Moody Lenses shopping assistant

For administrators reviewing this MCP server · last updated 5 August 2026

A read-only view of one Shopify store — Moody Lenses's — for AI assistants. A shopper browses the catalogue, picks a prescription, and is handed a link to Moody Lenses's own checkout. Operated by Curless.

What it cannot do

The short list first, because it is the answer to most review questions.

It cannot write anything. All four tools are reads. The app holds read_products, read_orders and read_discounts — no write scope exists on the token, so no order, product or customer record can be created or altered even by a bug.
It cannot take a payment. Checkout is a link to Shopify. No card number, billing address or payment token ever reaches this service.
It cannot read your users' data. There are no accounts here. It has no access to a user's files, mail, calendar or anything else on their machine — an MCP server is reached over HTTPS and sees only the arguments of the four calls below.
It cannot enumerate a merchant's customers. Order lookup answers exactly one order, and only when given the order number and the email it was placed with.

The four tools

list_moody_lenses — the catalogue. Optional free-text query, price cap, result limit.
get_moody_lens — one product: its options, prices, and which combinations are in stock.
create_moody_checkout — a Shopify cart link for one specific variant. Creates nothing; the URL is a link a browser can open.
lookup_moody_order — one order, by order number and email.

All four are annotated readOnlyHint: true, destructiveHint: false, openWorldHint: false.

What leaves the network

What a user types into their assistant reaches this server as tool arguments — a search term, a prescription, or an order number and email. Nothing else about the conversation is sent.

From this server outbound, two hosts only:

rqxbft-fw.myshopify.com — Shopify's Admin API, to read the catalogue and to look up a single order.
cdn.shopify.com — product images, fetched so the card can display them from this origin rather than the shopper's browser reaching Shopify directly.

Authentication

There is none, deliberately. A shopper has no account with this store's assistant, so there is nothing to authenticate them as, and requiring a sign-in to read a public catalogue would be theatre.

What guards it instead: the endpoint is read-only; the only sensitive answer it can give needs a matching order number and email; and both are rate-limited — 60 requests a minute per address overall, 10 a minute for order lookup. A wrong email and a non-existent order return the same answer, so the lookup cannot be used to confirm an order exists.

What is retained

Per-call logs — tool name, outcome, duration. No arguments, so no order numbers and no email addresses.
Web access logs — including IP addresses, as any web server keeps them.
Rate-limit counters — in memory only; discarded within minutes and on restart.
The merchant's Shopify token — file permissions 0600, on the server only, never sent anywhere but Shopify.

No shopper record is written, and nothing is sold, shared for advertising, or used to build a profile.

The interface

Results render as an MCP Apps card: one self-contained HTML document served as a ui:// resource, with its Content-Security-Policy declared to the host. It loads images from the two hosts above and makes no other network request.

Operations

Hosted by Curless on AWS, ap-southeast-1 (Singapore).
TLS by Let's Encrypt, renewed automatically.
Catalogue refreshed every five minutes; a failed refresh keeps serving the last good snapshot rather than presenting an empty store.
Health: /healthz.

Contact

Anything a shopper would ask — an order, a payment, a return — is Moody Lenses's: support@moodylenses.com, or https://moodycosmetics.com.

An administrator reviewing this server, or reporting a fault in it, reaches the operator at ops@curless.ai — kept here because the point of this page is to say who runs the thing you are being asked to approve.