Admin GraphQL (Execute)

Execute a validated Admin GraphQL operation against your own Shopify store — reads open, writes gated and audited

`shopify_admin_graphql`

Executes a Shopify Admin GraphQL operation against your own connected store. This is the one Shopify tool that reaches your store: it resolves your store domain and access token server-side from your brand's connected Shopify integration, runs the operation, and returns the result.

Every operation is parsed and pre-validated against the bundled Admin schema before any Shopify API call, so a hallucinated field is caught locally and never spends your Shopify API budget. Build your operation with learn_shopify_api → search_docs_chunks → validate_graphql_codeblocks first.

Read by default, write by request

This tool enforces a two-tier access model:

Reads are open. Any GraphQL query runs for every brand entitled to the CDP MCP — orders, products, customers, inventory, and so on.
Writes are dark by default. A GraphQL mutation runs only for a brand holding writes enablement. A brand without it gets a clear "writes disabled" error explaining how to request enablement — and its reads keep working. The permission check is fail-closed: any error looking up the flag denies the write.
Subscriptions are always rejected, even with writes enabled.

To enable writes, contact the LiveRecover account team and request writes enablement for your brand. It is enabled per brand, on request.

Writes are real and audited

When enabled, mutations run against your live store. Every mutation is recorded to an audit trail before it executes — see Write auditing below.

Parameters

Name	Type	Required	Description	Default
`query`	`string`	Yes	The Admin GraphQL operation to execute. A query runs for any entitled brand; a mutation runs only with the writes flag; subscriptions are always rejected.	—
`variables`	`object`	No	Variables object for the GraphQL operation.	—
`apiVersion`	`string`	No	Admin API version to run against, `YYYY-MM`. Pinned to the same version as the LiveRecover products proxy.	`2026-04`

The brand is never a parameter — your store is resolved from your authenticated session (see Notes).

Returns

data — the Admin GraphQL response data for your operation (null if the operation returned none).
extensions — Shopify's response extensions (such as query cost), when present.

A large response is truncated with an explicit [TRUNCATED] marker so it cannot overflow the MCP channel; narrow the query or paginate for complete data.

Errors

Pre-validation failure — a hallucinated or invalid field is caught locally against the bundled Admin schema, before any Shopify call, and returned with the validator's detail.
Writes disabled — a mutation from a brand without writes enablement is refused with a clear message; no Shopify call, no audit row. Reads are unaffected.
Subscription — always rejected.
Throttling — Shopify rate limiting (HTTP 429 / THROTTLED) surfaces as a structured error with a retryAfter value and guidance to wait or reduce query cost, never a swallowed empty result.
Missing scope — an access-denied error names the exact Shopify scope to grant to your brand's connection (for example, read_orders).

Write auditing

When writes are enabled, each mutation is audited to an audit trail:

Before the Shopify call, the tool reserves a pending audit row capturing the brand, operation name, operation body, variables, and API version.
If that audit write fails, the mutation is blocked and never executes — there are no unaudited writes.
After execution, the row is finalized with the real outcome (success / error).

Secret-shaped variable values (tokens, passwords, and similar) are redacted before the variables are stored, so a secret accidentally passed as a variable never lands in the audit trail.

Example prompts

Reads (open to any entitled brand):

Show me the 10 most recent orders in my store with their totals and status

How many products do I have with less than 5 units in stock?

Look up the customer with email jane@example.com and show their order count and tags

Writes (require writes enablement):

Add the tag "vip" to customer 1234567890 in my store

Update the price of the "Large Hoodie" variant to $59.00

Notes

Your store only. The brand comes from your authenticated session, never a parameter — this tool can only ever reach the store connected to your own brand. One brand can never touch another's store or audit rows.
Requires a connected Shopify store. Credentials resolve server-side from your brand's connected Shopify integration. If Shopify is not connected, the tool returns a clear not-connected message.
Pre-validation runs on every operation (queries and mutations) before any Shopify call, so invalid GraphQL never spends your API budget.
apiVersion defaults to 2026-04, the same Admin API version the LiveRecover products proxy pins — override it only when you specifically need a different version.
Your access token is never exposed. It never appears in tool output, errors, logs, metering, or the audit trail.

On this page