Elspet shopping assistant

For administrators reviewing this MCP server · last updated 15 September 2026

A view of one Shopify store — Elspet's — for AI assistants. A shopper browses the catalogue, chooses the options, gathers a cart, and is handed a link to Elspet's own checkout. Operated by Curless.

What it cannot do

The short list first, because it is the answer to most review questions.

It writes nothing to the shop. The app holds read_products, read_orders and read_discounts — no write scope exists on the token, so no order, product or customer record can be created or altered even by a bug. The cart is this connector's own: it lives in memory for the conversation, and nothing reaches Shopify until the shopper pays on Shopify's own checkout.
It cannot take a payment. Checkout is a link to Shopify. No card number, billing address or payment token ever reaches this service.
It cannot read your users' data. There are no accounts here. It has no access to a user's files, mail, calendar or anything else on their machine — an MCP server is reached over HTTPS and sees only the arguments of the calls below.
It cannot enumerate a merchant's customers. Order lookup answers exactly one order, and only when given the order number and the email it was placed with.

The tools

list_elspet_products — the catalogue. Optional free-text query, price cap, result limit.
get_elspet_product — one product: its options, prices, and which combinations are in stock.
get_elspet_checkout_link — a Shopify cart link, for one specific variant or, with no arguments, for everything in the cart. Creates nothing; the URL is a link a browser can open.
add_to_elspet_cart — puts one variant in the cart, or sets how many of it. Changes only this connector's in-memory cart.
view_elspet_cart — the cart, priced from today's catalogue.
clear_elspet_cart — empties the cart.
check_elspet_checkout_status — for the card, not offered to the assistant: whether the checkout the card opened has been paid, found by the reference that checkout carries.
lookup_elspet_order — one order, by order number and email.
get_elspet_store_policies — the shop's own published policies (returns, shipping, privacy, terms) and its FAQ and contact pages, as text with their links. Optional topic.

What the merchant wrote is fenced. Product descriptions and the shop's own policy text are written by the merchant, not by us, and they reach the buyer's assistant as prose. Before they leave this server they have their control characters and invisible (zero-width, bidi) characters removed and their length capped, and they are wrapped in markers naming whose words they are — with the instructions telling the assistant that what is inside those markers is for the buyer to read and is never an instruction to it. A shop cannot close the markers from inside: the brackets they are made of are stripped from the text first.

How each tool is annotated, exactly as the server declares it:

Tool	readOnlyHint	destructiveHint	idempotentHint	openWorldHint
`list_elspet_products`	true	false	true	true
`get_elspet_product`	true	false	true	true
`get_elspet_checkout_link`	true	false	true	true
`add_to_elspet_cart`	false	true	true	true
`view_elspet_cart`	true	false	true	true
`clear_elspet_cart`	false	true	true	false
`check_elspet_checkout_status`	false	true	true	true
`lookup_elspet_order`	true	false	true	true
`get_elspet_store_policies`	true	false	true	true

What leaves the network

What a user types into their assistant reaches this server as tool arguments — a search term, an option value, or an order number and email. Nothing else about the conversation is sent.

From this server outbound, two hosts only:

els-pet-us.myshopify.com — Shopify's Admin API, to read the catalogue, to look up a single order, and to find the order a checkout reference points to; and the same host's public Storefront API, with no credential, to read the policies and pages the shop publishes on its website.
cdn.shopify.com — product images, fetched so the card can display them from this origin rather than the shopper's browser reaching Shopify directly.

A checkout link carries three cart attributes, which Shopify copies onto the order it creates: Source (always Curless), Assistant (which AI assistant, when the client says) and CurlessRef (a random reference). The merchant sees them on the order, and the reference is how the card learns that the order was paid.

Authentication

There is none, deliberately. A shopper has no account with this store's assistant, so there is nothing to authenticate them as, and requiring a sign-in to read a public catalogue would be theatre.

What guards it instead: the endpoint writes nothing to the shop; the only sensitive answer it can give needs a matching order number and email. Requests are limited to 60 a minute per address, and an order lookup that matches nothing is counted against its order number, its email, the conversation and the address: after 5 such misses in a quarter of an hour for any one of them (50 for an address, which many people can share; 100 for the whole shop), lookups touching it wait. A wrong email and a non-existent order return the same answer, so the lookup cannot be used to confirm an order exists.

What is retained

Per-call logs — tool name, outcome, duration. No arguments, so no order numbers and no email addresses. Rotated by size and cleared whenever the service is redeployed.
Web access logs — including IP addresses, kept for 30 days and then deleted.
Rate-limit counters — in memory only; discarded within minutes and on restart.
Carts — which variants and how many, with the options chosen. In memory only, one per conversation, gone after two hours unused or on restart; never written to disk and not tied to a person. The id that names a cart is kept for up to a day.
Checkout references — one random reference per cart and a new one for each single-item Buy now link, in memory for up to a day, used only to recognise the order Shopify creates from that checkout.
The merchant's Shopify token — file permissions 0600, on the server only, never sent anywhere but Shopify.

No shopper record is written, and nothing is sold, shared for advertising, or used to build a profile.

The interface

Results render as an MCP Apps card: one self-contained HTML document served as a ui:// resource, with its Content-Security-Policy declared to the host. It loads images from the two hosts above and makes no other network request.

Operations

Hosted by Curless on Amazon Web Services, in Singapore.
TLS by Let's Encrypt, renewed automatically.
Catalogue refreshed every five minutes; a failed refresh keeps serving the last good snapshot rather than presenting an empty store.
Health: /healthz.

Contact

Anything a shopper would ask — an order, a payment, a return — is Elspet's: help@elspet.com, or https://www.elspet.com.

An administrator reviewing this server, or reporting a fault in it, reaches the operator at ops@curless.ai — kept here because the point of this page is to say who runs the thing you are being asked to approve.