What Claude can and cannot change

Handing an agent your storefront is only reasonable if the blast radius is known. Every one of the 53 MCP tools declares a risk level, and the useful thing about the catalog is how few tools can reach Shopify at all.

Three levels

Twenty-four of the 53 are read, twenty-two are draft, seven are approval. The interesting part is the line between draft and approval.

Draft work is real work, safely parked

A proposed theme edit is a genuine patch: scoped, validated, previewable. It sits as a workflow artifact inside GemBoss. Your Shopify store has not changed, and will not change because Claude decided the patch looked good.

That is what makes a long agent session safe. Claude can plan, propose, validate and preview for as long as it takes, and the worst case is a pile of drafts you throw away.

The approval gate

Two tools carry the gate itself:

• gem.request_approval creates a gate on a workflow step.
• gem.decide_approval records your approve or reject, with who decided — and carries the approved step out. Approving a theme-patch step writes that patch to an unpublished draft theme, but only for a caller that also holds theme:write; a key scoped only to approve gets its decision recorded and the write skipped, with the reason returned to it.

gemtheme.create_draft_theme_from_generation checks the store for an approved decision before it runs, and refuses without one.

gemtheme.apply_theme_patch_to_draft checks the same way: it reads the recorded decision from the store rather than trusting an approved flag in the call, so a write-scoped key cannot approve its own patch. Deciding and writing stay two separate permissions.

Note where both land: a draft theme. Even an approved patch goes to an unpublished theme first, so you can look at it in Shopify's own preview before anything faces a customer. Publishing is never one of the tools.

Analytics is a separate, read-only door

The gemboss.* analytics tools are on their own server with their own key, carrying the workflow:read scope. Nothing in that family can change or publish anything. If all you want is for Claude to read the funnel, connect only that server and the question of write access does not arise.

What this means in practice

You can safely say "go and figure this out" to Claude. You cannot accidentally say "and publish it", because publishing a theme is not something any tool here does. The scope on your key, not the wording of your prompt, is what decides how far a session can go.

Next

• Edit a theme safely
• Diagnose conversion