← Tool reference

update_cart

A WebMCP tool distributed by Shopify. 4,082 of the sites we crawled carry a tool set that includes it (4.1% of vendor-distributed detections). This is a documented platform feature, not a vulnerability. Individual sites did not each choose it one by one.

What the tool declares

The description below is quoted as Shopify publishes it, in the distributed bundle:

Add products to the cart, update line item quantities, or remove items. Batch EVERY change for one request into a SINGLE call — line_items accepts up to 10 entries; do NOT call update_cart once per item. Do NOT retry a call that already returned a result: adds are cumulative, so repeating a call adds duplicate items. Use line_items[].item.id with a ProductVariant GID when the exact variant is known. Use line_items[].id from get_cart to update or remove an existing line, passing the ABSOLUTE target quantity (not a delta; quantity 0 removes the line). Use handle or query only when adding the selected or first available variant.

The newest bundle version no longer declares this tool.

The input it asks for

The full input schema, as declared:

{
  "type": "object",
  "required": [
    "cart"
  ],
  "properties": {
    "cart": {
      "type": "object",
      "required": [
        "line_items"
      ],
      "properties": {
        "line_items": {
          "type": "array",
          "description": "Items to add or update (1-10).",
          "items": {
            "type": "object",
            "properties": {
              "id": {
                "type": "string",
                "description": "Existing cart line id from get_cart. Use to update or remove an existing line. Omit when adding new items."
              },
              "item": {
                "type": "object",
                "description": "The merchandise to add.",
                "properties": {
                  "id": {
                    "type": "string",
                    "description": "ProductVariant GID from get_product variants[].id, e.g. \"gid://shopify/ProductVariant/123\"."
                  }
                }
              },
              "handle": {
                "type": "string",
                "description": "Product handle. Adds the selected or first available variant; call get_product first if the user requested specific options."
              },
              "query": {
                "type": "string",
                "description": "Search query to find and add the selected or first available variant. For specific variants, call search_catalog/get_product first and pass item.id."
              },
              "quantity": {
                "type": "integer",
                "description": "Quantity. Defaults to 1 for adds and updates. Set to 0 with an existing line id to remove it.",
                "default": 1
              }
            }
          }
        }
      }
    }
  }
}

What we checked

We read the tool set the page declares and we never invoke a tool. We fetched and analysed the distributed bundle that declares this tool, so these copies carry no unverified-implementation signal. What a tool does is inferred from its name and description, and we have not yet published an accuracy measurement for that inference. These are measured indicators, not audits. The crawl is a sample, not a census.

Vendor documentation: https://shopify.dev/docs/api/web-mcp

Other tools in the same sets

• browse_store
• cancel_cart
• get_cart
• get_product
• manage_orders
• proceed_to_checkout
• search_catalog
• search_shop_policies_and_faqs
• show_variant

Source