https://mcp.mercemur.com/mcpOne tool surface, two doors
A single
tools/list covers everything below: catalogue, content, design, media,
and the two assistants. Which tools a connection actually sees is bounded by its
scopes, the same as an API key.Draft, then publish
Every content and design write lands in a draft. Nothing reaches a shopper until a
separate publish call. Preview first; a merchant should see a page before it goes
live.
Connect
Two ways in, dispatched by the credential’s own shape, not by a setting you choose:- OAuth (MCP clients)
- Secret API key
Point your client’s MCP connector at
https://mcp.mercemur.com/mcp. It discovers
the authorization server automatically (RFC 9728 protected resource metadata) and
opens a browser consent screen.The consent screen is where a merchant picks which store the agent may act on
and which scopes it gets, the same store-and-scope decision an API key makes at
creation time, just made by a person in a browser instead of in the dashboard.This is a Mercemur-run authorization server, not a third-party identity provider:
the credential MCP needs is a (store, scopes) pair, and only a Mercemur consent
screen can make that call.Call this first
get_commerce_schema
Returns the storefront template contract: every object and property a template can bind to, the binding syntax, the island components, and the capability envelope (what CSS and HTML are available, and what is not). Call this before writing any template. Scope:read_storefront · takes no arguments.
The template language has no render errors, a mistyped binding renders as empty
rather than failing, which is exactly why this comes first: there is nothing else that
will tell you a binding is wrong.
The tool groups
Catalogue
Products, variants, prices, and collections. Create, price, publish, group.
Content
Page templates: read the draft, preview a render, publish, and undo a bad publish.
Blog posts and categories: write one, edit it, publish or archive it.
Design
The Online Store builder: sections, navigation, theme tokens (colour, font),
starter designs.
Media
Upload an image or register one already hosted elsewhere into the media library.
Newsletter
Draft a broadcast, count the list, and send it. The only group here whose writes
cannot be undone.
Assistants
Ask the store’s own Optimize and Sales assistants a question directly.
What theme tools change, and how far it reaches
Two different tools change two different things, and they do not overlap:update_theme_settings(colour, font) is store-wide. It sets CSS custom properties at the storefront’s root layout, so a colour change is live on every page the moment it publishes, not one page at a time.update_templatechanges one page. Editing the product page template does not touch the home page template; each is its own draft with its own publish.write_island_stylingcovers the shared header/footer components (cart drawer, search, nav menu, currency switcher) that appear on every page by design, plus their animation timing and easing.
Scopes
Every tool is gated by the same scope vocabulary the REST API uses; see Scopes for the full list. A connection only sees, and can only call, the tools its scopes cover, the same “no tool a caller cannot use is even advertised” rule the REST API enforces with a 403.Narrowing a connection to fewer tool groups
Scope answers is this caller allowed to. A second, independent dimension answers does this caller want to:?features= on the connection URL keeps a client’s tool
list down to the groups you actually pick, so an agent doing design work never carries
the catalogue tools in its context.
catalog, content, design, marketing, media, schema. Omit the
parameter, or leave every group selected, and a connection sees everything its scopes
allow, exactly as if features were never named.
This narrows and nothing more. A group your scopes do not cover stays hidden whether
or not you name it, features can never grant authority a scope withheld. The
dashboard’s connection screen builds this URL for you as you tick and untick groups,
so hand-editing it directly is rarely necessary, but any client can set it on its own
connection URL.