Catalog API & MCP

A growing share of shoppers ask an AI assistant before they ever open a search engine. Solidshop makes sure those assistants can actually find your products: every store exposes a read-only catalog API in two flavours — conventional REST endpoints, and an MCP server that agent runtimes such as Claude can call directly as tools. Both are part of the free core, enabled on install, and require no setup.

The design principle behind both surfaces: every response carries the canonical URL of the page it describes. When an assistant recommends one of your products, the shopper lands on your storefront — your product page, your cart, your checkout. The API is a discovery layer, not a sales channel of its own.

What is (and is not) exposed

The catalog API is a guest. It serves exactly the data an anonymous visitor sees in your storefront HTML — published products, categories and brands on public access levels, in your store’s enabled languages and display currencies. Nothing more:

  • Stock is a yes/no answer. The API says whether a product or variant is in stock — never how many units you hold.
  • No cost prices. Your margins are yours.
  • No customer or order data. The API has no orders, no carts, no accounts — it is read-only catalog discovery, nothing else.
  • Hidden stays hidden. Unpublished or access-restricted products answer exactly like products that don’t exist.

The REST endpoints

All endpoints are GET, served by Joomla’s API application under your site’s /api path: 

GET /api/index.php/v1/solidshop/products
GET /api/index.php/v1/solidshop/products/{id}
GET /api/index.php/v1/solidshop/products/{id}/variants
GET /api/index.php/v1/solidshop/categories
GET /api/index.php/v1/solidshop/categories/{id}
GET /api/index.php/v1/solidshop/brands
GET /api/index.php/v1/solidshop/brands/{id}

The products list accepts filter[search], filter[category], filter[brand], filter[min_price] / filter[max_price], filter[in_stock], sort and JSON:API paging (page[limit], capped at 50). Add lang=de-DE on a multilingual site to get translated content, and currency=USD to get prices converted into any display currency you have enabled — the same conversion your storefront’s currency switcher uses.

The MCP server

MCP (Model Context Protocol) is the standard AI agents use to call external tools. Your store’s MCP endpoint lives at: 

https://www.example.com/api/index.php/v1/solidshop/mcp

It serves five read-only tools:

  • solidshop_search_products — free-text search with category, brand, price and availability filters
  • solidshop_get_product — one product in full detail: description, images, options, per-variant price and availability, specifications
  • solidshop_list_categories — the category tree with product counts
  • solidshop_list_brands — brands with product counts
  • solidshop_get_store_info — store profile: contact details, currencies, languages, policy pages

To try it yourself with Claude Code, connect your store as an MCP server: 

claude mcp add --transport http my-store \
    https://www.example.com/api/index.php/v1/solidshop/mcp

…then ask something like “what does my store sell under €50?”. Any MCP-capable client works the same way — the server speaks the standard Streamable HTTP transport, stateless, one JSON-RPC request per call. For a quick protocol-level check without an AI client, the official inspector works too: npx @modelcontextprotocol/inspector@latest.

For a walkthrough with a worked example — connecting a store, a full assistant conversation showing the tool calls, and why the endpoint is open by default — see How to connect your Joomla store to an AI assistant with MCP.

SEF URLs — if your server rewrites URLs, the shorter /api/v1/solidshop/… form works as well. The /api/index.php/ form works on every install, so the examples use it.

Turning it off, or requiring a token

Everything the API serves is already public on your storefront, so public access is the default and the right choice for almost every store — an AI assistant that cannot read your catalog anonymously simply moves on to a competitor’s.

If you still want to close it: System → Plugins → Web Services - Solidshop has a single Public catalog access switch. Set it to No and every catalog route — the MCP endpoint included — requires a Joomla API token; anonymous requests get a 401. Disabling the plugin removes the routes entirely.

Crawl load and rate limiting

Catalog responses are served with Cache-Control: public headers, so a reverse proxy or CDN in front of your site (LiteSpeed cache, Cloudflare, Varnish) absorbs repeat reads without touching PHP. Rate limiting is deliberately left to the server layer, where it belongs — use your host’s tools (fail2ban, LiteSpeed per-IP limits, Cloudflare rules) if an aggressive crawler ever needs reining in. The API itself does nothing a guest browsing your storefront couldn’t do.