Running Your Store with AI Agents: What MCP Means for Operators

MCP is a common interface, not an autonomous store manager

Our AI operations page explains the built-in MCP tools, supported assistants and live-action boundaries on the platform.

The Model Context Protocol, or MCP, is an open standard introduced by Anthropic in November 2024. It lets AI assistants connect to tools and data through a common interface. The useful analogy is a USB-C port for AI apps: clients can connect through a shared shape instead of requiring a wholly separate integration for each tool. Like a physical port, that common shape does not decide which connections are safe.

Anthropic’s MCP introduction describes the protocol’s purpose. For an operator, the important distinction is between connection and authority. A model may be able to request an order lookup without being allowed to issue a refund. A client may understand a page-editing tool without being allowed to publish. The server and staff permissions must enforce those boundaries; a polite instruction to the model is not access control.

An assistant can propose; your operation still owns the outcome

Use an agent for bounded tasks with defined inputs and outputs. Specify which records it may inspect, which fields it may change and when it must stop for review. Ask for evidence and a change summary rather than trusting fluent text. Research-use-only product information needs the same scrutiny whether a person or model drafts it. An agent cannot establish regulatory compliance, processor eligibility or the accuracy of laboratory results.

Useful store tasks are specific and reviewable

Catalog work can include drafting research-framed descriptions, proposing alt text and identifying missing specifications. Inventory work can include checking stock and preparing a restock review. Order tools can support lookups and internal notes; fulfilment actions need explicit scope because they can affect customer notifications and operational state. Discounts require rules, eligibility and approval before activation. Do not give an agent an open-ended instruction to optimise the whole business.

Page drafts, missing-meta-description cleanup and sales summaries are good candidates when the data is well defined. Customer inbox replies should be drafted against real policy and order information, not invented delivery promises. Review the compliance checklist before delegating any customer-facing writing. An assistant that can produce text quickly can also repeat a mistaken claim across products, email and promotions unless the workflow contains a review boundary.

Keep humans responsible for money, access and publication

Payments, refunds, staff permissions and API keys should never be delegated without a human decision. Peptide Website goes further at the tool boundary: those capabilities are not exposed to the agent. Do not confuse an order lookup with permission to act on its payment. If a customer requests a refund, the assistant can help organise the relevant information, but the authorised human follows the ordinary refund workflow.

Publishing also needs review. A plausible description can misstate specifications, invent laboratory evidence or imply human use. A discount can be structurally valid yet commercially wrong. Destructive actions can remove useful pages or break links. Preview the exact objects and proposed changes, then confirm through the required separate step. If the scope changes between preview and execution, stop and review again rather than treating an earlier broad approval as unlimited permission.

Treat incoming content as data, not instructions

Customer messages, product imports and external documents may contain text that looks like instructions to an agent. That text must not override staff permissions or cause the assistant to reveal secrets. A message asking support to ignore policy is still a customer message, not a system command. Keep tools narrow, avoid unnecessary data exposure and train reviewers to question results that suddenly demand broader access or unrelated actions.

Guardrails are a workflow and an enforced boundary

• Leave agent access off by default until an owner enables it deliberately.
• Use OAuth with scoped access, or a controlled personal-token workflow.
• Act with the connecting staff member’s role, not a universal administrator role.
• Start customer-facing edits as drafts and show the proposed changes.
• Require preview and a confirmed second call for publish, delete and cost actions.
• Run the compliance checker on agent-written copy before approval.
• Record tool activity and consequential changes in a full audit log.
• Apply rate limits and review unexpected bursts of tool activity.
• Keep payments, refunds, staff and API keys outside the exposed agent tool surface.
• Revoke unneeded client access and review connections when staff responsibilities change.

Authentication identifies the connection; authorisation limits what it can do. OAuth scopes and the staff role should both be considered, not treated as interchangeable. Personal tokens need controlled storage and revocation. Never paste a token into a product description, customer reply or public guide. An audit record helps answer what happened, but it is not a substitute for preventing an unauthorised action. Check that denied actions stay denied.

The copy checker can be configured off, warn or block across the relevant writing surfaces, including AI-agent edits. A warning mode supports review; it is not an approval stamp. Use blocking where the operation requires it, and have counsel review the underlying requirements. This is not legal advice. Combine automation with accountable review rather than claiming a regex check can certify an entire research-use-only business.

Four bounded workflows an operator can review

Weekly restock review: read first, purchase separately

Prompt → “Review low-stock catalog items and current inventory for the weekly restock meeting. Do not place orders or change quantities.” Tool → inventory and catalog read tools return stock records and relevant alerts. Result → a review list with item identifiers, recorded quantities and unresolved questions. The operator checks the source and decides what to purchase through the normal process. A snapshot is not a forecast, and the agent should not invent demand assumptions.

New-lot launch: draft against actual evidence

Prompt → “Draft a research-framed launch page for this existing lot using its approved specifications and public COA. Leave it unpublished.” Tool → catalog and page-design tools read the lot record and create a draft; the compliance checker reviews the copy. Result → a preview with a change summary and links to the evidence. A person checks lot identity, certificate access and wording before a separately confirmed publish call. Missing data remains a question, not an invitation to invent a result.

SEO cleanup: fix descriptions without changing claims

Prompt → “Find products missing meta descriptions and propose unique research-framed descriptions from their existing specifications. Do not publish.” Tool → SEO and catalog tools identify missing fields and prepare draft changes. Result → a product-by-product review list showing existing source fields and proposed text. Check length, uniqueness and accuracy before approval. The SEO guide explains why metadata and structured content support discoverability without promising rankings.

Monday sales summary: define the report before interpreting it

Prompt → “Summarise last week’s net sales and order activity in the store timezone, noting refunds and incomplete data. Make no operational changes.” Tool → reporting tools retrieve the defined period and metrics. Result → a summary with the date range, metric definitions and source limitations. The operator compares it with the admin report. If the tool cannot answer a requested breakdown, the agent should say so rather than substituting a guessed number or an unsupported causal explanation.

Connecting a client should not expand its permissions

The stated Peptide Website platform works with Claude, ChatGPT, Claude Code, Cursor, VS Code, Codex, Gemini CLI and Windsurf. Client setup can vary, so establish the intended connection and access method before relying on a workflow. A different client is not a different staff role. Keep the same review rules when switching from a chat interface to a development assistant, and test the permitted tool surface before using production records.

Start with a read-only review using non-sensitive records, then try a draft edit and inspect its audit entry. Confirm that a low-privilege staff member cannot use a client to bypass the ordinary admin restrictions. Demonstrate what happens when a request is blocked, a token is revoked or a second confirmation is absent. Keep the connection inventory in the handoff so access does not become an undocumented dependency on one person’s laptop.

How Peptide Website implements the boundary

Peptide Website has a built-in MCP server with 79 tools covering catalog, orders, customers, pages and design, SEO, shipping, taxes, draft orders and reports. Authentication supports OAuth 2.1 with PKCE or personal tokens. Agent access is off by default, follows the connecting staff member’s role and uses draft-first work. Publish, delete and cost actions require a confirmed second call; agent copy passes the compliance check and activity is audited.

Payments, refunds, staff and API keys are never exposed through that agent tool surface. Discuss the actual operating tasks in the AI section, not a promise of a fully autonomous store. Consider the site-speed guide when reviewing any new storefront work an agent proposes, and keep evidence review separate from copy generation. The useful outcome is less repetitive admin work with visible boundaries, not less human accountability.