Scan a Shopify Store for Risky Scripts From Claude, ChatGPT, or Cursor
What it looks like to ask an AI agent to scan a Shopify store over MCP, what comes back, and what a person still has to decide.
By The Appnary Team
MCP, the Model Context Protocol, is a way for an AI agent to call tools in another system. A store scanner is a good fit: the agent asks for a scan, and the scanner returns findings in a form the agent can read.
What the agent can ask for
Vigil's MCP tools are scan_store, warm_live_page, block_host, unblock_host, and list_blocked_hosts. A per-store agent token controls which store a connection can reach. In testing, you create the token for a store yourself.
- scan_store returns findings for the published theme, app embeds, app blocks, and external frames.
- warm_live_page loads the rendered storefront so scripts added at runtime can be seen.
- block_host, unblock_host, and list_blocked_hosts turn a script host off on the storefront, undo that, and show what is currently off.
What comes back
Each finding names the script, its source (a theme file and line, or an app), and the reason it was flagged. A flagged secret is reported without printing the secret. Because the output is structured, an agent can sort it, group it by app, and explain it in plain words.
What stays with a person
An agent can read the findings and draft a plan. The decision to turn a script off is a merchant's. A script can be one you need, and blocking it can break a checkout flow or a tracking setup. Vigil blocks scripts that load after its blocker embed, and for scripts hard-coded in the theme head it flags the line to remove instead. The first version does not uninstall apps, and it does not read customer records or order contents.
Where this stands
This is in testing on development stores. Public MCP access for every store, and the Shopify App Store listing, are planned and not available. If you want a manual version of the same check today, start with how to find which app added a script.
Read the Vigil notes or join the waitlist. There is no install link until Shopify approves the app.