MCP-Server

The server, when run as a direct API (`shopify-api-server.js`), explicitly lacks any authentication or authorization layer, making it critically vulnerable to unauthorized access and manipulation of Shopify data if exposed publicly. The `README.md` and `CHATGPT_SETUP.md` clearly state this risk, recommending the addition of authentication, rate limits, and HTTPS for production use. While environment variables are used for sensitive credentials (Shopify Access Token), the absence of request-level authentication for the API endpoints is a major security flaw for general deployment. GraphQL queries are structured, which helps prevent direct injection of malicious query structures, but the lack of authentication overrides this mitigation.