Loading ToolBench
MCP server for the Shopify Admin GraphQL API using asset-backed code mode
Two tools with explicit registration and schemas, but both suffer from critical gaps. 'search' and 'execute' have descriptions (good), but parameter descriptions are minimal and output schemas are completely undocumented. The tools accept arbitrary JavaScript code as input, which is a high-risk pattern with no validation guidance. Descriptions are lengthy (500+ chars) but lack actionable constraints. No error recovery guidance. No tool annotations. Naming is verb-based but generic ('search', 'execute'), does not clearly distinguish intent from similar tools in other MCP servers.
Execute JavaScript against the Shopify Admin GraphQL API. First use the 'search' tool to discover the right operations and related types, then call the API with the injected shopify helper. Configured target: - Shop: ${env.SHOPIFY_SHOP_DOMAIN} - API version: ${env.SHOPIFY_ADMIN_API_VERSION} Your code must be an async arrow function that returns the result.
Search the Shopify Admin GraphQL skill corpus bundled as Worker assets. The skill docs are the source of truth. Search results automatically include the matched Markdown docs and a bounded related-type expansion. Search strategy: - Search exact Shopify names when you know them, for example: productCreate, pageCreate, menuCreate, themes, shop. - If you do not know the exact name, search short intent phrases such as: create product, blog post, theme template, customer account, menu navigation. - If naming is uncertain, do multi-search yourself by trying several nearby terms and comparing results, for example: blog post, article, articleCreate. - Prefer searching operations first, then inspect related types from the returned docs. Useful Shopify term mappings: - blog post -> article - web page -> page - navigation or menu -> menu - theme file or template -> theme, themes, themeUpdate, themeFilesUpsert - legal policy -> shopPolicy, shopPolicies - customer account -> customer, customerAccounts
No output schema documented for either tool. LLMs cannot predict return structure, forcing them to guess how to parse results and chain downstream calls.
Parameter 'code' lacks validation constraints. Accepts arbitrary JavaScript with no length limits, timeout guidance, or injection prevention. No error message explains what happens if code throws or runs forever.
Descriptions are verbose (500+ chars) but lack actionable constraints. No guidance on error recovery, retry logic, or when to use search vs execute. No mention of rate limits or execution timeouts.
Tool names 'search' and 'execute' are generic and ambiguous. LLMs cannot distinguish these from similarly-named tools in other MCP servers. Should be 'search_shopify_graphql' and 'execute_shopify_graphql'.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 47 | 2026-07-28+ | v2 |
No error classification or recovery guidance. If code execution fails, LLM receives only 'Error: <message>' with no indication whether to retry, ask user, or abort.