@shopify/dev-mcp
A command line tool for setting up Shopify Dev MCP server
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:@shopify/theme-check-node | AI (dependencies): First-party @shopify/* dep, core to theme-check function. | ai | |
| dependencies | unvetted-dep:@shopify/shopify-dev-tools | AI (dependencies): First-party @shopify/* dep on official package. | ai | |
| phantom-deps | phantom-dep:@shopify/app-bridge-react | AI (phantom-deps): Same Shopify org scope; declared as peer/data dep, not directly imported — stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@modelcontextprotocol/sdk | AI (phantom-deps): SDK used transitively through bundled code; stable for this package. | ai | |
| phantom-deps | phantom-dep:zod | AI (phantom-deps): Zod is used via MCP SDK re-exports; stable pattern for this package. | ai | |
| phantom-deps | phantom-dep:@shopify/theme-check-docs-updater | AI (phantom-deps): Same-org dep used indirectly; stable pattern. | ai | |
| phantom-deps | phantom-dep:execa | AI (phantom-deps): Shopify monorepo pattern; declared for bundling/peer use, not a security concern. | ai | |
| phantom-deps | phantom-dep:@shopify/ui-extensions | AI (phantom-deps): Same-org scope dependency used as type/data source; stable false positive. | ai | |
| phantom-deps | phantom-dep:env-paths | AI (phantom-deps): Same monorepo pattern; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:preact | AI (phantom-deps): Config-referenced dep; stable false positive. | ai | |
| phantom-deps | phantom-dep:graphql | AI (phantom-deps): Config-referenced dep; stable false positive. | ai | |
| phantom-deps | phantom-dep:@shopify/hydrogen | AI (phantom-deps): Shopify-owned dep referenced in config/type context, not directly imported; stable pattern for this package. | ai | |
| phantom-deps | phantom-dep:@types/react | AI (phantom-deps): Framework type dep loaded by convention; stable false positive. | ai | |
| phantom-deps | phantom-dep:type-fest | AI (phantom-deps): Config-referenced dep; stable false positive. | ai | |
| phantom-deps | phantom-dep:@shopify/polaris-types | AI (phantom-deps): Type-only dep; not directly imported at runtime. Stable false positive. | ai | |
| phantom-deps | phantom-dep:@shopify/hydrogen-react | AI (phantom-deps): Type/config reference only; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@shopify/app-bridge-types | AI (phantom-deps): Type-only dep; stable false positive. | ai | |
| phantom-deps | phantom-dep:@shopify/cli | AI (phantom-deps): Same-org peer dep referenced in config; stable false positive. | ai | |
| phantom-deps | phantom-dep:@react-router/dev | AI (phantom-deps): Config-referenced dep, not directly imported; stable false positive. | ai | |
| phantom-deps | phantom-dep:react-router | AI (phantom-deps): Config-referenced dep; stable false positive. | ai | |
| phantom-deps | phantom-dep:schema-dts | AI (phantom-deps): Config-referenced dep; stable false positive. | ai | |
| phantom-deps | phantom-dep:toml | AI (phantom-deps): Config-referenced dep; stable false positive. | ai |
Versions (showing 10 of 10)
| Version | Deps | Published |
|---|---|---|
| 1.14.2 | 20 / 9 | |
| 1.14.1 | 20 / 9 | |
| 1.13.2 | 20 / 9 | |
| 1.13.0 | 20 / 9 | |
| 1.5.0 | 16 / 10 | |
| 1.3.1 | 8 / 8 | |
| 1.2.0 | 7 / 11 | |
| 1.1.0 | 2 / 10 | |
| 1.0.2 | 2 / 5 | |
| 1.0.1 | 2 / 5 |
v1.14.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.13.2
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.3.1
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: shopify-dep.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.