AI SHOP MANAGEMENT

Your AI.
Your entire shop.

Let an MCP-compatible AI assistant create shops and configure your storefront, products, checkout and integrations. Give it full theme source access, preview the result and publish through a separate tool.

Create an API key ↗See the workflow

14 MCP toolsNamed dashboard actionsComplete theme source

01 / CONNECT

Connect your assistant

In a client that supports remote MCP with bearer headers, choose Streamable HTTP, enter https://api.sellix.gg/mcp and send Authorization: Bearer YOUR_SELLIX_API_KEY. The following is a common configuration shape; use your client’s equivalent server and header settings.

Remote MCP configuration

{
    "mcpServers": {
        "sellix": {
            "url": "https://api.sellix.gg/mcp",
            "headers": {
                "Authorization": "Bearer YOUR_SELLIX_API_KEY"
            }
        }
    }
}

Clients that launch a local process

Download the stdio adapter for Node.js 20 or newer. It is the same dependency-free file as scripts/sellix-mcp.cjs in the repository. Keep the downloaded file locally, use its absolute path and set the two environment variables. It forwards requests to the hosted server; your application does not need to run on the AI client’s machine.

Local stdio adapter configuration

{
    "mcpServers": {
        "sellix": {
            "command": "node",
            "args": [
                "/absolute/path/to/sellix/scripts/sellix-mcp.cjs"
            ],
            "env": {
                "SELLIX_MCP_URL": "https://api.sellix.gg/mcp",
                "SELLIX_API_KEY": "YOUR_SELLIX_API_KEY"
            }
        }
    }
}

Use a verified account.

The key must be created by a verified user who is still a member of this account. Your account role continues to apply. The server uses bearer API keys; it does not advertise OAuth login or anonymous shop access.

02 / PERMISSIONS

Choose the key’s shop access and permissions

Open Create API key and give it a recognizable name.
Choose Current shop only for one shop, or All shops in this account, including new shops to let the assistant create and manage shops in this account.
Grant the MCP permissions below, choose an expiration and save the key. Copy the secret when it is shown once.
Add the key to your AI client’s secret or environment settings. Rotate or revoke it from the API keys page when needed.

Permission	What it allows
`mcp:read`	List shops and available actions, inspect forms, read theme source and preview drafts.
`mcp:write`	Execute shop configuration and catalog actions, upload files, create themes and save drafts.
`mcp:publish`	Publish, activate or roll back a theme. Required even when publishing through a dashboard action or the visual Builder.
`shops:create`	Create shops. Also requires `mcp:write` and an account-wide key.
`orders:read` / `orders:write`	Additional permission for order, delivery and payment-data actions.
`customers:read`	Additional permission for customer pages.
`products:read` / `products:write`	Additional permission for catalog REST actions, including physical product creation. `products:read` also unlocks inventory-secret pages such as license and account stock.
`webhooks:read` / `webhooks:write`	Additional permission for webhook management.

The existing admin API scope includes these permissions, while the creator’s account role and the key’s shop binding still apply. Legacy read and write scopes do not gain MCP permissions automatically.

Shared BlockPN connections apply to the whole account and require an account-wide key. Their catalogue entries include account_wide: true; a shop-bound key cannot change or disconnect them. Provider authorization returns a browser handoff.

03 / COMPLETE SHOP SETUP

From brief to configured shop

Call shops_list and select a returned numeric shop_id. If needed, call shops_create first and list shops again.
Read the existing identity and settings with shop_read. Credential values are redacted. Call shop_actions for available operations; optionally filter by a prefix such as products. or settings..
Call shop_inspect on a GET action, for example products.create, categories.create or settings.branding. Read the returned forms, input names, options and constraints.
Call shop_action with the destination route name, its route parameters, form data and a unique operation_id. Read validation errors and correct the fields if needed.
Create or customize a theme with the direct source tools below. Preview it, then publish the reviewed draft with a separate call.

shops_create

{
    "name": "NexusKeys",
    "slug": "nexuskeys",
    "visibility": "public",
    "operation_id": "nexuskeys-create-001"
}

shop_inspect

{
    "shop_id": 42,
    "route_name": "settings.branding"
}

shop_action: branding

{
    "shop_id": 42,
    "route_name": "settings.branding.update",
    "data": {
        "name": "NexusKeys",
        "subtitle": "Digital essentials, delivered instantly.",
        "brand_color": "#6E56CF"
    },
    "operation_id": "nexuskeys-branding-001"
}

shop_action: category

{
    "shop_id": 42,
    "route_name": "categories.store",
    "data": {
        "name": "Software",
        "slug": "software",
        "status": "active",
        "media_mode": "icon",
        "icon": "folder"
    },
    "operation_id": "nexuskeys-category-001"
}

operation_id is required for every mutation. Keep it stable when retrying the same tool and arguments after a connection failure. Completed results are retained for 24 hours; reuse with different arguments is rejected. Protocol request IDs can change between retries.

Use the existing REST API through MCP

shop_actions also returns api_actions. Use shop_inspect for a named API GET, or api_action for an API mutation. These actions retain their granular API permissions and use the selected shop. For example, api.v1.products.store accepts the documented product API payload with type: physical, price_cents, currency and stock. This complements the dashboard’s product wizard.

04 / ACTION COVERAGE

The existing shop dashboard, exposed as actions

The action catalog is generated from the application’s registered shop routes. It uses the same controllers, validation, role checks, model bindings and per-action throttles as the dashboard. It is not limited to a few branding fields. shop_actions returns the exact actions permitted by the current key and role, including route parameter names and any browser requirement.

Area	Route families	Coverage
Shop setup	`shops_create; settings.branding, settings.identity, settings.storefront, settings.currency, settings.update`	Create shops, name and branding, SEO, layout, currency and visibility.
Products and inventory	`products., addons., groups., licenses., accounts.*`	All six product types, variants, delivery configuration, stock, keys, pricing, ordering and product grouping.
Media and files	`gallery., files., products.images., products.files., settings.logo., settings.favicon., settings.og_image.*`	Upload, attach, replace, reorder and remove assets using the same file checks as the dashboard.
Categories and promotions	`categories., coupons., quantity-deals., promotions., bundles.*`	Organize categories and their parents, configure coupons, quantity deals and bundles.
Checkout and shipping	`settings.checkout., shipping-zones.`	Checkout behavior, shipping zones, rates, countries and thresholds.
Content and integrations	`settings.contacts., settings.terms., settings.email., settings.domain., settings.payment-methods., account.blockpn., webhooks.*`	Contact links, legal content, mail identity, custom-domain setup, payment methods and webhooks.
Storefront design	`themes.* plus the direct theme tools`	Create, import and export themes, edit every permitted source file, use the visual Builder, preview, publish, activate, remove and roll back.
Operations and reporting	`orders., fulfillments., customers., payments., analytics., visitors., activity-logs., utm., notifications.*`	Manage orders and delivery, read customers, inspect payments and analytics, export reports and configure notifications, with additional data scopes where required.

External steps remain external.

Provider OAuth consent, DNS changes at your registrar and streamed or oversized downloads can require your signed-in dashboard browser. A provider authorization returns requires_browser: true, the dashboard URL and selected shop ID. Select that shop before continuing there. The assistant can configure the available settings and explain the remaining step; a request does not bypass provider approval or domain ownership.

Account passwords, login sessions, member-security settings and API-key administration are outside shop configuration and cannot be invoked through the action tool. New shops remain within the API key’s account; a shop-bound key cannot create a sibling shop or access another shop’s models.

05 / FULL CUSTOM DESIGN

Edit the complete storefront source

Use theme_create with a catalog source such as canvas, or provide a bundle containing manifest, files and optional settings. Custom bundles use the same import format and Nunjucks rules documented here. The built-in sellix://themes/starter MCP resource returns a complete starter bundle.

Call theme_read to obtain the complete file map, manifest, settings, Builder document, recent revisions and current fingerprint.
Edit any allowed layout, page template, section, snippet, CSS or locale file. Add and remove files by sending the complete replacement file map to theme_save.
Include the last-read fingerprint as if_match. A stale draft is rejected instead of overwriting another editor’s work.
Call theme_preview with page: home or page: product. It returns sanitized HTML and CSS. Display the preview only in a sandbox.
Call theme_publish with the latest fingerprint and a new operation ID. It compiles the draft before creating and activating an immutable revision.
Use a revision ID returned by theme_read with theme_rollback if you want to restore an earlier published design.

A file map is a replacement, not a patch.

The example below illustrates the argument shape. Preserve every file referenced by your current manifest, or update the manifest consistently. Begin with the complete map from theme_read; do not replace a real multi-file theme with just these two example files.

theme_save argument shape

{
    "shop_id": 42,
    "theme_id": 7,
    "if_match": "COPY_THE_CURRENT_64_CHARACTER_FINGERPRINT",
    "files": {
        "templates/home.njk": "<main class=\"sx-theme\"><h1>{{ shop.name }}</h1>{% for product in products %}<a href=\"{{ product.url }}\">{{ product.name }}</a>{% endfor %}</main>",
        "assets/theme.css": ".sx-theme { max-width: 1200px; margin: auto; padding: 32px; }"
    },
    "operation_id": "nexuskeys-theme-draft-001"
}

theme_publish arguments

{
    "shop_id": 42,
    "theme_id": 7,
    "if_match": "COPY_THE_FINGERPRINT_RETURNED_BY_THE_SAVE",
    "message": "Publish the reviewed shop design.",
    "operation_id": "nexuskeys-theme-publish-001"
}

The visual Builder is also available through themes.builder.save and themes.builder.preview. Draft saving does not publish. Shop settings and product changes take effect when their actions complete; they are separate from theme drafts.

06 / FILES AND IMAGES

Upload assets without a browser form

Include an uploads array in shop_action. Each item contains the input field name, original filename and base64 bytes. Nested fields use dotted paths: images.0, files.0 or a form’s specific file input name. The existing controller’s MIME, extension, file-size and product-ownership checks still apply.

Upload a gallery image

{
    "shop_id": 42,
    "route_name": "products.images.gallery.store",
    "uploads": [
        {
            "field": "images.0",
            "filename": "hero.webp",
            "base64": "BASE64_ENCODED_IMAGE_BYTES"
        }
    ],
    "operation_id": "nexuskeys-hero-upload-001"
}

Use the returned image or file identifiers when attaching assets to products, or use the returned public image URL in theme markup. The effective upload limit is the smallest of the MCP, application and web-server limits. Streamed exports and large downloads return a browser handoff rather than embedding an unbounded file in a model response.

07 / TOOL REFERENCE

Tools and exact input schemas

The connected client discovers only the tools allowed by its API key. The public reference below includes all tools; action-level account roles and additional scopes are checked again on execution.

shops_listRead

List active shops this key can manage. A shop-bound key returns only its shop.

Scopes: mcp:read

Input schema

{
    "type": "object",
    "properties": {},
    "required": [],
    "additionalProperties": false
}

shop_readRead

Read shop identity, public metadata, asset URLs and its complete settings tree. Credential, password and token values are redacted. Requires an account role allowed to inspect shop settings.

Scopes: mcp:read

Input schema

{
    "type": "object",
    "properties": {
        "shop_id": {
            "type": "integer",
            "minimum": 1
        }
    },
    "required": [
        "shop_id"
    ],
    "additionalProperties": false
}

shops_createMutation

Create a shop in this account. Requires an account-wide key. Configure its branding, currency, checkout and content using shop actions afterward.

Scopes: mcp:write, shops:create

Input schema

{
    "type": "object",
    "properties": {
        "name": {
            "type": "string",
            "minLength": 2,
            "maxLength": 40
        },
        "slug": {
            "type": "string",
            "description": "Requested shop subdomain."
        },
        "visibility": {
            "type": "string",
            "enum": [
                "public",
                "unlisted",
                "private"
            ]
        },
        "access_password": {
            "type": "string"
        },
        "operation_id": {
            "type": "string",
            "minLength": 8,
            "maxLength": 200,
            "description": "Unique mutation identifier. Reuse only for retrying identical arguments."
        }
    },
    "required": [
        "name",
        "slug",
        "visibility",
        "operation_id"
    ],
    "additionalProperties": false
}

shop_actionsRead

Discover every permitted named shop action: products, variants, files, images, categories, discounts, shipping, settings, integrations, themes, orders and analytics. Financial/customer actions require their existing extra API scopes.

Scopes: mcp:read

Input schema

{
    "type": "object",
    "properties": {
        "shop_id": {
            "type": "integer",
            "minimum": 1
        },
        "prefix": {
            "type": "string"
        }
    },
    "required": [
        "shop_id"
    ],
    "additionalProperties": false
}

shop_inspectRead

Read a named GET page as structured text and forms. Returns field names, types, options, values and constraints. Sensitive input values are redacted.

Scopes: mcp:read

Input schema

{
    "type": "object",
    "properties": {
        "shop_id": {
            "type": "integer",
            "minimum": 1
        },
        "route_name": {
            "type": "string"
        },
        "parameters": {
            "type": "object",
            "additionalProperties": true
        },
        "query": {
            "type": "object",
            "additionalProperties": true
        }
    },
    "required": [
        "shop_id",
        "route_name"
    ],
    "additionalProperties": false
}

shop_actionMutation

Execute a named dashboard action with its actual controller validation and account-role checks. Use shop_inspect first for field names. Changes can be live or destructive. Provider authorization and streamed exports return a browser handoff.

Scopes: mcp:write

Input schema

{
    "type": "object",
    "properties": {
        "shop_id": {
            "type": "integer",
            "minimum": 1
        },
        "route_name": {
            "type": "string"
        },
        "parameters": {
            "type": "object",
            "additionalProperties": true
        },
        "data": {
            "type": "object",
            "additionalProperties": true
        },
        "uploads": {
            "type": "array",
            "maxItems": 20,
            "items": {
                "type": "object",
                "properties": {
                    "field": {
                        "type": "string"
                    },
                    "filename": {
                        "type": "string"
                    },
                    "base64": {
                        "type": "string"
                    }
                },
                "required": [
                    "field",
                    "filename",
                    "base64"
                ],
                "additionalProperties": false
            }
        },
        "operation_id": {
            "type": "string",
            "minLength": 8,
            "maxLength": 200,
            "description": "Unique mutation identifier. Reuse only for retrying identical arguments."
        }
    },
    "required": [
        "shop_id",
        "route_name",
        "operation_id"
    ],
    "additionalProperties": false
}

api_actionMutation

Execute a named public REST API action from api_actions returned by shop_actions. Includes physical product creation, catalog CRUD, orders, customers, payouts and webhooks. Requires the existing granular API scope in addition to MCP permissions. Uses the selected shop even with an account-wide key.

Scopes: mcp:write

Input schema

{
    "type": "object",
    "properties": {
        "shop_id": {
            "type": "integer",
            "minimum": 1
        },
        "route_name": {
            "type": "string"
        },
        "parameters": {
            "type": "object",
            "additionalProperties": true
        },
        "data": {
            "type": "object",
            "additionalProperties": true
        },
        "operation_id": {
            "type": "string",
            "minLength": 8,
            "maxLength": 200,
            "description": "Unique mutation identifier. Reuse only for retrying identical arguments."
        }
    },
    "required": [
        "shop_id",
        "route_name",
        "operation_id"
    ],
    "additionalProperties": false
}

themes_listRead

List independent installed storefront drafts, active theme and publication fingerprints.

Scopes: mcp:read

Input schema

{
    "type": "object",
    "properties": {
        "shop_id": {
            "type": "integer",
            "minimum": 1
        }
    },
    "required": [
        "shop_id"
    ],
    "additionalProperties": false
}

theme_readRead

Read the entire editable manifest, file map, settings, Builder document and recent publication revisions.

Scopes: mcp:read

Input schema

{
    "type": "object",
    "properties": {
        "shop_id": {
            "type": "integer",
            "minimum": 1
        },
        "theme_id": {
            "type": "integer",
            "minimum": 1
        }
    },
    "required": [
        "shop_id",
        "theme_id"
    ],
    "additionalProperties": false
}

theme_createMutation

Create an unpublished theme from a catalog source (canvas by default) or import a complete custom Nunjucks bundle. Paid sources retain entitlement checks.

Scopes: mcp:write

Input schema

{
    "type": "object",
    "properties": {
        "shop_id": {
            "type": "integer",
            "minimum": 1
        },
        "name": {
            "type": "string"
        },
        "source": {
            "type": "string"
        },
        "bundle": {
            "type": "object",
            "additionalProperties": true
        },
        "operation_id": {
            "type": "string",
            "minLength": 8,
            "maxLength": 200,
            "description": "Unique mutation identifier. Reuse only for retrying identical arguments."
        }
    },
    "required": [
        "shop_id",
        "name",
        "operation_id"
    ],
    "additionalProperties": false
}

theme_saveMutation

Replace supplied draft manifest, complete file map and/or settings. Supports custom layouts, sections, snippets, CSS and locales. Does not publish. Requires the last-read fingerprint.

Scopes: mcp:write

Input schema

{
    "type": "object",
    "properties": {
        "shop_id": {
            "type": "integer",
            "minimum": 1
        },
        "theme_id": {
            "type": "integer",
            "minimum": 1
        },
        "if_match": {
            "type": "string",
            "minLength": 64,
            "maxLength": 64,
            "description": "Current fingerprint returned by theme_read."
        },
        "manifest": {
            "type": "object",
            "additionalProperties": true
        },
        "files": {
            "type": "object",
            "additionalProperties": true
        },
        "settings": {
            "type": "object",
            "additionalProperties": true
        },
        "operation_id": {
            "type": "string",
            "minLength": 8,
            "maxLength": 200,
            "description": "Unique mutation identifier. Reuse only for retrying identical arguments."
        }
    },
    "required": [
        "shop_id",
        "theme_id",
        "if_match",
        "operation_id"
    ],
    "additionalProperties": false
}

theme_previewRead

Compile and sanitize the draft against real shop data without publishing. Returns navigation-free HTML and CSS; use a sandbox when displaying it.

Scopes: mcp:read

Input schema

{
    "type": "object",
    "properties": {
        "shop_id": {
            "type": "integer",
            "minimum": 1
        },
        "theme_id": {
            "type": "integer",
            "minimum": 1
        },
        "page": {
            "type": "string",
            "enum": [
                "home",
                "product"
            ]
        }
    },
    "required": [
        "shop_id",
        "theme_id"
    ],
    "additionalProperties": false
}

theme_publishMutation

Publish and activate the exact current draft after compilation. This changes the live shop. Requires mcp:publish and the last-read fingerprint.

Scopes: mcp:publish

Input schema

{
    "type": "object",
    "properties": {
        "shop_id": {
            "type": "integer",
            "minimum": 1
        },
        "theme_id": {
            "type": "integer",
            "minimum": 1
        },
        "if_match": {
            "type": "string",
            "minLength": 64,
            "maxLength": 64,
            "description": "Current fingerprint returned by theme_read."
        },
        "message": {
            "type": "string"
        },
        "operation_id": {
            "type": "string",
            "minLength": 8,
            "maxLength": 200,
            "description": "Unique mutation identifier. Reuse only for retrying identical arguments."
        }
    },
    "required": [
        "shop_id",
        "theme_id",
        "if_match",
        "operation_id"
    ],
    "additionalProperties": false
}

theme_rollbackMutation

Restore an existing published revision of this theme and activate it. Changes the live shop; does not replace the editable draft.

Scopes: mcp:publish

Input schema

{
    "type": "object",
    "properties": {
        "shop_id": {
            "type": "integer",
            "minimum": 1
        },
        "theme_id": {
            "type": "integer",
            "minimum": 1
        },
        "revision_id": {
            "type": "integer",
            "minimum": 1
        },
        "operation_id": {
            "type": "string",
            "minLength": 8,
            "maxLength": 200,
            "description": "Unique mutation identifier. Reuse only for retrying identical arguments."
        }
    },
    "required": [
        "shop_id",
        "theme_id",
        "revision_id",
        "operation_id"
    ],
    "additionalProperties": false
}

08 / PROTOCOL

Stateless Streamable HTTP

Send one UTF-8 JSON-RPC 2.0 request per HTTP POST to https://api.sellix.gg/mcp. Use Content-Type: application/json, Accept: application/json, text/event-stream and your bearer key. This server returns JSON responses, does not assign sessions and does not offer a GET event stream. GET and DELETE return 405. Batches are rejected.

Supported revisions: 2026-07-28, 2025-11-25 and 2025-06-18. Modern clients use server/discover; legacy clients use initialize and then notifications/initialized.

Legacy initialize request

{
    "jsonrpc": "2.0",
    "id": 1,
    "method": "initialize",
    "params": {
        "protocolVersion": "2025-11-25",
        "clientInfo": {
            "name": "my-shop-assistant",
            "version": "1.0.0"
        },
        "capabilities": {}
    }
}

Modern request metadata

For revision 2026-07-28, send MCP-Protocol-Version: 2026-07-28, Mcp-Method: tools/call and Mcp-Name: shops_list for the example below. The version, method and name headers must match the request body; client information and capabilities belong in params._meta.

Modern tools/call request

{
    "jsonrpc": "2.0",
    "id": 2,
    "method": "tools/call",
    "params": {
        "name": "shops_list",
        "arguments": {},
        "_meta": {
            "io.modelcontextprotocol/protocolVersion": "2026-07-28",
            "io.modelcontextprotocol/clientInfo": {
                "name": "my-shop-assistant",
                "version": "1.0.0"
            },
            "io.modelcontextprotocol/clientCapabilities": {}
        }
    }
}

Successful tools return both text content and structuredContent. A tool validation, permission or action failure returns isError: true with details; protocol and authentication failures use HTTP/JSON-RPC errors. Supported methods include discovery, initialization, ping, tool listing/calling, resource listing/reading and the configure_shop prompt.

09 / DEPLOYMENT AND LIMITS

Run the hosted endpoint

The endpoint is part of the Laravel application on the configured API subdomain. No separate long-running MCP daemon or Composer package is required.
Deploy the application files, run the project’s normal database migrations and refresh its route/config caches. MCP uses the existing API-key and API-idempotency tables.
Set MCP_ENABLED=false to disable the endpoint. The default is enabled.
Requests without an Origin header are accepted. When an Origin is present, it must be the configured marketing, dashboard or API origin, or an exact HTTPS origin in the comma-separated MCP_ALLOWED_ORIGINS setting. Add only browser clients you intend to allow.
MCP request bodies are limited to 32 MiB; each decoded upload to 20 MiB. A request can contain up to 20 upload entries. Application upload rules may impose smaller limits.
Theme limits are shared with the code editor: 120 files, 256 KiB per file and 2 MiB total source.
API-key expiration, revocation, per-key rate limits, tenant suspension and additional per-action throttles remain enforced.

Protocol references: Streamable HTTP, MCP tools and version compatibility.

10 / TROUBLESHOOTING

Resolve connection and action errors

Result	What to check
401 / invalid key	Use a current, unrevoked bearer key. A shop-bound key also needs an active, enabled shop.
403 / missing scope or role	Check the MCP scopes, the creator’s verified account membership and account role. Creating a shop requires an account-wide key.
403 / Origin	Allow the browser client’s exact origin through `MCP_ALLOWED_ORIGINS`, or use a non-browser client or the stdio adapter.
Unknown action or missing parameters	Read `shop_actions` again. Use the exact route name and supply its named route parameters; form fields go under `data`.
Validation failure	Read `structuredContent.fields`, correct the named fields and use a new operation ID for the changed arguments. Use form data from `shop_inspect` instead of guessing.
409 / stale draft	Read the theme again, merge your changes and use the new fingerprint. Do not overwrite another editor’s draft blindly.
409 / operation ID	Wait if the same operation is still running. If a server error left its outcome uncertain, inspect the shop state before creating a new operation ID. Unknown server failures keep the reservation to avoid executing a completed action twice.
429 / rate limit	Wait before retrying. Keep the same operation ID for a mutation you are retrying after a connection problem.
405 from GET /mcp	This is a POST endpoint. Use Streamable HTTP, not the deprecated HTTP+SSE transport.
`requires_browser: true`	Follow the returned dashboard link while signed in, select the indicated shop and complete the external or download step.

Weiter lesen

Mehr für Builder

API Docs Die produktive Orders API mit Invoice-Alias, Authentifizierung, Fehlern und Rate Limits. Webhooks Signiert, deduplizierbar und mit stabiler Event-ID wiederholt. Theme docs Build storefront themes with HTML, CSS and Nunjucks. Status Live Health für jedes Sellix-Subsystem.