README

This is a sub-module for the Magento2 MCP module

Customer-domain MCP tools for Magebit_Mcp. Reads and writes against customer accounts, addresses, customer groups, and account management flows (password reset, confirmation).

Each tool is a thin wrapper over a Magento service contract (CustomerRepositoryInterface, AddressRepositoryInterface, GroupRepositoryInterface, AccountManagementInterface) and composes its read response from field resolvers that 3rd-party modules can extend.

Install

composer require magebitcom/magento2-mcp-customer-tools
bin/magento module:enable Magebit_McpCustomerTools
bin/magento setup:upgrade
bin/magento setup:di:compile
bin/magento cache:flush

Tool catalog

Read tools

Write tools

All writes require the global magebit_mcp/general/allow_writes flag and the token's own allow_writes flag to be 1. Destructive operations additionally set requires_confirmation so MCP clients (Claude Desktop, etc.) prompt before firing.

Every write tool also implements Magebit\Mcp\Api\UnderlyingAclAwareInterface so the handler blocks calls from admins who wouldn't be allowed to perform the same action in the admin UI.

Identity lookups

customer.customer.get, customer.customer.update, customer.customer.delete, customer.account.confirmation_status accept either id (numeric primary key) or email. Email lookups take an optional website_id because customer/account_share/scope may be per-website (the Magento default), in which case the same address can exist on multiple sites as distinct accounts.

Address tools are keyed by numeric id only — addresses are unique per row, not per customer+label.

PII handling

Customer and address records are PII-heavy by design. Every read tool exposes the fields / exclude arguments so callers can narrow the payload:

• customer.customer.get { fields: ["identity", "scope"] } — just id / email / website / group.
• customer.customer.get { exclude: ["addresses", "profile"] } — skip the full address book and the dob/gender/taxvat triplet.
• customer.customer.list ships with a lean default set (identity, scope, timestamps) — addresses, custom_attributes, and extension_attributes are omitted from list responses to avoid multiplying the payload by the size of each customer's attribute set.

Audit summaries stored in magebit_mcp_audit_log contain identifiers only (id, email, website_id, row counts) — never the full record.

Extending

See docs/EXTENDING.md for:

• adding a new field to any tool response via CustomerFieldResolverInterface / AddressFieldResolverInterface / GroupFieldResolverInterface;
• adding a new filter to any list tool via CustomerFilterTranslatorInterface / AddressFilterTranslatorInterface / GroupFilterTranslatorInterface;
• the ACL layering rules for custom write tools.

License

Released under the MIT License.

Have questions or need help? Contact us at info@magebit.com