MCP permissions

Permissions are granted per store connection. Read and write access are separate; granting a write scope does not automatically grant its read counterpart.

Scope	Allows
read_settings	Store identity, configuration, snapshot and storefront order-form settings
read_products	Products, variants, collections and media library listings
write_products	Create and update products, variants and collections
read_themes	Themes, files, versions, schedules and settings
write_themes	Duplicate, edit, schedule, publish and restore themes
read_orders	Order listings, order details and sales reports
write_orders	Preview and create orders
read_customers	Search customers and read customer history
read_discounts / write_discounts	Inspect, create and deactivate discounts
read_content / write_content	Pages, blog posts and menus
read_seo / write_seo	SEO audit, listings, image alt text and redirects
read_custom_data / write_custom_data	Metafield definitions and values
write_media	Upload and delete media
read_tracking / write_tracking	Pixels and storefront tracking configuration
read_analytics	Store analytics, product funnel and traffic sources

Least privilege

Ask only for the scopes needed by the workflow. A reporting assistant normally needs read scopes. A theme assistant needs theme scopes but does not need customer data. A content assistant does not need orders.

search_store searches only the resource families granted to the connection and reports which families were skipped. Resources and resource templates follow the same visibility rule as tools.