The Shopify AI Toolkit is one skill now: what it checks and what it leaves to you

On September 25, 2026, Shopify merged the skills in its AI Toolkit into a single skill called shopify. The changelog entry is flagged "Action required", so if you installed the Toolkit before that date there may be something for you to do. That part is short and is covered below.

The bigger question is the one you face every day you write Shopify code with Claude Code, Cursor, Codex or VS Code: what do you let the tool do, and what do you still check yourself? The Toolkit changes that answer, so this post covers both. What it does for you, how its four parts fit together, how to set it up today, and where it stops.

I wrote about the Toolkit when it became generally available in June, in the Shopify AI Toolkit in Cursor, Claude Code and VS Code. That post explains what it is. This one is about what changed since and how to work with it.

What changed on September 25

Until then the Toolkit shipped one skill per part of the platform: one for the Admin API, one for Liquid, one for Functions, and so on, more than twenty in total. Now the plugins and the Toolkit's repository expose one shopify skill that covers all of it. Shopify's Toolkit documentation says the skill covers every Shopify developer surface, and that your agent reads the guidance for a surface only when a task needs it. The repository holds two skills today: shopify and ucp, the separate skill for the Universal Commerce Protocol command line.

Shopify gives the reason in the changelog entry. The earlier setup sometimes confused agents, and skill descriptions were cut short when they took up too much of the context window. One skill means fewer descriptions in the agent's context.

My read: that reason applies to your own setup as well. Every skill and every MCP server you add puts its description in front of the model on every task. More tools is not automatically a better agent.

If you installed the old skills

What you do depends on how you installed the Toolkit. The changelog entry says you are affected if you run its skills through a plugin, through npx skills, or through a similar tool that installs the individual skills.

For npx skills, these are the commands from the migration section of the docs. The first one skips any skill you never installed, so you can run it as it is. Add the -g flag to both if you installed the skills globally.

1npx skills remove shopify-admin shopify-admin-execution shopify-app-pricing shopify-app-review shopify-app-store-review shopify-custom-data shopify-customer shopify-dev shopify-functions shopify-hydrogen shopify-liquid shopify-onboarding-dev shopify-onboarding-merchant shopify-partner shopify-payments-apps shopify-polaris-admin-extensions shopify-polaris-app-home shopify-polaris-checkout-extensions shopify-polaris-customer-account-extensions shopify-pos-ui shopify-shopifyql shopify-storefront-graphql shopify-use-shopify-cli

1npx skills add Shopify/shopify-ai-toolkit

The changelog entry prints a slightly different pair: its remove command has a -y flag and a shorter list of names, and its add command names the skill with --skill shopify. I used the version from the docs page here because its list of names is the longer one.

The docs say the old skills are deprecated and no longer receive updates. Skills installed with npx skills also do not update on their own: you run npx skills update to get new versions. According to the repository's changelog, running that with version 1.5.24 or later of the skills CLI replaces each retired skill with a notice that tells you to remove it and add shopify.

Things that used the old names

The rename reaches a few places outside the skills folder. The repository's changelog for version 2.0.0 lists them:

• Saved prompts and custom agents. Anything that loaded shopify-admin by name should load shopify and say which topic it is about.
• Allowlists. A permission entry for one of the old skills, or a shopify-* pattern, needs an entry for shopify.
• Script paths. The validation script moved from each skill's own folder to the scripts folder of the shopify skill, and it takes the topic as a flag, for example --api admin.

One more rename, for people on the Dev MCP server. The changelog entry says they are unaffected, and for the skills that is true. But version 1.16.0 of @shopify/dev-mcp was published the same day, and its README no longer lists the validate_theme_codeblocks tool that version 1.15.4 documented. Theme validation is the validate_theme tool now, and other code goes through a tool called validate. If your agent instructions or permission lists name the old tool, update them.

What the docs do not say

Shopify does not give a command per tool for forcing a plugin update. The changelog entry only says to use the agent's plugin management tools. So for that step, your editor's own documentation is the source, not Shopify's.

Toolkit, skill, Dev MCP, CLI: which is which

Four names get used as if they were the same thing. They are not, and knowing the difference tells you what you have installed.

The Dev MCP server used to have its own documentation page. That address now redirects to the Toolkit page, where the server is the third install route. Its README on npm says the full plugin is recommended when your tool supports it. So: plugin if you can, skills if your tool has no plugins or you want to manage them yourself, Dev MCP if you prefer MCP.

One thing Shopify does not answer: whether to run the plugin and the Dev MCP server next to each other. The docs present them as alternatives and say nothing about combining them. I am not going to guess.

Where the CLI comes in

The Spring '26 Edition, where the Toolkit was announced as generally available on June 17, 2026, puts the split in one line: the skills help an agent understand how to build, and the CLI then executes the commands. Searching docs and validating code change nothing on a store. Running a command can.

For store data that means two commands. shopify store auth signs the CLI in to one store with the access scopes you name. shopify store execute then runs an Admin API query against it. The command's reference states that mutations are disabled by default: to change store data you have to run it again with --allow-mutations. The Toolkit docs describe store tasks as something the agent prepares and runs with you choosing when to execute them.

Set it up today

You need Node.js 18 or higher and a supported tool. As of October 5, 2026 the docs list Claude Code, Codex, Antigravity CLI, Cursor, Hermes, OpenClaw, Pi and Visual Studio Code. These are the plugin commands for the three most common ones, copied from the Toolkit documentation.

1claude plugin install shopify-ai-toolkit@claude-plugins-official

1codex plugin add shopify@openai-curated

1/add-plugin shopify

In VS Code, make sure the Agent plugins preview is enabled in your settings, open the Command Palette, run Chat: Install Plugin From Source and enter https://github.com/Shopify/shopify-ai-toolkit as the repository URL. The docs page has the commands for the other tools.

If you followed my June post, the Claude Code command there was a two-step form that starts with /plugin marketplace add. The docs page and the repository's README both show the single command above now.

No plugin support in your tool? Install the skills directly with the npx skills add Shopify/shopify-ai-toolkit command from the section above. And if you prefer MCP, this adds the Dev MCP server to Claude Code:

1claude mcp add --transport stdio shopify-dev-mcp -- npx -y @shopify/dev-mcp@latest

Restart Claude Code afterwards. In Cursor, the same server goes into your MCP settings like this:

1{2  "mcpServers": {3    "shopify-dev-mcp": {4      "command": "npx",5      "args": ["-y", "@shopify/dev-mcp@latest"]6    }7  }8}

There is nothing to switch on after that. The docs say your AI tool draws on Shopify's developer resources automatically when you ask it something about Shopify.

What it sends to Shopify

One thing to know before you install it on client work: usage telemetry is on by default. The telemetry section of the README lists what the skill's scripts send to shopify.dev each time they run. That includes the search query and the search result, the validation result and the code that was validated. When the agent passes them along, it also includes the names of your model and your tool, and your most recent message to the agent, cut off at 2,000 characters. The Dev MCP server's README says its release builds send usage events too, and that these can include tool inputs and results.

You can turn it off. Shopify recommends an empty opt-out file, because it also works in tools that do not pass your shell environment on to the scripts they start:

1mkdir -p ~/.config/shopify-ai-toolkit && touch ~/.config/shopify-ai-toolkit/opt-out

On Windows the file is %APPDATA%\shopify-ai-toolkit\opt-out. The README says the opt-out covers the skill scripts, the MCP server and the plugin's hooks at once. Setting OPT_OUT_INSTRUMENTATION=true in your environment is the other documented way.

What the Toolkit does for you

A model on its own writes Shopify code from memory. Memory is where the mistakes come from: a field that was renamed, a filter from another framework, an API version that has moved on. With the Toolkit the agent looks things up in the current docs and schemas, and checks what it wrote before it hands it to you.

I build this site with Claude Code and the Dev MCP server, and one rule in the repository exists because of what happens without that check. I once shipped a lesson that taught a filter called titleize. It exists in Rails. It does not exist in Shopify Liquid. A student spent ten minutes on code that looked correct and never worked. Since then, every Liquid construct in a lesson goes through the validator before it ships.

That class of mistake is what the Toolkit removes. Here is the line, and what the Dev MCP server's theme validation says about it (run on October 5, 2026):

1<h2>{{ product.title | titleize }}</h2>

1ERROR: Unknown filter 'titleize' used.

The skill's instructions tell the agent what to do with that error: read it, search the docs for the thing it names, fix that, and validate again. For anyone learning Shopify, that matters. An invented filter gets caught before it reaches you.

What it leaves to you

Now a second snippet, through the same validator on the same day. An AI was asked to show the product price:

1<div class="product-price">2  <span class="price">${{ product.price }}</span>3</div>

1Theme file snippets/ai-price.liquid passed all checks from Shopify's Theme Check.

It passes, and it should. Every part of it is real Liquid. It is also wrong. product.price is a number in the currency's subunit, so a product that costs 18.99 shows up as 1899. And the dollar sign is typed in by hand, so a store that sells in euros shows a dollar sign anyway. The fix is the money filter, which does both jobs.

A validator answers one question: is this valid Shopify code? It cannot answer the next one: is this the right code for this store? From here on this is my read, but Shopify says something close to it on the docs page: "The toolkit doesn't remove the need to review and test the result."

The things I still check by hand in generated Shopify code:

• Where the data lives. A metafield and a value parsed out of the product title both validate. Only one of them survives the merchant renaming a product.
• Which part of the platform does the job. Theme code, an app or a Function can all produce something that looks like the feature. Which one is right depends on whether the rule has to hold at checkout, and no validator knows that.
• The cases nobody typed into the prompt. A sold-out variant, a product without an image, a second currency. The code is valid for all of them. Whether it behaves well is a separate matter.
• Whether a write should run at all. The CLI makes you opt in to mutations. Whether this change belongs on this store today is not a question about syntax.

I gave more examples of this in the June post, and the wider argument is in do you still need to learn Shopify development in the AI era. The short form: the better the tools get at producing valid code, the more of your value sits in the second question.

A way to work with it

This is how I would set up the routine, whichever editor you use.

1. Install one route and keep it current. The plugin if your tool supports it. If you use npx skills, put npx skills update in your routine, because nothing does it for you.
2. Do not accept Shopify code that skipped the validator. The skill tells the agent to validate generated code before it returns it. If you see Liquid or GraphQL in a reply with no validation step before it, ask for it.
3. Then read the diff for what a validator cannot see. The data model, the choice of theme, app or Function, and the cases from the list above.
4. Keep store writes deliberate. Leave --allow-mutations off until you have read the mutation and know which store it will run against.
5. Test on a store. Shopify's own wording is review and test. A green validation is the start of that, not the end.

The Toolkit was introduced on April 9, 2026. Its skills and its install commands have both changed since. The docs page is where the current ones are.