Commerce7 MCP Server

Before you start

Access to the Commerce7 MCP Server is provided through a Commerce7 app.

If you're building a new integration, follow the normal Commerce7 app development process before configuring MCP access:

1. Tell us your plan. Contact the Commerce7 Partner team and explain what you're building, who it's for, and what Commerce7 data or functionality it requires.
2. Request a sandbox. Development and testing must be completed in a Commerce7 sandbox.
3. Create your app. Create your app in the Commerce7 App Development Center.
4. Build and test. Develop and thoroughly test your integration in your sandbox before submitting the app for review.

See Building Apps on Commerce7 for the complete app development process.

Important: Do not use a production tenant for development and testing.

Add MCP Tool Access to your app

MCP Tool Access determines which Commerce7 MCP capabilities are available to your application.

MCP Tool Access is configured separately from API Access.

To configure MCP Tool Access:

1. Open your app in the Commerce7 App Development Center.
2. Open the version you are developing.
3. Under Step 1: APIs & Webhooks, locate MCP Tool Access.
4. Select Add MCP Tool Access.
5. Select the MCP tools your application requires.
6. Select Save MCP Tool Access.

Use least privilege. Select only the MCP tools and access required by your application. Apps requesting unnecessary tool access may be rejected.

Connect to the Commerce7 MCP Server

Connect using an MCP client or SDK that supports Streamable HTTP and custom headers.

Before connecting, make sure:

• MCP is enabled for your Commerce7 tenant.
• Your app is installed on the tenant.
• Your app has the required MCP Tool Access.
• You have your App ID, App Secret, and tenant ID.

1. Create your authentication token

Base64-encode your app credentials in this format:

APP_ID:APP_SECRET

On macOS or Linux:

printf '%s' 'APP_ID:APP_SECRET' | base64 | tr -d '\n'

Copy the result. This is your TOKEN.

Security: Base64 encoding is not encryption. Keep your App Secret and generated token private.

2. Add the MCP server configuration

Add the Commerce7 MCP Server to your client's MCP configuration:

{"mcpServers": { "commerce7": { "type": "streamable-http", "url": "https://mcp.commerce7.com/v2", "headers": { "Experimental": "Do not use if you are not Commerce7. API likely to change", "Authorization": "Basic TOKEN", "x-tenant-id": "TENANT-ID" } } }}

Replace:

• TOKEN with your Base64-encoded App ID and App Secret.
• TENANT-ID with your Commerce7 tenant ID.

Keep the Experimental header exactly as shown, including the two spaces before API.

Note: MCP configuration syntax varies by client. Some clients use "type": "http" for Streamable HTTP.

3. Connect

Save the configuration and connect or reconnect your MCP client.

Your client should list the Commerce7 MCP tools available to your app.

Verify your connection

After connecting, verify that:

• The Commerce7 MCP Server appears as connected.
• Your MCP client discovers the Commerce7 tools available to your app.
• The connection is authenticated against the expected Commerce7 tenant.

Commerce7 provides an echo tool that can be used to verify the connection and identify the authenticated tenant.

Once the connection is verified, try a simple read-only request using one of the MCP tools your app has access to.

Working with Commerce7 MCP tools

Commerce7 MCP includes both read-only tools and tools that support workflows that can change Commerce7 data.

Depending on the MCP Tool Access configured for your app, tools are available for areas including:

• Customers and customer addresses
• Customer preferences and insights
• Orders
• Inventory
• Clubs and club memberships
• Club shipments and signups
• Campaigns
• Coupons and customer tags
• Reservations
• Tenant settings

The Commerce7 App Development Center shows the MCP Tool Access that can be requested for your app.

Read-only tools

Read-only tools retrieve Commerce7 data without changing it.

For example, Commerce7 provides tools for operations such as finding a customer, retrieving customer details, finding an order, checking inventory, looking up a club membership, or retrieving a reservation.

Tool workflows

Some Commerce7 MCP tools are designed to be used together.

For example, an AI assistant may first use a lookup tool to identify the correct Commerce7 record, use a details tool to retrieve the current record, and then use a Draft tool to prepare a proposed change.

A customer update might follow a workflow such as:

customerList → customerDetails → updateCustomerDraft

An order update might follow:

orderList → orderDetails → updateOrderDraft

These workflows help the assistant resolve the correct Commerce7 resource before reading or preparing changes to it.

Developers should allow the MCP client or agent to follow these multi-tool workflows rather than assuming that each tool operates independently.

Actions and Draft tools

Many change-oriented Commerce7 MCP tools have names ending in Draft.

A Draft tool prepares a proposed action but does not immediately make the change in Commerce7.

For example, a Draft tool may prepare a proposed:

• Customer update
• Inventory adjustment or transfer
• Club membership change
• Club shipment change
• Reservation change
• Campaign change
• Coupon or tag change
• Order update

Important: A successful response from a *Draft tool does not mean that the requested change has been completed in Commerce7.

Commerce7's own AI experiences use a human-in-the-loop model. A proposed action is prepared and presented to the user, and the user must explicitly confirm it before the change is made. Commerce7 also logs the confirmed user action.

We recommend that partner integrations follow the same pattern: prepare the requested action, show the user what is being proposed, and require explicit confirmation before making the change.

Security best practices

When integrating with the Commerce7 MCP Server:

• Keep your App Secret and authentication token private.
• Remember that Base64 encoding is not encryption.
• Do not commit credentials or completed MCP configurations containing credentials to source control.
• Run integrations that use your App Secret server-side. Never expose your App Secret in browser or client-side code.
• Request only the MCP Tool Access required by your application.
• Use a Commerce7 sandbox for development and testing.
• For operations that can change Commerce7 data, follow a human-in-the-loop approach that allows users to review and confirm the proposed action.

Troubleshooting

Commerce7 tools don't appear

Confirm that:

• Your app has the appropriate MCP Tool Access selected in the App Development Center.
• You saved the MCP Tool Access after selecting it.
• Your MCP client was reconnected after changing access.
• You're connecting with the expected app and tenant.

Authentication fails

Check that:

• The App ID and App Secret are correct.
• The authentication token was generated from APP_ID:APP_SECRET.
• The Authorization header begins with Basic followed by the encoded token.
• The x-tenant-id header contains the correct Commerce7 tenant ID.

Server configuration isn't recognized

Verify that your MCP client supports Streamable HTTP and custom headers.

MCP configuration syntax varies by client. Some clients use http instead of streamable-http when configuring a Streamable HTTP MCP server.

A Draft tool doesn't change anything

This is expected.

Draft tools prepare proposed Commerce7 changes. A successful Draft response should not be treated as confirmation that the requested change has been completed.

Next steps

Once your connection is working:

1. Test your integration in a Commerce7 sandbox.
2. Request only the MCP Tool Access your integration needs.
3. Test both successful operations and ambiguous or error scenarios.
4. For actions that can change Commerce7 data, build a human-in-the-loop review and confirmation experience.
5. Follow the standard Commerce7 app review process before deploying your integration to customers.