This documentation always describes the latest published version.
| Aspect | Behavior |
|---|---|
| Storage location | Plain text in the .env file of the environment: ~/.claude-plugin-syliusadmin/<stage or prod>/.env. The plugin directory itself contains no credentials. |
| Transmission | Email and password go only to <SYLIUS_BASE_URL>/api/v2/admin/administrators/token. Use an https:// URL; the server does not enforce this. |
| Token | The JWT lives only in the memory of the server process. It is renewed 30 seconds before expiry; if the token has no expiry, 300 seconds apply. It is never written to disk. |
| Stage key | SYLIUS_API_KEY is sent as the X-Stage-Api-Key header on every request, including login. |
| Setup skill | Never fills in credentials for you. |
Protect the .env files with file permissions, keep them out of any repository and do not pass them on.
The server writes no log of its own and does not output credentials. The configuration class hides password and API key in its text representation so they do not appear in error output either. An error from the Sylius API is returned to Claude as a message and contains method, path, environment and at most the first 500 characters of Sylius' response.
| Data | Destination |
|---|---|
| Tool calls and results (product texts, prices, codes) | Part of the conversation with Claude and therefore sent to Anthropic. |
| Requests to the Admin API | To the configured SYLIUS_BASE_URL only, nowhere else. |
| Uploaded image files | The bytes go to the shop, not into the conversation. |
| Credentials | Only to the shop (login), never to Claude. |
The server contains no telemetry and no other external calls.
All tool parameters are treated as untrusted because a language model supplies them.
| Safeguard | Effect |
|---|---|
| Path allowlist | Every request is checked against a fixed list of permitted resources before it is sent. Allowed are products, variants, categories, attributes, options, zones, countries, shipping methods, shipping categories, tax categories and marketplace links; channels and input field definitions read-only; plus the login endpoint. Everything else (orders, customers, promotions, admin users) fails with SyliusScopeError. |
| Path checks | Paths containing .., //, ?, # or % are rejected. Codes may only contain letters, digits, underscore and hyphen. |
| Delete protection | DELETE is only allowed for marketplace links; the client rejects it for every other resource. |
| Method override | Form fields starting with _method are rejected so a POST cannot turn into a DELETE. |
| Image upload | See below. |
| Environment cross-check | If SYLIUS_ENV_NAME does not match SYLIUS_ENVIRONMENT in the file, the server does not start. |
| Activation guard | A product without a variant is not activated. |
In the Community Edition the Sylius admin user itself always has full access. The allowlist is the only boundary of the server, not a permission in Sylius. Anyone who can read the
.envfile can log in to the Admin API directly with the same rights.
A file path arrives as a tool parameter from the language model and could be slipped in by manipulated content (for example in an ingested product description). Without restriction that would allow reading any local file and publishing it publicly in the shop. Therefore:
SYLIUS_IMAGE_UPLOAD_BASE_DIR, file upload is disabled completely..jpg, .jpeg, .png, .gif, .webp up to 10,000,000 bytes..env file was passed on by accident.