Adobe Commerce (Magento) API facts that shape an MCP server
| Fact | Detail | Source |
|---|---|---|
| Announcement | At Adobe Summit in April 2026, Adobe introduced a Commerce MCP server that gives developers access to catalog, cart, pricing, inventory, promotions, checkout, order management and post-purchase flows, so merchants can build their own shopping assistants, voice shopping agents and upsell agents. | Adobe blog: Adobe Commerce Summit announcements (April 20, 2026) |
| Release status | Adobe’s Commerce MCP overview, last updated June 17, 2026, carries a "Coming Soon" badge ("This feature is coming soon and is subject to change"). It shows shopper experiences (conversational product discovery, cart changes, checkout inside the conversation, post-purchase guidance) and names no supported editions, authentication or tools. | Adobe Experience League: Commerce MCP overview |
| Release notes | The Adobe Commerce as a Cloud Service release notes list releases through September 22, 2026, and none mentions MCP. The September 8, 2026 release brought the service up to Adobe Commerce 2.4.9. | Adobe Experience League: Adobe Commerce as a Cloud Service release notes |
| Official MCP Registry | Nothing is published by Adobe. A search for "magento" returns a single community server, for managing Adobe Commerce on cloud infrastructure projects (environments, logs and read-only SQL over SSH) rather than store operations. | Official MCP Registry: search for magento |
| What Adobe has released | Adobe’s released Commerce MCP servers are development tools: the Commerce Developer, App Builder and drop-ins MCP servers help coding agents such as Cursor, Claude Code and GitHub Copilot build App Builder apps and convert PHP extensions when moving to Adobe Commerce as a Cloud Service. | Adobe Developer: Commerce development MCPs and skills |
| Tokens on Open Source and PaaS | Magento Open Source and Adobe Commerce on-premises or on cloud infrastructure issue integration tokens (valid until revoked), admin tokens (4 hours by default, after two-factor authentication) and customer tokens (1 hour). By default an integration’s access token can no longer be used alone as a bearer token, because a leaked, never-expiring token gives undetected persistent access; requests are OAuth-signed with all four credentials instead. | Adobe Developer: token-based authentication |
| Adobe Commerce as a Cloud Service auth | The SaaS edition doesn’t support the traditional admin and integration token methods. REST calls use Adobe IMS OAuth 2: server-to-server credentials for background jobs, or a user flow that applies the admin user’s Commerce role and attributes actions to that user. | Adobe Developer: REST authentication for Adobe Commerce as a Cloud Service |
| Bulk and asynchronous APIs | Bulk endpoints combine many calls of one type into a single request, queue each entity as a message and return a bulk_uuid for checking status. On-premises and cloud infrastructure projects need RabbitMQ for them, while Adobe Commerce as a Cloud Service runs message queues automatically. | Adobe Developer: bulk endpoints |
| Input limits | Magento’s built-in input limits are off by default. When enabled, synchronous REST list inputs are capped at 20 entities (5,000 for asynchronous calls), paginated REST and GraphQL results at 300 items per page, and REST pages default to 20 items. | Adobe Developer: web API input limiting |
| Order editing (SaaS only) | Since July 28, 2026, Adobe Commerce as a Cloud Service has REST endpoints that edit an order by copying it into a cart and submitting it as a linked replacement, which cancels the original. The feature is off by default (your Customer Success Manager or a support ticket enables it) and needs the Magento_Sales::actions_edit permission. | Adobe Experience League: Adobe Commerce as a Cloud Service release notes |
| Support dates | Each Adobe Commerce release gets three years of standard support: 2.4.9 (released May 12, 2026) until May 31, 2029, 2.4.8 until May 31, 2028, and 2.4.7 until May 31, 2027, with extended support to May 31, 2028. Standard support for 2.4.6 ended on August 11, 2026, and its extended support runs to August 31, 2027. | Adobe Experience League: Adobe Commerce lifecycle policy |
| Agentic checkout | Adobe also committed Adobe Commerce to the Universal Commerce Protocol (UCP) and Agentic Commerce Protocol (ACP) for buying inside AI assistants, working with PayPal, Stripe and Adyen, and announced a Brand Concierge integration for conversational shopping on the storefront. | Adobe blog: Adobe Commerce Summit announcements (April 20, 2026) |
Every way to connect Adobe Commerce (Magento) to AI
| Option | Type | Fits when | Limits |
|---|---|---|---|
| Adobe Commerce MCP server | Official | Merchants who want Adobe’s own route for agents that search the catalog, build carts, check out and track orders, once Adobe releases it. | Not released as of September 2026: Adobe’s documentation marks it "Coming Soon" and hasn’t published supported editions, authentication or a tool list. Nothing from Adobe covers Magento Open Source. |
| Magebit magento2-mcp-module | Community | Self-hosted Magento 2 stores that want an MCP endpoint inside Magento, with bearer-token or OAuth 2.1 sign-in, per-tool admin-role permissions, a write kill-switch, a PII-redacting audit log and per-admin rate limits. Optional modules add orders (invoices, shipments, credit memos, cancel and hold), catalog, MSI inventory and customers. | An MIT-licensed community project, last updated August 31, 2026, that installs into your store, so review the code and retest it with each upgrade. Its write tools reach refunds and cancellations, so enable them per role only once approvals are in place. |
| Mirasvit AI Agent Integration (MCP) | Community | Teams that want a paid, vendor-supported Magento extension with OAuth 2.1 sign-in tied to Magento admin role permissions. It works with Claude, ChatGPT and Gemini (Mirasvit says Copilot Studio connects the same way) and lists Magento Open Source and Adobe Commerce on-premises and on Cloud, plus Hyvä and Mage-OS. | Broad by design: product create and update, order processing, bulk stock changes, a read-only database tool and the REST endpoints of any installed extension, scoped by the signed-in user’s Magento role, so narrow that role first. Paid license with a yearly charge for updates and support. |
| CData Connect AI | Hosted | A managed, remote MCP endpoint for Adobe Commerce where users sign in with their own credentials. CData lists Claude, ChatGPT and Microsoft Copilot Studio among supported clients, and its GitHub README points to Connect AI for full create, read, update and delete. | Store data passes through CData’s cloud, and its Adobe Commerce page doesn’t list supported editions or the objects and actions exposed, so test against a staging store. Offered with a free trial. |
| Zapier MCP (Magento 2.X) | Hosted | Simple no-code actions from an assistant: Zapier lists creating a customer and adding a sales order comment for Magento 2.X. | Only those two actions are listed, both writes, with no order, stock or product lookups, so it can’t answer store questions. |
| Custom Magento MCP server | Custom | Store-specific tools (order status, stock by source, refunds with approval), sign-in through your identity provider, integration or IMS credentials held on the server, B2B company scoping, and tools that span Magento, your ERP and your support desk. Works with all three editions. | Build and run cost; you own OAuth request signing or IMS token refresh, paging within Magento’s input limits, and retesting after upgrades. |
Tools a Adobe Commerce (Magento) MCP server should expose
Start with read-only tools and add write actions once the team trusts the answers. Every write action below runs with a confirmation or approval step.
| Tool | Access | Risk | Purpose | Guard |
|---|---|---|---|---|
get_order_status | Read | Low | Status, items, invoices, shipments and tracking numbers for one order. | One order per call by order number; returns the customer’s first name only, with no address, phone or payment details. |
find_customer | Read | Medium | Find a customer by email or order number and show customer group, order count and last order date. | Allowlisted fields only; no addresses, phone numbers or date of birth; every lookup logged with the caller. |
get_stock_by_source | Read | Low | Quantity per inventory source and salable quantity per stock for a SKU, including open reservations. | Read-only; uses the inventory APIs, never direct database queries. |
check_price | Read | Low | Current, special and tier or customer-group prices for a SKU in a website or store view. | Read-only; limited to the websites and customer groups the caller may see. |
summarize_abandoned_carts | Read | Medium | Count and value of carts left active past a set age, by day and top SKUs. | Aggregates only; no names or emails; small groups are suppressed. |
get_company_orders | Read | Medium | Open orders and invoices for one B2B company account (Adobe Commerce B2B only). | Limited to the companies assigned to the signed-in sales rep; totals and statuses only. |
create_credit_memo | Write | High | Refund an invoiced order in full or for selected items, with an option to return items to stock. | Preview of items, amounts and refund method, then approval by a finance or customer-service lead; one idempotency key per order and amount; per-refund and daily caps. |
update_source_stock | Write | Medium | Set a SKU’s quantity at one inventory source, for example after a cycle count. | Before-and-after preview and confirmation by an inventory role; batches go through the bulk API and report status by bulk_uuid. |
cancel_order | Write | High | Cancel an order that hasn’t been invoiced or shipped. | Checks the order state first, then needs approval by a customer-service lead with a reason; logged with the user and order number. |
Connect it to Claude, ChatGPT or Copilot Studio
Claude
Add an OAuth-capable server as a custom connector: Magebit’s and Mirasvit’s modules both offer OAuth 2.1, and a custom server can sign people in through your identity provider. On Team and Enterprise plans only Owners add custom connectors, and each user then connects individually. Calls come from Anthropic’s cloud, so a store behind a firewall needs Anthropic’s IP ranges allowlisted. Keep refund and cancellation tools off in Research, which can call connector tools without asking each time. Local servers such as boldcommerce/magento2-mcp run over stdio in Claude Desktop or Claude Code on one machine, which suits a developer, not a team.
ChatGPT
Use developer mode (Pro, Plus, Business, Enterprise and Education on the web; on Enterprise and Education a workspace admin grants access) with a server that supports OAuth, since developer mode accepts OAuth or no authentication rather than a static token. ChatGPT treats tools without a readOnlyHint as writes and asks for confirmation, so mark order and stock lookups read-only. Keep Magento integration credentials and IMS secrets on the MCP server, and use Secure MCP Tunnel if the store must stay private.
Microsoft Copilot Studio
Add the server over Streamable HTTP (Copilot Studio doesn’t support SSE) with OAuth 2.0 so each person signs in with your company identity, and let the server map that identity to a Magento role. An API key also works, but then every user shares one Magento identity. Power Platform data policies govern MCP connections, and generative orchestration must be on.
Claude implementation · Copilot implementation · ChatGPT implementation
Permissions, identity and audit
- On Magento Open Source and Adobe Commerce on-premises or on cloud infrastructure, create a dedicated integration under System > Extensions > Integrations with Resource Access set to Custom, and tick only the resources the tools use (for example orders and inventory, not system configuration).
- Keep the integration’s four OAuth credentials on the MCP server and sign each request. Don’t re-enable standalone bearer tokens, which Adobe turns off by default because a never-expiring token that leaks gives undetected, persistent access to the store.
- On Adobe Commerce as a Cloud Service, use IMS server-to-server credentials for background reads, and the IMS user flow when an action such as a refund must run under a named admin’s Commerce role and be attributed to them.
- Map each person signed in to Claude, ChatGPT or Copilot to what they may do: support reads orders, finance approves credit memos, merchandisers change stock, and B2B sales reps see only their companies.
- Return minimal customer data and keep full addresses, phone numbers and payment details out of tool responses. Log every call with the user, the tool and the order numbers or SKUs touched, not the data returned.
Hosting and network
- In-store modules (Magebit, Mirasvit) run inside Magento and serve MCP from your store’s domain, so they deploy and upgrade with the store; install them on staging first.
- A custom server runs in your AWS or Azure account next to the store, with integration or IMS client secrets in a secrets manager. Adobe Commerce as a Cloud Service is reached at its tenant URL on api.commerce.adobe.com.
- Claude and ChatGPT connect from their own clouds, so publish the MCP endpoint over HTTPS behind OAuth and an allowlist, or use ChatGPT’s Secure MCP Tunnel for a private store.
- Page through results within Magento’s input limits (at most 300 items per page when limits are on), send stock and price batches through the bulk endpoints (which need RabbitMQ outside the SaaS edition), and cache catalog data that rarely changes.
- Hosted connectors such as CData Connect AI and Zapier hold your Magento credentials in their cloud; check their data processing terms and where logs are kept.
Cost and timeline
- Adobe’s pages don’t mention pricing for its Commerce MCP server. Magebit’s module is free under the MIT license, Mirasvit sells a paid license with a yearly charge for updates and support, CData offers a free trial, and Zapier says each MCP tool call uses two tasks from your plan’s quota.
- A focused read-only Magento MCP server (order status, stock by source, customer lookup) typically takes two to four weeks including security and evaluation.
- Write tools (refunds, cancellations, stock updates), B2B company rules, and servers that span Magento plus an ERP or support desk take longer and are scoped after a short discovery.
Adobe Commerce (Magento) MCP questions
Does Magento have an MCP server?
Not an official one you can use yet. Adobe introduced a Commerce MCP server at Summit in April 2026, but as of September 2026 its documentation says "Coming Soon" and the Adobe Commerce as a Cloud Service release notes list no release. Community and commercial MCP modules for Magento 2 exist, such as Magebit’s open-source module and Mirasvit’s paid extension.
When will Adobe’s Commerce MCP server be available?
Adobe hasn’t published a date. Its Commerce MCP overview, last updated June 17, 2026, says the feature is "coming soon and is subject to change", and we found no public beta or early-access program. If you run Adobe Commerce as a Cloud Service, ask your Adobe account team about timing and which editions it will cover.
Does it work with Magento Open Source?
Nothing from Adobe covers Magento Open Source today, and Adobe hasn’t said which editions its Commerce MCP server will support. Open Source stores can install an in-store MCP module or run a custom server on the same REST and GraphQL APIs, signing requests with an integration’s OAuth credentials.
Is Adobe’s App Builder MCP the same thing?
No. Adobe’s Commerce Developer, App Builder and drop-ins MCP servers are available now, but they help coding agents such as Cursor, Claude Code and GitHub Copilot build App Builder apps and convert PHP extensions. They are development tools, not a way for an assistant to look up orders or stock.
Can Claude manage Magento orders?
Yes, through an MCP server with order tools; Magebit’s module, for example, can create invoices, shipments and credit memos and cancel or hold orders. Start with read-only order status, and add refunds or cancellations only with a preview, approval by the right admin role and one idempotency key per order. On Adobe Commerce as a Cloud Service, the order-edit endpoints added in July 2026 are off by default and need the Magento_Sales::actions_edit permission.
Does it work with ChatGPT and Copilot?
Yes, if the server uses Streamable HTTP and supports OAuth. ChatGPT developer mode accepts OAuth or no authentication rather than a static token, and Copilot Studio accepts OAuth 2.0 or an API key over Streamable HTTP only. Mirasvit states Copilot Studio support; test any other server in a sandbox agent first.
Is there a free Magento MCP server?
Yes. magebitcom/magento2-mcp-module is MIT-licensed and was updated in August 2026, while boldcommerce/magento2-mcp (GPL-3.0) was last updated in April 2025, runs locally and sends an integration token as a bearer token, which Adobe disables by default. CData’s GitHub server is read-only and needs a licensed CData JDBC driver. Free code still needs review, hosting and upkeep.
Community, hosted or custom?
Use a community or commercial module for a quick internal pilot on a store you host, and a hosted connector when its actions match what you need. Choose a custom server for store-specific rules, refunds with approvals, B2B company scoping, IMS on Adobe Commerce as a Cloud Service, or tools that span Magento and your ERP. AIONDATA is an independent provider, not an Adobe partner, so we will say when a module or hosted option is enough.
