[BUG] Shopify claude.ai connector returns 403 on all tool calls (including public search_docs_chunks)

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

The Shopify MCP connector (added via claude.ai connector UI) shows ✓ Connected, but every tool call returns HTTP 403 — including search_docs_chunks, which is a public, unauthenticated tool that does not require any Shopify token.

What Should Happen?

Tool calls to the connected Shopify MCP should succeed and return tool output. For public tools like search_docs_chunks (no auth required), the call must not be rejected with 403.

Error Messages/Logs

Steps to Reproduce

1. Add Shopify connector via claude.ai connector UI; complete OAuth — UI shows ✓ Connected.
2. In a Claude Code session, call any Shopify MCP tool, e.g. search_docs_chunks with query "products".
3. Tool returns HTTP 403.
4. Tried: disconnect/reconnect (re-OAuth), uninstall/reinstall connector, restart Claude Code, change Tool permissions to Always allow — all failed.
5. Verified: a local stdio Shopify MCP (shopify-mcp via npx with the same shop) works correctly — confirming the issue is specific to the claude.ai-hosted connector path.

Claude Model

Opus

Is this a regression?

Yes, this worked in a previous version

Last Working Version

_No response_

Claude Code Version

1.9255.0

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

PowerShell

Additional Information

Likely related to:

• #18194 (Cowork mode: MCP connectors return 403)
• #55914 (claude.ai connectors show Connected but expose zero tools)
• anthropic-sdk-python#1257 (host_not_allowed 403 from claude.ai egress)

The 403 hitting search_docs_chunks (a public tool that needs no Shopify token) rules out token/scope issues on the Shopify side and points to the claude.ai → MCP gateway path.