How to connect Claude to your Shopify catalog with MCP

August 14, 2026 · The BulkSheet team

“Connect an AI agent” is easy to describe and a little abstract until you see it happen. This post is the opposite of abstract: every screenshot below is a real Claude Desktop session against a real BulkSheet catalog (sample products, not live inventory), doing a real search, a real preview, a real apply, and a real undo - in that order.

Connect the server - no header, no API key

In Claude Desktop, open Settings → Connectors → Add custom connector and enter https://bulksheet.app/mcp as the server URL. That's the whole setup on Claude's side - no OAuth client ID, no secret, nothing in “Advanced settings.”

Claude Desktop's Add custom connector dialog, with the name field set to BulkSheet MCP and the server URL set to https://bulksheet.app/mcp — Add custom connector: just a name and the server URL.

BulkSheet's Shopify MCP server connects to Claude, Cursor, or any MCP client - every plan, including Free.

Install on Shopify

Click Add, then Connect, and a new browser tab opens on a page BulkSheet itself controls - not Claude's UI, not a third party. It shows exactly which host is asking to connect (claude.ai here) before it asks for anything.

BulkSheet's Connect to claude.ai page, showing a checkbox to confirm the connection and a password field for the MCP token — The destination host is shown before anything else - check it says what you expect. (This page has since gained a clarifying line about the token below the checkbox, not pictured here.)

Paste the MCP token you created from Settings → AI agent access in the BulkSheet app, check the confirmation box, and click Connect. One detail worth knowing: the token you paste here proves you own this BulkSheet install, but it isn't the token Claude ends up using - a separate, dedicated connection token gets issued behind the scenes, so the one you pasted stays yours and untouched. You'll see both in Settings → AI agent access afterward.

Five tools, with per-tool approval

Back in Claude, the connector is live, and Claude's own settings let you control exactly when each of BulkSheet's five tools is allowed to run - useful if you want search and preview to run freely but want to approve every apply by hand.

Claude Desktop's BulkSheet MCP connector settings, showing five tools - Apply bulk edit, Get product, Preview bulk edit, Search products, Undo batch - each set to Needs approval — Five tools, nothing else. Each one's approval level is yours to set.

Search, preview, apply, undo - the whole loop

From here it's a normal conversation. Asking Claude to search the catalog returns real product data, not a summary Claude made up:

Claude Desktop response showing a table of three products found by searching for the tag 'test', with vendor, SKU, price, inventory, and status columns — “Search my BulkSheet catalog for products tagged ‘test’” - a real table, not a paraphrase.

Asking for a bulk change previews it first - every affected product, tags before and after, and nothing written yet:

Claude Desktop preview response showing a before/after tags table for three products, all gaining a new 'featured' tag, with no products skipped — Preview shows the diff for every row before anything changes - this is the safeguard, not a promise that a compromised agent can't skip it.

Confirming applies exactly that previewed batch - and gives you a batch ID for undo:

Claude Desktop response confirming the featured tag was applied successfully to all three products, with a batch ID and a note that undo is available for the next 15 minutes — Applied - with a 15-minute undo window on this exact batch.

And undo genuinely reverts it, not just a “sure, done” reply:

Claude Desktop response confirming the featured tag was removed from all three products, restoring their original tags, with no skips or warnings — Undo restores the original tags - verified against the live catalog, not replayed from memory.

What actually limits a misbehaving agent

Requiring a preview before apply is a product-quality safeguard - it catches mistakes early, but it isn't a security boundary. An agent that already holds a valid token can call apply directly, the same way any integration with write access to your store can. What actually limits the damage:

Revocable, separately-labeled tokens. Settings → AI agent access shows every token - manually created and OAuth-issued - by name, with instant revoke.
The same row caps and daily quota as the editor - agent edits and your own team's edits share one bucket, not two.
Live drift detection at apply time and drift-aware undo - a field changed by someone else since preview is skipped and reported, never silently overwritten.
Email notification on first apply, on any large operation, and now on every new OAuth connection - so a token being used somewhere you don't expect doesn't go unnoticed.

Curious about the rest, including how the OAuth connection itself is secured? See the Shopify MCP server details and Your catalog is safe.

Frequently asked questions

Do I need to configure a header or API key in Claude Desktop?

No. Claude Desktop and claude.ai connect through OAuth - you add the server URL, click Connect, and paste a token on BulkSheet's own page when prompted. Claude Code and Cursor still use a header-based token, since that's what those clients support.

Can Claude apply changes to my catalog without asking?

Every apply requires an explicit preview first, and Claude's own tool-permission settings (shown in the screenshots above) let you require approval on specific tools like Apply bulk edit. Preview is a product-quality safeguard, not the only thing stopping a compromised agent - see the guardrails section above for what actually limits the blast radius.

Ready to try it? Install BulkSheet - AI agent access is on every plan, including Free.