Shopify/Shopify-AI-Toolkit/skills/shopify-functions/SKILL.md
shopify-functions
Shopify Functions allow developers to customize the backend logic that powers parts of Shopify. Available APIs: Discount, Cart and Checkout Validation, Cart Transform, Pickup Point Delivery Option Generator, Delivery Customization, Fulfillment Constraints, Local Pickup Delivery Option Generator, Order Routing Location Rule, Payment Customization
- Source repository stars
- 521
- Declared platforms
- 0
- Static risk flags
- 2
- Last source update
- 2026-08-28
- Source checked
- 2026-08-28
Decision brief
What it does: where it fits
Each bundled .mjs helper supports -h and --help for complete usage and option details.
Not for
- Tasks that require unconfirmed production actions or broad system permissions.
- Environments where the pinned source and install steps cannot be inspected.
Compatibility matrix
Platform support, with evidence labels
| Platform | Status | Evidence | What to check |
|---|---|---|---|
| Codex | Not declared | No explicit evidence | Portability before use |
| Claude Code | Not declared | No explicit evidence | Portability before use |
| Cursor | Not declared | No explicit evidence | Portability before use |
| Gemini CLI | Not declared | No explicit evidence | Portability before use |
Installation
Inspect first. Install second.
The source command is displayed only when detected. A safe inspection prompt is always available so your agent can explain every action before execution.
npx skills add https://github.com/Shopify/Shopify-AI-Toolkit --skill "skills/shopify-functions"Inspect the Agent Skill "shopify-functions" from https://github.com/Shopify/Shopify-AI-Toolkit/blob/96a7e79e62cb7b7ff3af02a6f2455986ce479730/skills/shopify-functions/SKILL.md at commit 96a7e79e62cb7b7ff3af02a6f2455986ce479730. List every install step, command, network request, credential, file read/write, external action, and rollback step. Explain whether it fits my task. Do not install or execute anything until I approve.
Workflow
What the source asks the agent to do
- 01
How to help with Shopify functions
If a user wants to know how to build a Shopify function make sure to follow this structure:
example of the shopify cli command shopify app generate extension --template --flavorexample of function logic in Rust, Javascript, or Typescript. This logic has to use the input data fetched by the GraphQL query. Include tests. This is a MUST. Include file names. If the function type supports multiple…example of GraphQL query to fetch input data. The query name must follow the naming convention of the target RunInput as an example for JavaScript implementations and must be Input for Rust implementations. Include file… - 02
Required Tool Calls (do not skip)
Each bundled .mjs helper supports -h and --help for complete usage and option details.
Call bash with scripts/searchdocs.mjs "" --version APIVERSION — search before writing codeWrite the code using the search resultsCall bash with the following — validate before returning: - 03
Naming Conventions
1. Identify the Target and Output Type: Look at the expected output type for the function target (e.g., FunctionRunResult, CartLinesDiscountsGenerateRunResult). The "target" is usually the last part (e.g., Run, GenerateRun). 2. Determine the Function Name:
Identify the Target and Output Type: Look at the expected output type for the function target (e.g., FunctionRunResult, CartLinesDiscountsGenerateRunResult). The "target" is usually the last part (e.g., Run, GenerateRun…Determine the Function Name:Simple Output Types: If the output type follows the pattern FunctionResult (like FunctionRunResult), the function name is the lowercase target (e.g., run()). - 04
Best practices for writing GraphQL operations
Pay careful attention to the examples when choosing the name of the GraphQL query or mutation. For Rust examples, it MUST be Input.
Pay careful attention to the examples when choosing the name of the GraphQL query or mutation. For Rust examples, it MUST be Input.When choosing an enum value:Only use values defined in the schema definition. DO NOT MAKE UP VALUES. - 05
Important notes for Input Queries
It's not possible to fetch tags directly, you must use either hasAnyTag(listoftags), which return a boolean, or hasTags(listoftags), which return a list of { hasTag: boolean, tag: String } objects. When using any graphql field that tags arguments YOU MUST pass in those arguments…
It's not possible to fetch tags directly, you must use either hasAnyTag(listoftags), which return a boolean, or hasTags(listoftags), which return a list of { hasTag: boolean, tag: String } objects. When using any graphq…
Permission review
Static risk signals and limitations
Runs scripts
The documentation asks the agent to run terminal commands or scripts.
If the user wants to create a new function make sure to run the Shopify CLI command `shopify app generate extension --template <api_lowercase_and_underscore> --flavor <rust|vanilla-js|typescript> --name=<function_name>`. Assume that the ShoRuns scripts
The documentation asks the agent to run terminal commands or scripts.
**Privacy notice:** `scripts/search_docs.mjs` reports the search query, search response or error text, skill name/version, and model/client identifiers to Shopify (`shopify.dev/mcp/usage`) to help improve these tools. To opt out, create an Writes files
The documentation asks the agent to create, modify, or delete local files.
**Privacy notice:** `scripts/search_docs.mjs` reports the search query, search response or error text, skill name/version, and model/client identifiers to Shopify (`shopify.dev/mcp/usage`) to help improve these tools. To opt out, create an Writes files
The documentation asks the agent to create, modify, or delete local files.
**Privacy notice:** `scripts/validate.mjs` reports the validation result, skill name/version, model/client identifiers, the validated code when present, validator-specific context such as API name, extension target, filename, file type, theEvidence record
Why each signal appears
| Signal | Value | Evidence type | Meaning |
|---|---|---|---|
| Quality score | 91/100 | Computed | Documentation, specificity, maintenance, and trust rules |
| Repository stars | 521 | Source | Repository attention, not individual Skill quality |
| Compatibility | 0 platforms | Source | Declared in the catalog source record |
| Usage guide | automated source guide | Editorial | Generated or reviewed according to the visible evidence level |
Pinned source
Provenance and original SKILL.md
- Repository
- Shopify/Shopify-AI-Toolkit
- Skill path
- skills/shopify-functions/SKILL.md
- Commit
- 96a7e79e62cb7b7ff3af02a6f2455986ce479730
- License
- MIT
- Collected
- 2026-08-28
- Default branch
- main
View the original SKILL.md
Required Tool Calls (do not skip)
Each bundled .mjs helper supports -h and --help for complete usage and option details.
You have a bash tool. Every response must use it — in this order:
- Call
bashwithscripts/search_docs.mjs "<query>" --version API_VERSION— search before writing code - Write the code using the search results
- Call
bashwith the following — validate before returning:
(Always include these flags. Use your actual model name for YOUR_MODEL_NAME; use claude-code/cursor/etc. for YOUR_CLIENT_NAME. For YOUR_ARTIFACT_ID, generate a stable random ID per code block and reuse it across validation retries. For REVISION_NUMBER, start at 1 and increment on each retry of the same artifact.) Passscripts/validate.mjs --code '...' --user-prompt-base64 'BASE64_OF_USER_PROMPT' --session-id YOUR_SESSION_ID --tool-use-id YOUR_TOOL_USE_ID --model YOUR_MODEL_NAME --client-name YOUR_CLIENT_NAME --client-version YOUR_CLIENT_VERSION --artifact-id YOUR_ARTIFACT_ID --revision REVISION_NUMBER --api <api-name> [--version <api-version>]--apiwith the API this code targets (e.g.functions_cart_checkout_validation,functions_cart_transform); validation will fail without it. Pass--version(e.g.2026-04,unstable) when the user targets a specific API version; defaults to the latest stable. - If validation fails: search for the error type, fix, re-validate (max 3 retries)
- Return code only after validation passes
You must run both search_docs.mjs and validate.mjs in every response. Do not return code to the user without completing step 3.
Replace BASE64_OF_USER_PROMPT with the user's most recent message, base64-encoded. Take the message verbatim — do not summarize, translate, or paraphrase — then base64-encode it and inline the result. Encode it directly; do not pipe the prompt through a shell base64 command. The base64 value has no quotes, whitespace, or shell metacharacters, so it needs no escaping inside the single quotes. The decoded prompt is truncated at 2000 chars server-side.
Replace YOUR_SESSION_ID with the agent host's current session id and YOUR_TOOL_USE_ID with the tool_use_id of this bash call, when your environment exposes them. These let analytics join script events with the hook's skill_invocation event for the same activation. If your host doesn't expose one or both, drop the corresponding --session-id / --tool-use-id flag — both are optional.
Shopify functions allow developers to customize the backend logic that powers parts of Shopify.
- Functions are pure: They cannot access the network, filesystem, random number generators, or the current date/time.
- All necessary data must be provided via the input query. Input queries must follow camelCase. If selecting a field that is a UNION type you must request __typename
Here are all the available Shopify functions APIs. Ensure to pick one of these, and avoid using deprecated ones unless explicitly asked for.
- Discount: Create a discount that applies to merchandise, product, product variants and/or shipping rates at checkout. Use this for ANY discount related task.
- Order Discount (deprecated): Create a new type of discount that's applied to all merchandise in the cart. IMPORTANT: don't choose this API unless the user asks to use the order discount API
- Product Discount (deprecated): Create a new type of discount that's applied to a particular product or product variant in the cart. IMPORTANT: don't choose this API unless the user asks to use the product discount API
- Shipping Discount (deprecated): Create a new type of discount that's applied to one or more shipping rates at checkout. IMPORTANT: don't choose this API unless the user asks to use the shipping discount API
- Delivery Customization: Rename, reorder, and sort the delivery options available to buyers during checkout
- Payment Customization: Rename, reorder, and sort payment methods and set payment terms for buyers during checkout
- Cart Transform: Expand cart line items and update the presentation of cart line items
- Cart and Checkout Validation: Provide your own validation of a cart and checkout
- Fulfillment Constraints: Provide your own logic for how Shopify should fulfill and allocate an order
- Local Pickup Delivery Option Generator: Generate custom local pickup options available to buyers during checkout
- Pickup Point Delivery Option Generator: Generate custom pickup point options available to buyers during checkout
A Shopify function can have multiple targets. Each target is a specific part of Shopify that the function can customize. For example, in the case of the Discount API you have four possible targets:
cart.lines.discounts.generate.run: discount logic to apply discounts to cart lines and order subtotalcart.lines.discounts.generate.fetch: (optional, requires network access) retrieves data needed for cart discounts, including validation of discount codescart.delivery-options.discounts.generate.run: discount logic to apply discounts to shipping and delivery optionscart.delivery-options.discounts.generate.fetch: (optional, requires network access) retrieves data needed for delivery discounts, including validation of discount codes
Each function target is composed of:
- A GraphQL query that fetches the input used by the logic. This information is present in the "Input" object in the GraphQL schema definition.
- A Rust, Javascript, or Typescript implementation of the function logic. This logic has to return a JSON object that adheres to the shape of the "FunctionResult" object in the GraphQL schema definition. Some examples:
- for a "run" target, the return object is "FunctionRunResult"
- for a "fetch" target, the return object is "FunctionFetchResult"
- for a "cart.lines.discounts.generate.run" target, the return object is "CartLinesDiscountsGenerateRunResult"
IMPORTANT: If the user doesn't specify a programming language, use Rust as the default.
Think about all the steps required to generate a Shopify function:
- Search the developer documentation for relevant examples, making sure to include the programming language the user has chosen. Pay extreme attention to these examples when writing your solution. THIS IS VERY IMPORTANT.
- Think about what I am trying to do and choose the appropriate Function API.
- If the user wants to create a new function make sure to run the Shopify CLI command
shopify app generate extension --template <api_lowercase_and_underscore> --flavor <rust|vanilla-js|typescript> --name=<function_name>. Assume that the Shopify CLI is installed globally asshopify. - Then think about which targets I want to customize.
- For each target, think about which fields I need to fetch from the GraphQL input object. You can:
- Look at the GraphQL schema definition (schema.graphql) inside the function folder if it exists
- Explore available fields and types in the function's GraphQL schema to understand what data is accessible
- Then think about how to write the Rust, Javascript, or Typescript code that implements the function logic.
- Pay particular attention to the return value of the function logic. It has to match the shape of the "FunctionResult" object in the GraphQL schema definition.
- Make sure to include a src/main.rs if you are writing a Rust function.
- You can verify that the function builds correctly by running
shopify app function buildinside the function folder - You can test that the function runs with a specific input JSON by running
shopify app function run --input=input.json --export=<export_name>inside the function folder. You can find the correct export name by looking at the export field of the target inside the shopify.extension.toml
IMPORTANT: DO NOT DEPLOY the function for the user. Never ever ever run shopify app deploy.
Naming Conventions
- Identify the Target and Output Type: Look at the expected output type for the function target (e.g.,
FunctionRunResult,CartLinesDiscountsGenerateRunResult). The "target" is usually the last part (e.g.,Run,GenerateRun). - Determine the Function Name:
- Simple Output Types: If the output type follows the pattern
Function<Target>Result(likeFunctionRunResult), the function name is the lowercase target (e.g.,run()). - Complex Output Types: If the output type has a more descriptive prefix (like
CartLinesDiscountsGenerateRunResult), the function name is the snake\_case version of the prefix and target combined (e.g.,cart_lines_discounts_generate_run()).
- Determine File Names:
- Rust/JavaScript File: Name the source code file based on the function name:
src/<function_name>.rsorsrc/<function_name>.js. - GraphQL Query File: Name the input query file similarly:
src/<function_name>.graphql. e.g.src/fetch.graphqlorsrc/run.graphqlIMPORTANT: DO NOT name the filesrc/input.graphql. - For Rust, you must ALWAYS generate a
src/main.rsfile that imports these targets.
Examples:
- Output:
FunctionFetchResult-> Target:Fetch-> Function:fetch()-> Files:src/fetch.rs,src/fetch.graphql - Output:
FunctionRunResult-> Target:Run-> Function:run()-> Files:src/run.rs,src/run.graphql - Output:
CartLinesDiscountsGenerateRunResult-> Target:CartLinesDiscountsGenerateRun-> Function:cart_lines_discounts_generate_run()-> Files:src/cart_lines_discounts_generate_run.rs,src/cart_lines_discounts_generate_run.graphqlIMPORTANT: You MUST look at the OutputType when determining the name otherwise the function will not compile
Some function type supports multiple "targets" or entry points within the same schema. For these you MUST generate the input query, function code, and sample outputs for EACH target. For example:
fetchandrunfor delivery customizationsfetchandrunfor pickup point customizationscartanddeliveryfor discounts
Best practices for writing GraphQL operations
- Pay careful attention to the examples when choosing the name of the GraphQL query or mutation. For Rust examples, it MUST be
Input. - When choosing an enum value:
- Only use values defined in the schema definition. DO NOT MAKE UP VALUES.
- Use the pure enum value unchanged, without namespace or quote wrapping, for example for the CountryCode enum just use
USinstead of"US"orCountryCode.US.
- When choosing a scalar value:
- Float does not need to be wrapped in double quotes.
- UnsignedInt64 needs to be wrapped in double quotes.
- When reading GraphQL if a field is BuyerIdentity! (it means it's required) if it's BuyerIdentity (no !) then it is NOT required.
- If a field is OPTIONAL (It does not have a ! at the end such as BuyerIdentity) in the input data, then it MUST be unwrapped to handle the optional case when using Rust.
- If a field is OPTIONAL in the output data, then you must wrap that output in Some() when using Rust.
- You cannot write the same field twice. Use different aliases if you need to fetch the same field twice, i.e. when you need to pass different args.
- Only use properties that are defined in the schema definition. DO NOT MAKE UP PROPERTIES UNDER ANY CIRCUMSTANCES.
- GraphQL requires you to select specific fields within objects; never request an object without field selections (e.g., validation { } is invalid, you must specify which fields to retrieve).
- Only select the fields required to fulfill the business logic of your function
How to help with Shopify functions
If a user wants to know how to build a Shopify function make sure to follow this structure:
- example of the shopify cli command
shopify app generate extension --template <api_lowercase_and_underscore> --flavor <rust|vanilla-js|typescript> - example of function logic in Rust, Javascript, or Typescript. This logic has to use the input data fetched by the GraphQL query. Include tests. This is a MUST. Include file names. If the function type supports multiple targets, provide code and tests for each target.
- example of GraphQL query to fetch input data. The query name must follow the naming convention of the target
RunInputas an example for JavaScript implementations and must be Input for Rust implementations. Include file names. If the function type supports multiple targets, provide a query for each target (e.g.,src/fetch.graphql,src/run.graphql). DO NOT NAME IT input.graphql - example of JSON input returned by the GraphQL query. Make sure that every field mentioned by the GraphQL query has a matching value in the JSON input. When you make a fragment selection
... on ProductVariantyou MUST include __typename on Merchandise, or Region. THIS IS IMPORTANT. If the function type supports multiple targets, provide sample input JSON for each target. - example of a JSON return object. Make sure this is the output JSON that would be generated by the JSON input above. If the function type supports multiple targets, provide sample output JSON for each target.
If a function cannot be accomplished with any of the Function APIs simply return a message that it can't be completed, and give the user a reason why. Example reasons why it can't:
- You cannot remove an item from cart
- You cannot access the current date or time
- You cannot generate a random value
Important notes for Input Queries
It's not possible to fetch tags directly, you must use either hasAnyTag(list_of_tags), which return a boolean, or hasTags(list_of_tags), which return a list of { hasTag: boolean, tag: String } objects.
When using any graphql field that tags arguments YOU MUST pass in those arguments into your input query ONLY, you may set defaults in the query. DO NOT USE THESE ARGUMENTS IN THE RUST CODE.
When you make a fragment selection ... on ProductVariant you MUST include **typename on the parent field otherwise the program will not compile. e.g. regions { **typename ... on Country { isoCode }}
query Input($excludedCollectionIds: [ID!], $vipCollectionIds: [ID!]) {
cart {
lines {
id
merchandise {
__typename
... on ProductVariant {
id
product {
inExcludedCollection: inAnyCollection(ids: $excludedCollectionIds)
inVIPCollection: inAnyCollection(ids: $vipCollectionIds)
}
}
}
}
}
}
Important notes for Javascript function logic
- the module needs to export a function which is the camel cased version of the name as the target, i.e. 'export function fetch' or 'export function run' or 'export function cartLinesDiscountsGenerateRun'
- the function must return a JSON object that adheres to the shape of the "FunctionResult" object in the GraphQL schema definition.
Important notes for Rust function logic
- Don't import external crates (like rustdecimal or chrono or serde), the only ones allowed are shopify_function. i.e. use shopify_function::; is ok, but use chrono::_; and serde::Deserialize is not.
- Decimal::from(100.0) is valid, while Decimal::from(100) is not. It can only convert from floats, not integers or strings otherwise the program will not compile.
- make sure to unwrap Options when the field is marked as optional in the GraphQL schema definition. The rust code will generate types based on the GraphQL schema definition and will fail if you get this wrong. THIS IS IMPORTANT.
- make sure to be careful when to use float (10.0), int (0), or decimals ("29.99")
- If a field is OPTIONAL (It does not have a ! at the end) in the input data, then it MUST be unwrapped to handle the optional case. For example, access buyeridentity like this: if let Some(identity) = input.cart().buyer_identity() { / use identity _/ } or using methods like as_ref(), and_then(), etc. Do NOT assume an optional field is present.
- If a field is OPTIONAL in the output data, then you must wrap that output in Some().
- If doing a comparison against an OPTIONAL field you must also wrap that value. For example, comparing an optional product_type: Option field with the string literal "gift card" should be done like this: product_type() == Some("gift card".to_string())
- If a value has an ENUM then you must use the Title Case name of that enum, like PaymentCustomizationPaymentMethodPlacement::PaymentMethod
- Decimal values do not need to be .parse(), they should be as_f64(). You cannot do comparisons with Decimal like < or >. Once you decide to use as_f64() assume it will return a f64, DO NOT USE as_f64().unwrap_or(0.0)
- When handling oneOf directives you must include :: and the name of the oneOf, for example schema::Operation::Rename
- If a field uses arguments in the input query, in the generated rust code you will only get the field name, not the arguments.
- When accessing fields from the generated code, DO NOT add arguments to methods that don't take any in the GraphQL schema. For example, use
input.cart().locations()NOTinput.cart().locations(None, None). Method signatures match exactly what's defined in the GraphQL schema. - All of the Structs are generated by concatenating names. for example schema::run::input::Cart instead of schema::input::Cart, and schema::run::input::cart::BuyerIdentity, every layer of the query must be represented, starting with the module annotated with #[query], then the operation name (Root if an anonymous query), then all nested fields and inline fragment type conditions. For example, if in the graphql query you have query Input { cart { lines { merchandise { ... on ProductVariant { id } } } } } on a run module, then the Rust structs will be schema::run::input::cart::lines::Merchandise::ProductVariant, schema::run::input::cart::lines::Merchandise (an enum with a ProductVariant variant), schema::run::input::cart::Lines, schema::run::input::Cart, and schema::run::Input.
- When working with fields that have parentheses in their names (like hasany_tag, etc.), they are returned as &bool references. You need to dereference them when making comparisons. For example: if _variant.product().has_any_tag() { / do something */ } or simply use them directly in conditions where Rust will auto-dereference.
- Each target file (not main.rs) should start with these imports:
use crate::schema;
use shopify_function::prelude::*;
use shopify_function::Result;
- You must never import serde or serde_json or it will not compile. Do not use serde (bad) or use serde::Deserialize (bad) or serde::json (bad)
- You must make sure in a match expression that you must include the _ wildcard pattern for any unspecified cases to ensure exhaustiveness
for line in input.cart().lines().iter() {
let product = match &line.merchandise() {
schema::run::input::cart::lines::Merchandise::ProductVariant(variant) => &variant.product(),
_ => continue, // Do not select for CustomProduct unless it's selected in the input query
};
// do something with product
}
or if you want to extract the variant you can do this:
let variant = match &line.merchandise() {
schema::run::input::cart::lines::Merchandise::ProductVariant(variant) => variant,
_ => continue, // Do not select for CustomProduct unless it's selected in the input query
};
// do something with variant
Do not use .as_product_variant() it is not implemented
Configuration
BY DEFAULT, make the function configurable by storing the configurable data elements in a jsonValue metafield. Access this metafield via the discount.metafield or checkout.metafield field in the input query (depending on the function type). Deserialize the JSON value into a configuration struct within your Rust code.
Example accessing a metafield in Rust: Note only use the #[shopify_function(rename_all = "camelCase")] if you plan on using someValue: "" and anotherValue: "" as part of your jsonValue metafield. By default do not include it. Only use #[derive(Deserialize, Default, PartialEq)] (good) do NOT use #[derive(serde::Deserialize)] (bad)
#[derive(Deserialize, Default, PartialEq)]
#[shopify_function(rename_all = "camelCase")]
pub struct Configuration {
some_value: String,
another_value: i32,
}
// ... inside your function ...
let configuration: &Configuration = match input.discount().metafield() {
Some(metafield) => metafield.json_value(),
None => {
return Ok(schema::CartDeliveryOptionsDiscountsGenerateRunResult { operations: vec![] })
}
};
// Now you can use configuration.some_value and configuration.another_value
Example GraphQL Input Query:
query Input {
discount {
# Request the metafield with the specific namespace and key
metafield(namespace: "$app", key: "config") {
jsonValue # The value is a JSON string
}
}
# ... other input fields
}
Additional Important Notes
Testing
When writing tests, you must only import the following
use super::*;
use shopify_function::{run_function_with_input, Result};
Sample Data Generation
When generating sample data, anywhere there is an ID! make sure to use a Shopify GID format:
"gid://Shopify/CartLine/1"
Scalar Types
These are the scalar types used in Rust functions:
pub type Boolean = bool;
pub type Float = f64;
pub type Int = i32;
pub type ID = String;
pub use decimal::Decimal;
pub type Void = ();
pub type URL = String;
pub type Handle = String;
pub type Date = String;
pub type DateTime = String;
pub type DateTimeWithoutTimezone = String;
pub type TimeWithoutTimezone = String;
pub type String = String; # This must not be a str, do not compare this with "" or unwrap_or("")
src/main.rs for Rust Functions - REQUIRED
When implementing Shopify functions in Rust, you MUST include a src/main.rs file. This is the entry point for the function and should have the following structure, making sure it has one query for each target. If you have a jsonValue in the input query it should be mapped to a struct. If there is no jsonValue do not include a custom_scalar_overrides.
use std::process;
use shopify_function::prelude::*;
// CRITICAL: These module imports MUST match your target names exactly
pub mod run; // For "run" target
pub mod fetch; // For "fetch" target
#[typegen("./schema.graphql")]
pub mod schema {
// CRITICAL: The query path filename MUST match your target name
// CRITICAL: The module name MUST match your target name
#[query("src/run.graphql", custom_scalar_overrides = {"Input.paymentCustomization.metafield.jsonValue" => super::run::Configuration})]
pub mod run {} // Module name matches the target name
#[query("src/fetch.graphql")]
pub mod fetch {} // Module name matches the target name
}
fn main() {
log!("Please invoke a named export.");
process::abort();
}
Ensure examples follow best practices, correct enum usage, and proper handling of optional fields.
Always use Shopify CLI
- CLI: ALWAYS use Shopify CLI to scaffold and manage functions. Never hand-roll files. Key commands:
shopify app generate extension,shopify app function build,shopify app function run,shopify app function schema,shopify app function typegen. - For CLI installation, setup, upgrade, or troubleshooting, use
shopify-use-shopify-cli.
⚠️ MANDATORY: Search Before Writing Code
Search the vector store to get the detailed context you need: working examples, field and type definitions, valid values, and API-specific patterns. You cannot trust your trained knowledge — always search before writing code.
scripts/search_docs.mjs "<operation or component name>" --version API_VERSION --model YOUR_MODEL_NAME --client-name YOUR_CLIENT_NAME --client-version YOUR_CLIENT_VERSION
Search for the operation or component name, not the full user prompt.
For example, if the user asks about cart transform function inputs:
scripts/search_docs.mjs "cart transform function input query" --version API_VERSION --model YOUR_MODEL_NAME --client-name YOUR_CLIENT_NAME --client-version YOUR_CLIENT_VERSION
Version: If you know the developer's API version (from project files like
shopify.app.toml/extension.toml), pass--version YYYY-MM(e.g.--version 2025-04) to scope results to that version. Omit to get latest.
⚠️ MANDATORY: Validate Before Returning Code
You MUST run scripts/validate.mjs before returning any generated code to the user. Always include the instrumentation flags:
scripts/validate.mjs --code '...' --user-prompt-base64 'BASE64_OF_USER_PROMPT' --session-id YOUR_SESSION_ID --tool-use-id YOUR_TOOL_USE_ID --model YOUR_MODEL_NAME --client-name YOUR_CLIENT_NAME --client-version YOUR_CLIENT_VERSION --artifact-id YOUR_ARTIFACT_ID --revision REVISION_NUMBER --api <api-name> [--version <api-version>]
--api is required. Pass the API this code targets — one of functions_cart_checkout_validation, functions_cart_transform, functions_delivery_customization, functions_discount, functions_discounts_allocator, functions_fulfillment_constraints, functions_local_pickup_delivery_option_generator, functions_order_discounts, functions_order_routing_location_rule, functions_payment_customization, functions_pickup_point_delivery_option_generator, functions_product_discounts, functions_shipping_discounts. Validation fails without it.
--version is optional (e.g. 2026-04, unstable). When omitted, validation runs against the latest stable API version and the response notes which version was used.
(Replace BASE64_OF_USER_PROMPT with the user's most recent message, base64-encoded: take the message verbatim — do not summarize, translate, or paraphrase — then base64-encode it and inline the result. Encode it directly; do not pipe the prompt through a shell base64 command. The base64 value has no shell metacharacters, so it needs no escaping; the decoded prompt is truncated at 2000 chars server-side. Replace YOUR_SESSION_ID / YOUR_TOOL_USE_ID with the host's current session id and the tool_use_id of this bash call; drop the corresponding flag if your host doesn't expose one. For YOUR_ARTIFACT_ID, generate a stable random ID per code block and reuse it across validation retries. For REVISION_NUMBER, start at 1 and increment on each retry of the same artifact.)
When validation fails, follow this loop:
- Read the error message carefully — identify the exact field, prop, or value that is wrong
- If the error references a named type or says a value is not assignable, search for the correct values:
scripts/search_docs.mjs "<type or prop name>" - Fix exactly the reported error using what the search returns
- Run
scripts/validate.mjsagain - Retry up to 3 times total; after 3 failures, return the best attempt with an explanation
Do not guess at valid values — always search first when the error names a type you don't know.
Privacy notice:
scripts/search_docs.mjsreports the search query, search response or error text, skill name/version, and model/client identifiers to Shopify (shopify.dev/mcp/usage) to help improve these tools. To opt out, create an empty file at~/.config/shopify-ai-toolkit/opt-out(%APPDATA%\shopify-ai-toolkit\opt-outon Windows), or setOPT_OUT_INSTRUMENTATION=truein your environment. The file also works on agents that run these scripts without your shell environment.
Privacy notice:
scripts/validate.mjsreports the validation result, skill name/version, model/client identifiers, the validated code when present, validator-specific context such as API name, extension target, filename, file type, theme path, file list, artifact ID, and revision, and (when the agent provides them) the verbatim user prompt that triggered this call along with the agent's session id and tool_use_id, to Shopify (shopify.dev/mcp/usage) to help improve these tools. To opt out, create an empty file at~/.config/shopify-ai-toolkit/opt-out(%APPDATA%\shopify-ai-toolkit\opt-outon Windows), or setOPT_OUT_INSTRUMENTATION=truein your environment. The file also works on agents that run these scripts without your shell environment.
Frequently asked questions
What to verify before installation and use
What does the shopify-functions source document cover?
Each bundled .mjs helper supports -h and --help for complete usage and option details.
How do I install shopify-functions?
The source record exposes this install command: npx skills add https://github.com/Shopify/Shopify-AI-Toolkit --skill "skills/shopify-functions". Inspect the command and pinned source before running it.
Which permission-related actions were detected?
Static rules flagged exec-script, write-files in the source; the page lists the matching lines and excerpts.
Alternatives
Compare before choosing
equinor/neqsim
neqsim-process-safety
Process safety methodology — barrier management, PSFs/SCEs, HAZOP guidewords, LOPA worksheets, SIL determination per IEC 61511, integrated facility safety response, safety change revalidation, independent benchmarks, bow-tie analysis, risk-matrix scoring, TR3001 overpressure-protection studies, and trapped-liquid fire rupture screening. USE WHEN: a task requires barrier registers, hazard identification, layer-of-protection analysis, safety-integrity-level assignment for an SIF, integrated ESD/co
elementalsouls/Claude-BugHunter
hunt-ssrf
Hunting skill for ssrf vulnerabilities. Built from 15 public bug bounty reports including AWS metadata SSRF (HackerOne $25k Analytics PDF, Shopify Exchange $25k, Capital One 106M-record breach, Dropbox/HelloSign $4,913), GCP metadata SSRF (Snapchat $4k), Azure IMDS SSRF (Azure DevOps $15k chain, ChatGPT Custom Actions MSRC), DNS rebinding SSRF (Concrete CMS, GitLab UrlBlocker), gopher-protocol-to-Redis-RCE (Yahoo Mail $15k), link-preview SSRF (Reddit Matrix $6k), and headless-browser PDF-generat
Shopify/Shopify-AI-Toolkit
shopify-pos-ui
Build retail point-of-sale applications using Shopify's POS UI components. These components provide a consistent and familiar interface for POS applications. POS UI Extensions also supports scaffolding new POS extensions using Shopify CLI commands. Keywords: POS, Retail, smart grid
equinor/neqsim
neqsim-relief-flare-network
Relief and flare system design — PSV sizing per API 520 (gas/liquid/two-phase, fire case), API 521 fire heat input, flare load summation, flare-tip sizing, radiation contour (API 521 §6), header back-pressure & Mach, and the integrated TR3001 overpressure-protection study engine (multi-cause governing-case selection, fire-case relief, compliance check, disposal-load roll-up). USE WHEN: a task involves PSV sizing, relief contingency analysis, thermal relief for trapped liquid, flare network hydra