shopify-mcp-server

Authentication middleware is explicitly disabled if the `MCP_API_KEY` environment variable is not set, leading to unauthenticated access to all endpoints. This is a critical vulnerability. The query builder uses direct string concatenation to construct Shopify's search query parameters, which, while relying on Shopify's internal sanitization for search input, could potentially be vulnerable to unexpected query behavior or injection if specific malicious patterns are not fully neutralized. The `/api/execute-query` endpoint allows executing arbitrary GraphQL queries, making it a powerful endpoint that requires robust protection by the API key.