AI assistants can read your catalog, orders, and settings, and make changes, through the same GraphQL API the Dashboard uses. Saleor MCP is the connection, and you decide what it may do. It runs on Saleor Cloud from 3.23, with Saleor Cloud staff login.
- Staff connect their assistant with their own Saleor Cloud login (OAuth)
- Autonomous agents use access keys that an administrator creates and can revoke at any time
- Only reviewed mutations run, and high-impact changes need separate approval
- An activity log shows who called what, from which client, and the outcome
Staff sign in as themselves
Open Saleor MCP in the Dashboard, copy the setup for your MCP client, and sign in with your Saleor Cloud account. The assistant acts as you: it never gets more than your Dashboard permissions allow, and you approve the access it may use when you connect. If it needs more later, it asks, and you approve the upgrade in the browser.
Access keys for agents
Agents and server-to-server automation do not sign in. An administrator creates a named access key in the app's settings, gives it its own access per area, and can edit or revoke it at any time. Changes apply on the key's next request.
Read, write, high impact
Per Dashboard permission group, administrators set each area to None, Read, Edit, or Full. Everyday changes to single products, stock, pages, or draft orders run through one tool. Bulk changes, refunds, and order actions that reach customers run through a separate high-impact tool, so your MCP client asks for approval for them separately. Staff, apps, webhooks, and anything not yet reviewed stay in the Dashboard.
See what ran
The Activity page lists every tool call: the user or access key, the MCP client, the operations, and whether they succeeded. Mutations also record the one-line summary the assistant wrote for the approval prompt. Queries, variables, and responses are not stored.