- Responsible AI guidance for businesses, MBIE, July 2025
Written by the Levy Street team in Wellington. Last updated 19 October 2026.