The control worth understanding is the pairing of two things: the API Client sets the ceiling on what is possible and --tools sets what is actually offered. Start with a read-only client and a short list, then widen it once you can see which tools the agent really calls.
Commercetools' own MCP server for a Composable Commerce Project, now called Commerce MCP. It exposes the Project's resources as tools an assistant can call, using the API Client credentials you hand it.
- Catalogue work: read_products, update_products, read_product_projections and read_product_search
- Cart and order operations, including create_carts, update_carts, create_orders and update_orders
- Customer data through read_customers, update_customers and read_customer_search
- Pricing and promotions: standalone prices, cart discounts, discount codes, shipping methods and tax categories
- A tool allow-list — pass the tools you want and nothing else is exposed
- Field filtering and redaction, so a read-only agent stays read-only
- Two ways to run it: managed servers configured in the Merchant Center, or the self-hosted package, with the same tools and filtering either way
A commercetools Project and an API Client whose scopes cover the tools you enable — an Admin Client with manage and view scopes sees all of them. The self-hosted package runs with npx -y @commercetools/commerce-mcp and takes --projectKey, --clientId and --clientSecret; stdio is the default transport and --remote=true switches it to Streamable HTTP.
One command plus a key — npx -y @commercetools/mcp-essentials --tools=all --clientId=CLIENT_ID --clientSecret=CLIENT_SECRET --projectKey=PROJECT_KEY --authUrl=AUTH_URL --apiUrl=API_URL, then supply credentials