MCP server for CS-Cart: step-by-step guide

How it works

The MCP server is a separate service that stands beside the store and talks to it through the CS-Cart REST API. The AI assistant never connects to the store directly: it sends a question to the server, the server turns it into an API call, fetches the data and hands it back in a form the model understands. No core file of the store changes, and the only thing installed on the CS-Cart side is the ss_mcp add-on, which gives the API a few ready-made reports.

In the standard setup the server is read-only. It answers questions about products, categories, orders, customers and sales, but changes nothing in the store. Every connection needs an access token, and a token can be revoked at any moment.

What you will need

A CS-Cart or Multi-Vendor store, version 4.12.1 or newer (that is what the ss_mcp add-on requires; the server itself only uses the REST API).
Access to the admin panel with the right to create administrators.
The MCP server address and an access token. For an instance we host, demo instances included, we send you both by email, the token always in a separate message.
An MCP client: Claude Desktop, claude.ai in the browser, or n8n with the MCP Client node.

Step 1. An API user in the store

The server signs in to the store as a specific user, so it is best to create a separate administrator account for it, not tied to any member of your team. Such an account can be switched off later in one move, with no effect on the rest of the panel.

In the panel go to Customers > Administrators and add a new administrator, for example with the address mcp@yourstore.com. Save the profile.
Open the profile again. The API access tab only appears after the account has been saved once.
On that tab tick API access for this user. The store generates an API key.
Copy the key straight away. Once you save the changes the panel will never show it again, and a lost key can only be replaced with a new one.
Check the store time zone in Settings > Appearance, field Time zone. The server has to use the same zone, otherwise order dates in answers shift by the time difference.

The account has to stay active. A disabled administrator is refused by the API, and the server then reports that the store rejected authentication.

In Multi-Vendor the API key can be given to an administrator. An administrator account sees the data of every vendor, orders and customers included, so connecting it is a decision worth making consciously, as with any integration that has full access.

If we host the server for you, send us the store address, this administrator’s email, the API key and the time zone. Ideally the key in a separate message.

Step 2. The ss_mcp add-on

The core CS-Cart API returns neither sales broken down by product, nor a single customer’s spending, nor a ready revenue total. The ss_mcp add-on adds four read-only reports, worked out with the same core functions the admin panel uses:

sales statistics with a comparison to the previous period,
a ranking of the best-selling products,
a summary of a single customer’s purchases,
abandoned carts.

Installation:

Go to Add-ons > Manage add-ons and choose Manual installation.
Point to the add-on zip file and confirm the installation.
The add-on appears on the list as active. The Customers menu gains an item called MCP data source.

The add-on has no settings you need to fill in. Its configuration holds only an information field and optional query logging, useful for diagnostics. It counts the paid amount by the order statuses that have payment received ticked in your store, so it relies on what is already configured.

The server also works without the add-on, but some answers are thinner then. The product ranking and the customer summary reply that the add-on is missing, the server works revenue out on its own from at most 500 orders and without a period comparison, and abandoned carts come from the core API with less precision.

Step 3. Connecting an MCP client

To connect you need two things from our email: the server address, for example https://mcp.cs-cart.com.pl/demo/your-store/mcp, and the token. The token goes in the Authorization header as Bearer, a space and then the token.

Claude Desktop

Claude Desktop connects to a remote server through the mcp-remote helper, which needs Node.js installed. In the app go to Settings > Developer > Edit Config and add to the claude_desktop_config.json file:

{
  "mcpServers": {
    "cscart-store": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "SERVER_ADDRESS",
        "--header",
        "Authorization:${AUTH_HEADER}"
      ],
      "env": { "AUTH_HEADER": "Bearer YOUR_TOKEN" }
    }
  }
}

Replace SERVER_ADDRESS with the address from our email and YOUR_TOKEN with the token. The header is deliberately written without a space after the colon, and the token itself sits in an environment variable, because on Windows a space inside an argument can break the command. After saving the file, quit Claude Desktop completely and start it again. The store tools appear in the chat window.

claude.ai in the browser

In Settings > Connectors choose Add custom connector and enter the server address. If the dialog has a Request headers section, add an authorization header with the value Bearer YOUR_TOKEN, typing the word Bearer yourself. That section is only available on some accounts for now. Without it a token connection will not work, and Claude Desktop or n8n remain.

n8n

Add an MCP Client node to the workflow and set the server address, the HTTP Streamable transport and Bearer Auth authentication with the token stored in credentials. The node can be attached as a tool of an AI agent or called directly, for example in a report sent every Monday.

Step 4. First questions

Start by checking the connection. Ask the assistant whether the connection to the store works. It then calls the health_check tool, which reports whether the store answers and how fast. After that you can ask in plain language:

What was revenue this month compared with the previous one?
Which products sold best this year?
Show the latest orders and their statuses.
How much has the customer jan@example.com spent and what did they buy most often?
Which customers abandoned a cart, and for what amount?
What is the stock level and price of the product whose name contains the word jacket?

The assistant picks the tools and their order itself, so one question can run several of them in turn.

What the server can do

Tool	Questions it answers	ss_mcp add-on
health_check	whether the connection to the store works	no
get_products	product search: name, price, stock, status	no
get_product_details	full product data, including code, prices, weight and description	no
get_categories	category tree with product counts	no
get_product_reviews	product reviews and ratings (needs the core Comments and reviews add-on)	no
get_orders	order list filtered by status, email and period	no
get_order_details	order details: products, customer, shipping address, payment method, totals with shipping cost	no
get_customer_info	customer data by email or number	no
get_store_stats	product and order counts, revenue, period comparison	recommended
get_abandoned_carts	abandoned carts: customer, email, value, number of products, cart age	recommended
get_top_products	product ranking by sales	required
get_customer_summary	a customer’s purchase history and spending	required

Sales questions cover the periods known from the CS-Cart panel: today and yesterday, this and last week, this and last month, this and last year, as well as the last 24 hours, the last 7 and the last 30 days. Without a period the ranking and the statistics cover the current month or the whole history, depending on the tool. An arbitrary from-to date range is not supported yet.

Revenue leaves out cancelled, declined, failed and incomplete orders. Product, order and cart lists return at most 100 items at a time, so for large reports it is better to ask about a specific period or filter.

Multi-Vendor

With an administrator key the server sees the whole marketplace, and that is how we test it. An order placed with several vendors is not counted twice: the reports take the vendor orders into account, not the parent order that groups them. Abandoned carts are available to the administrator only, because in Multi-Vendor a cart is not tied to a vendor. When the add-on handles a vendor’s request, the statistics, the ranking and the customer summary are limited to that vendor’s own company.

Security

The server is read-only. Write tools, that is changing an order status and a stock level, exist but are switched off and do not appear on the tool list until we enable them at your explicit request.
Every connection needs a token. A token has an expiry date, and a revoked one stops working at once, without a server restart. The server keeps only its cryptographic hash.
The server has no database of its own and copies no store content. It fetches only what a question asks for.
You can cut off access to the store on your side at any time by disabling the administrator from step 1 or their API access.

Troubleshooting

The assistant does not see the store tools. In Claude Desktop the usual cause is a syntax error in the configuration file or missing Node.js. Check that the file is valid JSON and restart the app.

The server replies Wymagany naglowek Authorization: Bearer <token>. or Nieprawidlowy token. (missing header, invalid token). The token does not arrive or has a typo. Check that the word Bearer and a single space stand before the token.

The server replies Token wygasl. (token expired). The expiry date has passed. For a demo, write to us and we will extend it without changing the token.

A tool returns Sklep odrzucil uwierzytelnienie (HTTP 401/403). (the store rejected authentication). The API key is out of date, the administrator was disabled or their email changed. Generate a new key in the administrator’s profile and send it to us.

A tool returns Blad polaczenia ze sklepem (store connection error), or health_check shows no connection. The store is unavailable or blocks API traffic, for example with a firewall or bot protection. Check that the store address followed by /api opens from outside.

The product ranking or the customer summary says it needs the add-on. The ss_mcp add-on is not installed or is disabled. Go back to step 2.

Order dates are shifted by a few hours. The server time zone does not match the store’s. Send us the zone from Settings > Appearance.

What next

We write more about what MCP is and what to think through before connecting AI to store data in the article An MCP server for your store. The service description and pricing are on the MCP server for CS-Cart page. If you would like to try the server on your own store, get in touch and we will run a demo on our infrastructure.

MCP server for CS-Cart, a step-by-step guide