manage_orders
A WebMCP tool distributed by Shopify. 99,664 of the sites we crawled carry a tool set that includes it (99.7% of vendor-distributed detections). This is a documented platform feature, not a vulnerability. Individual sites did not each choose it one by one.
What the tool declares
The description below is quoted as Shopify publishes it, in the distributed bundle:
Navigate to the customer's order history page. Use when the user asks about past orders, order status, tracking, or returns. The user will be prompted to log in if not already authenticated. This MOVES the browser to the order history page; the tool result then confirms the destination and instructs you not to navigate again — follow it.
| Vendor | Shopify |
|---|---|
| Sites | 99,664 in 3 tool sets (64,429 + 31,153 + 4,082) |
| Declared by bundle versions | 0.1.0, 0.1.1, 1cd8a9f0, f427de6a |
| Read-only hint | readOnlyHint: false |
The input it asks for
The tool takes no input.
The full input schema, as declared:
{
"type": "object",
"properties": {}
}What we checked
We read the tool set the page declares and we never invoke a tool. We fetched and analysed the distributed bundle that declares this tool, so these copies carry no unverified-implementation signal. What a tool does is inferred from its name and description, and we have not yet published an accuracy measurement for that inference. These are measured indicators, not audits. The crawl is a sample, not a census.
Vendor documentation: https://shopify.dev/docs/api/web-mcp
Other tools in the same sets
add_to_cartbrowse_storecancel_cartget_cartget_productget_ucp_profileproceed_to_checkoutsearch_catalogsearch_shop_policies_and_faqsshow_variantupdate_cartupdate_cart_lines
Source
25d8fb700a3a3e973ea18e6ac678d15762cce58a46690334defa5b05b9142e13.
Declarations: captured from the vendor's distributed bundles, each checked against a recorded sha256.
See the Shopify tool sets
and what a tool declares and what a crawler cannot see.