Operator-facing MCP Extension

[jarednorman]

This would be a totally optional extension called solidus_mcp that exposes store operations (inventory, products, possible some order operations) as MCP tools. This would allow operators to manage their store from an AI agent of their choice, natively allowing stores to choose existing providers or run their own models.

Notes

• This must be a separate extension. It brings with it security and data-privacy considerations that not all stores may be equipped to handle.
• The supported functionality will be hand-curated tools that call Solidus code directly, not a proxy over the REST API.
• We'll use the mcp gem for forwards-compatibility.
• The agent will act on the behalf of the authenticated user and all operations must go through established authorization checks.
• Authentication is an open question. Using API keys opens up agents to using the whole API, which we don't necessarily want.
• Write-safety is extremely important. Write operation should be disabled by default.
• When write tools are enabled, we likely want a two-phased approach or some other user approval mechanism, to be decided. (Shopify Sidekick, or example, requires user approval to call out to tools supported by apps. We may want to emulate that.)
• We may want an audit log of some kind, which raises the question of whether that would be useful more broadly on Solidus stores.

[jarednorman]

@sofiabesenski4 @Noah-Silvera This isn't set in stone, just a first pass of what I was imagining here.