AI connectors (MCP)

Filemonk has an MCP server, so an AI assistant can work with your store directly: look up an order, find out why a buyer did not get their files, resend an email, or change a setting. It reaches every API v2 action, with the same safety checks as the API.

https://app.filemonk.io/api/v2/external/mcp

You can also copy this URL from the Filemonk app, under Settings > Other > AI connectors.

Note

You do not need an API key to connect an assistant, and you should not paste one into a chat. The assistant signs in with OAuth and you approve it in your Shopify admin.

Connect Claude

1. Add a custom connector

   In Claude (claude.ai or Claude Desktop), open Settings > Connectors, choose Add custom connector, and paste the MCP URL above.

2. Sign in

   Claude opens a Filemonk sign-in page. Enter your store’s myshopify.com address and continue.

3. Approve in Shopify

   You land in your Shopify admin on a page that shows who is asking and what they will be able to do. Click Connect.

In Claude Code, one command does it:

claude mcp add --transport http filemonk https://app.filemonk.io/api/v2/external/mcp

Claude Code opens the same sign-in in your browser.

Connect ChatGPT

In ChatGPT, add a custom connector (an MCP app) and paste the MCP URL. ChatGPT registers itself, opens the same Filemonk sign-in page, and you approve it in your Shopify admin exactly as above. Which plans and settings allow custom connectors is decided by OpenAI; if you do not see the option, check ChatGPT’s own help.

Connect Cursor

Add Filemonk as a remote MCP server in Cursor’s MCP settings (mcp.json):

{
  "mcpServers": {
    "filemonk": {
      "url": "https://app.filemonk.io/api/v2/external/mcp"
    }
  }
}

Cursor signs in with OAuth the first time it uses the server. If you would rather skip the browser, send your API key as a header (for a tool you run yourself, never one you share):

{
  "mcpServers": {
    "filemonk": {
      "url": "https://app.filemonk.io/api/v2/external/mcp",
      "headers": { "X-Auth-Token": "fm_api_key_your_key_here" }
    }
  }
}

Use a connector key instead

If you cannot approve inside the Shopify admin, choose Use a connector key instead on the Filemonk sign-in page and paste the connector key from Settings > Other > AI connectors. Then click Allow.

• The connector key only approves connections. It is not the API key, and sending it as a header is rejected with a 401.
• Treat it like a password: anyone holding it can approve an assistant for your store.
• Rotating it in the Filemonk app disconnects every assistant, so you can cut off access in one step.

What the assistant can do

The server gives the assistant three tools. Instead of one tool per action, they cover the whole of API v2, so a new action is available the moment it ships.

Tool	What it does
search	Finds the action that matches what you asked for, from plain words like “resend the download email”.
execute_read	Runs a read (GET): look up orders, files, products, licence keys, download logs, emails and settings.
execute_write	Runs a write (POST, PUT, PATCH, DELETE): resend an email, attach a file, revoke access, change a setting.

Things you can ask, once connected:

• “Why didn’t order #1042 get its files?”
• “How many orders did we get this month?”
• “Resend the download email for #1042.”
• “Which products have no files attached?”
• “How many licence keys are left?”
• “Change the thanks text on the download page, in German.”

Each call uses the same rate-limit budget as the API (a read costs 1 point, a write 2), so the assistant cannot exceed the limits. The connector manifest is public at https://app.filemonk.io/api/v2/external/mcp.json.

Safety: preview, then confirm

Assistants work with the same preview and confirm rule as the API:

• Destructive actions (deleting files, products or licence keys, and similar) do nothing on the first call. They return what would change and how many records it touches, and the assistant is told to tell you and wait.
• Only after you agree does it repeat the call with confirm: true.
• A write can carry an idempotency_key. Repeating the same call with the same key within 24 hours returns the first result instead of running it again, so a retry never sends an email twice.
• Actions that Filemonk does not offer to outside tools are refused with an explanation of where to do them in the app.

Every call is limited to your store; an assistant connected to one store cannot see another.

Ending a connection

Rotate the connector key in Settings > Other > AI connectors to disconnect every assistant at once. Access tokens last 24 hours, and an assistant that has not been used for 30 days has to be approved again.

For developers: OAuth by hand

The server follows the standard flow: authorization-server metadata at /.well-known/oauth-authorization-server, dynamic client registration (POST /api/v2/external/oauth/register), authorization code with PKCE S256 (/api/v2/external/oauth/authorize), token exchange and refresh (POST /api/v2/external/oauth/token) and revocation (POST /api/v2/external/oauth/revoke), all on https://app.filemonk.io. Clients that use an HTTPS client id URL are accepted without registering. A request without a usable credential answers 401 with a WWW-Authenticate header pointing at the resource metadata, which is how clients find the sign-in. Redirect URLs must be https, except loopback addresses (http://127.0.0.1:<port>, for tools running on your own machine).