From 8ea9d7073fdcc19f90533cf69027b7a92e3ca769 Mon Sep 17 00:00:00 2001
From: armorer-labs <armorer-labs@users.noreply.github.com>
Date: Tue, 19 May 2026 14:23:20 +0800
Subject: [PATCH] Document Armorer Guard MCP proxy

---
 README.md | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)

diff --git a/README.md b/README.md
index 36c461a3..a2bd0cd5 100644
--- a/README.md
+++ b/README.md
@@ -77,6 +77,36 @@ If you have an existing custom app with a static `shpat_` access token, you can
 }
 ```
 
+**Optional local guardrail:**
+
+To inspect tool-call arguments locally before they reach the Shopify MCP server,
+wrap the command with [Armorer Guard](https://github.com/ArmorerLabs/Armorer-Guard):
+
+```json
+{
+  "mcpServers": {
+    "shopify": {
+      "command": "armorer-guard",
+      "args": [
+        "mcp-proxy",
+        "--",
+        "npx",
+        "shopify-mcp",
+        "--clientId",
+        "<YOUR_CLIENT_ID>",
+        "--clientSecret",
+        "<YOUR_CLIENT_SECRET>",
+        "--domain",
+        "<YOUR_SHOP>.myshopify.com"
+      ]
+    }
+  }
+}
+```
+
+Armorer Guard runs locally and forwards safe MCP calls unchanged while blocking
+prompt injection, credential leakage, exfiltration risk, and dangerous actions.
+
 **Static Access Token (legacy):**
 
 ```json