Authentication
The Operators MCP uses OAuth:- You sign in with your existing Shopify credentials
- There are no API keys to manage or rotate
- Access is scoped to your store, so no other merchant’s data is reachable
- You revoke sessions from Integrations
OAuth access levels
When you connect an AI client, the consent screen asks which access level to grant:
Full access is selected by default. Select Read only when you want an AI assistant to search and inspect data without changing anything.
If the client already asked for read-only access, the consent screen shows that level with no option to widen it.
Read-only connections can call the list and get tools, such as
list_cycles, get_cycle, and list_items. The write tools, update_cycle, update_item, update_outbound_fulfillment, update_inbound_receival, create_return, update_return, add_tag, remove_tag, add_comment, create_blocked_date, and delete_blocked_date, return an Insufficient scope error. Reconnect and select Full access to use them.
Deactivating an OAuth client under Integrations blocks all of its tokens at once, including tokens already issued.
Approval flows
The Operators MCP uses MCP safety annotations to protect your data:- Read operations. Approved automatically, so searching and viewing cycles, inventory, charges, and customers is uninterrupted.
- Write operations. Ask for your confirmation before they create, update, or delete data.
Data access
- The Operators MCP only works within your store’s data.
- You have the same data access as your Supercycle admin account.
- No data is shared with external systems unless you set up an integration yourself.
- Every operation goes through the Supercycle API with its standard rate limits and validation.
Best practices
- Review write operations. Read the confirmation prompt before you approve a change from your AI client.
- Revoke sessions when needed. When a team member leaves or access should end, revoke their session from Integrations.