Saleor MCP FAQ
Answers to common questions about Saleor MCP.
Can I use Saleor MCP with a self-hosted Saleor?
No. Saleor MCP is a hosted app for Saleor Cloud environments on Saleor 3.23 or later. Staff sign in with their Saleor Cloud account.
For a self-hosted Saleor, you can run the open-source Saleor MCP server. It is read-only and you host it yourself. See Self-hosted Saleor.
Which MCP clients work with Saleor MCP?
Any client that supports remote MCP servers over Streamable HTTP. For staff sign-in, the client must also support OAuth. The Connect page has ready-made setup for Codex and Claude Code, and a JSON entry for other clients. See the quickstart.
How is this different from the Documentation MCP or a GraphQL MCP server?
The Documentation MCP answers questions from the Saleor documentation. A local GraphQL MCP server, such as the one described in GraphQL schema only, reads a downloaded schema file.
Saleor MCP connects to your live Saleor Cloud environment. It reads and changes real data, checks permissions on every request, and logs every call.
Can the assistant do more than I can in the Dashboard?
No. Saleor MCP never gives a person more than their own Saleor permissions allow. App permissions and the group policy can narrow access further. See Permission levels.
Who needs to set up Saleor MCP?
A staff user with both MANAGE_APPS and MANAGE_STAFF. With MANAGE_APPS alone, you can view Settings but not change it, and you can’t open Activity. See Who can configure Saleor MCP.
Why does Saleor reject my change to the app permissions?
Saleor lets you add only permissions you hold yourself. It also blocks any change to an app that has a permission you don’t hold, with “You can’t manage this app.” Ask someone who holds all of the app’s current permissions and the ones you want to add. See Changing app permissions.
Can I give a group access I don’t have myself?
In the group policy, yes, for any area the app holds. Members still need that permission in Saleor to use it. Access keys are different: you can grant a key only areas you hold yourself.
Can the assistant delete products or issue refunds?
Only with Full access in that area, and only through run_high_impact_mutation. Keep approval prompts on in your client for that tool. See Mutation tiers.
Where is the full list of supported mutations?
The list changes as Saleor reviews new mutations, so these docs describe the tiers by area. For the exact operations each level includes, see the access editor in Saleor MCP → Settings. To see what a connection can do, ask the assistant to call connection_info.
Why can’t my assistant see data I can see in the Dashboard?
Ask the assistant to call connection_info. It tells you whether you can approve more access yourself, through a permission upgrade, or need someone with MANAGE_APPS and MANAGE_STAFF to change the group policy or app permissions.
I gave my group more access. Why doesn’t the assistant have it?
Because a connection never gains access on its own. Each connection stores the access you approved when you connected. On every request, Saleor MCP uses only the part of it you can still get right now. So for a connection you already have:
- Removed access stops on the next request.
- Restored access, which the connection had before it was removed, comes back on the next request without approval.
- New access, such as a new area or Edit where you had Read, doesn’t apply until you approve it. Refreshing a token doesn’t add it either.
To approve new access, accept the permission upgrade the assistant offers when it first needs it. The new access applies from the next request, on the same connection. You can also sign in again from your client, which creates a new connection with everything you can get now.
Access keys work differently. A change to a key’s access applies to its next request.
Does Saleor MCP store my data?
The activity log stores who made each call, the client, the tool, the root operations, the outcome, and, for mutations, the tier and the summary. GraphQL documents, variables, and responses are not stored. Mutations are kept for 90 days, other calls for 14 days.
MCP clients never receive a Saleor token. Your choice of AI assistant and model decides how it processes the data it reads.
How do I revoke access?
- An access key: revoke it in Saleor MCP → Settings → Access keys. Revocation applies to the key’s next request.
- A user connection: log out from your client, or revoke the connection’s token. See Revoking a connection.
- A whole permission group: set the group to None in the group policy.
Who can see the activity log?
Staff users with both MANAGE_APPS and MANAGE_STAFF. Open Saleor MCP → Activity.