← Tool reference

update_cart_lines

A WebMCP tool distributed by Shopify. 95,582 of the sites we crawled carry a tool set that includes it (95.7% of vendor-distributed detections). This is a documented platform feature, not a vulnerability. Individual sites did not each choose it one by one.

What the tool declares

The description below is quoted as Shopify publishes it, in the distributed bundle:

Change the quantity of items already in the cart, or remove them. Every change here addresses an existing cart line by its id, so call get_cart first unless you already have line_items[].id from an earlier get_cart in this conversation. Pass the ABSOLUTE target quantity, not a delta — quantity 2 means the line ends up at 2 regardless of what it was. Use quantity 0 to remove the line entirely. Batch every change for ONE request into a SINGLE call — line_items accepts up to 10 entries; do NOT call update_cart_lines once per line. Batching applies WITHIN a single request: each new thing the user asks for later is its own call. This tool cannot add new merchandise. To add something not already in the cart, use add_to_cart. To empty the whole cart at once, use cancel_cart.

The input it asks for

The full input schema, as declared:

{
  "type": "object",
  "required": [
    "cart"
  ],
  "properties": {
    "cart": {
      "type": "object",
      "required": [
        "line_items"
      ],
      "properties": {
        "line_items": {
          "type": "array",
          "description": "Existing cart lines to update or remove (1-10).",
          "minItems": 1,
          "maxItems": 10,
          "items": {
            "type": "object",
            "required": [
              "id",
              "quantity"
            ],
            "properties": {
              "id": {
                "type": "string",
                "description": "Existing cart line id from get_cart line_items[].id. Required — this tool cannot resolve products by name."
              },
              "quantity": {
                "type": "integer",
                "description": "Absolute target quantity for this line (not a delta). 0 removes the line.",
                "minimum": 0
              }
            }
          }
        }
      }
    }
  }
}

What we checked

We read the tool set the page declares and we never invoke a tool. We fetched and analysed the distributed bundle that declares this tool, so these copies carry no unverified-implementation signal. What a tool does is inferred from its name and description, and we have not yet published an accuracy measurement for that inference. These are measured indicators, not audits. The crawl is a sample, not a census.

Vendor documentation: https://shopify.dev/docs/api/web-mcp

Other tools in the same sets

• add_to_cart
• browse_store
• cancel_cart
• get_cart
• get_product
• get_ucp_profile
• manage_orders
• proceed_to_checkout
• search_catalog
• search_shop_policies_and_faqs
• show_variant

Source