solidus_mcp 0.2.0.rc1

data/app/controllers/solidus_mcp/registrations_controller.rb

@@ -0,0 +1,48 @@
+# frozen_string_literal: true
+
+module SolidusMcp
+  class RegistrationsController < ActionController::API
+    include HttpAccess
+
+    MAX_BODY_BYTES = 16.kilobytes
+
+    wrap_parameters false
+    before_action :prepare_registration
+    rate_limit to: 20, within: 1.hour, by: -> { "per-ip:#{request.remote_ip}" }, store: ActionController::Base.cache_store,
+      with: -> { registration_throttled }
+    rate_limit to: 200, within: 1.hour, by: -> { "global" }, store: ActionController::Base.cache_store,
+      with: -> { registration_throttled }
+
+    def create
+      return render_error("invalid_client_metadata", "Use application/json", :unsupported_media_type) unless request.media_type == "application/json"
+
+      body = request.body.read(MAX_BODY_BYTES + 1)
+      return render_error("invalid_client_metadata", "Registration metadata is too large", :payload_too_large) if body.bytesize > MAX_BODY_BYTES
+
+      render json: ClientRegistration.call(JSON.parse(body)), status: :created
+    rescue JSON::ParserError
+      render_error("invalid_client_metadata", "Expected a JSON object")
+    rescue ClientRegistration::InvalidMetadata => e
+      render_error(e.code, e.message)
+    rescue ActiveRecord::RecordInvalid
+      render_error("invalid_client_metadata", "Client metadata could not be registered")
+    end
+
+    private
+
+    def prepare_registration
+      response.set_header("Cache-Control", "no-store")
+      response.set_header("Pragma", "no-cache")
+      head :not_found unless SolidusMcp.configuration.enabled?
+    end
+
+    def registration_throttled
+      response.set_header("Retry-After", "3600")
+      render_error("temporarily_unavailable", "Too many client registrations; try again later", :too_many_requests)
+    end
+
+    def render_error(code, description, status = :bad_request)
+      render json: {error: code, error_description: description}, status: status
+    end
+  end
+end

data/app/controllers/solidus_mcp/tokens_controller.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+module SolidusMcp
+  class TokensController < Doorkeeper::TokensController
+    include HttpAccess
+    before_action :validate_resource
+
+    private
+
+    def validate_resource
+      return if action_name == "revoke"
+      expected = SolidusMcp.configuration.endpoint_url
+      return render json: {error: "invalid_target"}, status: :bad_request unless params[:resource] == expected
+      source = case params[:grant_type]
+      when "authorization_code" then Doorkeeper::AccessGrant.by_token(params[:code])
+      when "refresh_token" then Doorkeeper::AccessToken.by_refresh_token(params[:refresh_token])
+      end
+      if source && source.resource != expected
+        render json: {error: "invalid_grant"}, status: :bad_request
+      end
+    end
+  end
+end

data/app/models/solidus_mcp/administrator.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+module SolidusMcp
+  class Administrator < ActiveRecord::Base
+    self.table_name = "solidus_mcp_administrators"
+    attr_readonly :user_id
+    belongs_to :user, class_name: Spree.user_class.name
+    has_many :role_changes, class_name: "SolidusMcp::AdministratorChange", dependent: :restrict_with_exception
+
+    validates :user_id, uniqueness: true
+    validates :enabled, inclusion: {in: [true, false]}
+
+    def change!(actor:, enabled:, lock_version:)
+      transaction do
+        Administration.lock_users!(actor, user)
+        Administration.authorize_assignment!(actor, user)
+        unless [true, false].include?(enabled)
+          raise ArgumentError, "enabled must be true or false"
+        end
+        if enabled && !user.admin?
+          errors.add(:user, "must be a Solidus administrator")
+          raise ActiveRecord::RecordInvalid.new(self)
+        end
+        if new_record? != (lock_version == -1)
+          raise ActiveRecord::StaleObjectError.new(self, "update")
+        end
+        previous = persisted? ? enabled_in_database : false
+        self.lock_version = new_record? ? 0 : lock_version
+        self.enabled = enabled
+        save!
+        role_changes.create!(actor_id: actor.id, previous_enabled: previous, enabled: enabled) if previous != enabled
+      end
+    end
+  end
+end

data/app/models/solidus_mcp/administrator_change.rb

@@ -0,0 +1,8 @@
+# frozen_string_literal: true
+
+module SolidusMcp
+  class AdministratorChange < ActiveRecord::Base
+    self.table_name = "solidus_mcp_administrator_changes"
+    belongs_to :administrator, class_name: "SolidusMcp::Administrator"
+  end
+end

data/app/models/solidus_mcp/connection_policy.rb

@@ -0,0 +1,53 @@
+# frozen_string_literal: true
+
+module SolidusMcp
+  class ConnectionPolicy < ActiveRecord::Base
+    self.table_name = "solidus_mcp_connection_policies"
+    belongs_to :application, class_name: "Doorkeeper::Application"
+    belongs_to :user, class_name: Spree.user_class.name
+    has_many :policy_changes, class_name: "SolidusMcp::PolicyChange", dependent: :restrict_with_exception
+
+    validates :user_id, uniqueness: {scope: :application_id}
+    validates :enabled, inclusion: {in: [true, false]}
+    validates :application_uid, presence: true
+    validate :known_permissions
+    before_validation :retain_application_uid, on: :create
+
+    # Management writes and their audit must commit together. lock_version
+    # prevents an older form from restoring permissions another admin removed.
+    def change!(actor:, permissions:, enabled:, lock_version:, deleted_at: nil)
+      transaction do
+        Administration.lock_users!(actor, user)
+        Administration.authorize_management!(actor, owner: user)
+        # -1 identifies the unsaved default policy. Version 0 must not let a
+        # default-policy form overwrite someone else's first explicit policy.
+        if new_record? != (lock_version == -1)
+          raise ActiveRecord::StaleObjectError.new(self, "update")
+        end
+        self.lock_version = new_record? ? 0 : lock_version
+        previous = persisted? ? attributes.slice("permissions", "enabled", "deleted_at") :
+          {"permissions" => [], "enabled" => true, "deleted_at" => nil}
+        assign_attributes(permissions: permissions.uniq.sort, enabled: enabled, deleted_at: deleted_at)
+        save!
+        current = attributes.slice("permissions", "enabled", "deleted_at")
+        policy_changes.create!(actor_id: actor.id, previous_values: previous, new_values: current) if previous != current
+      end
+    end
+
+    def delete_permissions!(actor:, lock_version:)
+      Administration.authorize_management!(actor, owner: user, action: :destroy)
+      change!(actor: actor, permissions: [], enabled: false, lock_version: lock_version, deleted_at: Time.current)
+    end
+
+    private
+
+    def retain_application_uid
+      self.application_uid = application&.uid
+    end
+
+    def known_permissions
+      valid = permissions.is_a?(Array) && permissions.all? { |key| key.is_a?(String) && (SolidusMcp.registry.permissions.include?(key) || Array(permissions_in_database).include?(key)) }
+      errors.add(:permissions, "contain an unknown operation") unless valid
+    end
+  end
+end

data/app/models/solidus_mcp/credential.rb

@@ -0,0 +1,36 @@
+# frozen_string_literal: true
+
+module SolidusMcp
+  class Credential
+    SCOPES = %w[mcp:read mcp:write].freeze
+    attr_reader :token, :user
+
+    def self.authenticate(bearer)
+      return if bearer.blank?
+      token = Doorkeeper::AccessToken.by_token(bearer)
+      return unless token
+      user = Spree.user_class.find_by(id: token.resource_owner_id)
+      credential = new(token, user)
+      credential if credential.active?
+    end
+
+    def initialize(token, user)
+      @token = token
+      @user = user
+    end
+
+    def active?
+      token.reload
+      user&.reload
+      token.accessible? && token.application.present? && Administration.user?(user) &&
+        token.resource == SolidusMcp.configuration.endpoint_url &&
+        (token.scopes.to_a & SCOPES).any?
+    rescue ActiveRecord::RecordNotFound
+      false
+    end
+
+    def permits?(scope)
+      token.scopes.include?(scope)
+    end
+  end
+end

data/app/models/solidus_mcp/policy_change.rb

@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+module SolidusMcp
+  class PolicyChange < ActiveRecord::Base
+    self.table_name = "solidus_mcp_policy_changes"
+    belongs_to :connection_policy, class_name: "SolidusMcp::ConnectionPolicy"
+    belongs_to :actor, class_name: Spree.user_class.name
+  end
+end

data/app/services/solidus_mcp/client_registration.rb

@@ -0,0 +1,94 @@
+# frozen_string_literal: true
+
+module SolidusMcp
+  # RFC 7591 registration creates a client, never a grant or an access token.
+  # Doorkeeper still handles admin consent, PKCE and all token operations.
+  class ClientRegistration
+    class InvalidMetadata < StandardError
+      attr_reader :code
+
+      def initialize(message, code: "invalid_client_metadata")
+        @code = code
+        super(message)
+      end
+    end
+
+    def self.call(metadata)
+      new(metadata).call
+    end
+
+    def initialize(metadata)
+      @metadata = metadata
+    end
+
+    def call
+      invalid!("Expected a JSON object") unless @metadata.is_a?(Hash)
+      redirects = redirect_uris
+      name = @metadata.fetch("client_name", "MCP client")
+      unless name.is_a?(String) && name.strip.present? && name.length <= 128 && !name.match?(/[[:cntrl:]]/)
+        invalid!("client_name must be a nonempty string of at most 128 characters")
+      end
+      auth_method = @metadata.fetch("token_endpoint_auth_method", "client_secret_basic")
+      unless %w[none client_secret_basic client_secret_post].include?(auth_method)
+        invalid!("Unsupported token_endpoint_auth_method")
+      end
+      grants = @metadata.fetch("grant_types", ["authorization_code"])
+      unless grants.is_a?(Array) && grants.include?("authorization_code") && (grants - %w[authorization_code refresh_token]).empty?
+        invalid!("Only authorization_code and refresh_token grants are supported")
+      end
+      invalid!("Only the code response type is supported") unless @metadata.fetch("response_types", ["code"]) == ["code"]
+      application_type = @metadata["application_type"]
+      if @metadata.key?("application_type") && !%w[native web].include?(application_type)
+        invalid!("application_type must be native or web")
+      end
+      if application_type == "web" && redirects.any? { |value| URI(value).scheme != "https" }
+        invalid!("Web clients require HTTPS callbacks", code: "invalid_redirect_uri")
+      end
+      scope = @metadata.fetch("scope", Credential::SCOPES.join(" "))
+      unless scope.is_a?(String) && scope.split.present? && (scope.split - Credential::SCOPES).empty?
+        invalid!("scope must contain only supported store scopes")
+      end
+
+      # Select fields explicitly. Caller-supplied IDs, secrets and privileged
+      # model attributes are never assigned, and metadata URLs are never fetched.
+      client = Doorkeeper::Application.create!(name: name.strip, redirect_uri: redirects,
+        confidential: auth_method != "none", scopes: scope.split.uniq.join(" "))
+      result = {client_id: client.uid, client_id_issued_at: client.created_at.to_i,
+                client_name: client.name, redirect_uris: redirects,
+                token_endpoint_auth_method: auth_method, grant_types: grants.uniq,
+                response_types: ["code"], scope: client.scopes.to_s}
+      result[:application_type] = application_type if application_type
+      if client.confidential?
+        result[:client_secret] = client.plaintext_secret
+        result[:client_secret_expires_at] = 0
+      end
+      result
+    end
+
+    private
+
+    def redirect_uris
+      values = @metadata["redirect_uris"]
+      unless values.is_a?(Array) && values.length.between?(1, 10) && values.all? { |value| valid_redirect?(value) }
+        invalid!("Provide 1 to 10 HTTPS or literal loopback HTTP callback URLs without credentials, fragments or wildcards",
+          code: "invalid_redirect_uri")
+      end
+      values.uniq
+    end
+
+    def valid_redirect?(value)
+      return false unless value.is_a?(String) && value.bytesize.between?(1, 2048)
+      return false if value.match?(/[[:space:][:cntrl:]*\\]/)
+
+      uri = URI.parse(value)
+      uri.host.present? && uri.userinfo.nil? && uri.fragment.nil? &&
+        (uri.scheme == "https" || (uri.scheme == "http" && %w[127.0.0.1 ::1].include?(uri.hostname)))
+    rescue URI::InvalidURIError
+      false
+    end
+
+    def invalid!(message, code: "invalid_client_metadata")
+      raise InvalidMetadata.new(message, code: code)
+    end
+  end
+end

data/app/services/solidus_mcp/price_update.rb

@@ -0,0 +1,42 @@
+# frozen_string_literal: true
+
+module SolidusMcp
+  # Shared only by the two pricing tools. Updates an exact existing context;
+  # it never guesses a price, creates a row, or bypasses Solidus validations.
+  class PriceUpdate
+    def initialize(policy)
+      @policy = policy
+    end
+
+    def call(variant_id:, currency:, country_iso:, amount:)
+      valid_context = currency.match?(/\A[A-Z]{3}\z/) && (country_iso.nil? || country_iso.match?(/\A[A-Z]{2}\z/))
+      raise ToolError, "Invalid currency or country context" unless valid_context
+      unless amount.is_a?(String) && amount.match?(/\A(?:0|[1-9]\d{0,7})(?:\.\d{1,2})?\z/)
+        raise ToolError, "Amount must be a nonnegative decimal string with at most two decimal places"
+      end
+      unless Spree::Config.pricing_options_class == Spree::Variant::PricingOptions
+        raise ToolError, "Custom pricing options require a store-specific pricing tool"
+      end
+      variant = @policy.scope(Spree::Variant, :update)
+        .where(product_id: @policy.scope(Spree::Product, :update).select(:id)).find(variant_id)
+      prices = @policy.scope(Spree::Price, :update).where(variant_id: variant.id,
+        currency: currency, country_iso: country_iso).limit(2).to_a
+      raise ToolError, "Price context is unavailable or ambiguous" unless prices.one?
+      price = prices.first
+      price.with_lock do
+        yield
+        @policy.authorize_record!(:update, variant.product)
+        @policy.authorize_record!(:update, variant)
+        @policy.authorize_record!(:update, price)
+        unless price.variant_id == variant_id && price.currency == currency && price.country_iso == country_iso
+          raise ToolError, "Price context changed; retrieve prices again"
+        end
+        price.assign_attributes(amount: BigDecimal(amount))
+        @policy.authorize_record!(:update, price)
+        price.save!
+      end
+      {price_id: price.id, variant_id: variant.id, currency: price.currency,
+       country_iso: price.country_iso, amount: price.amount.to_s("F")}
+    end
+  end
+end

data/app/services/solidus_mcp/serializers.rb

@@ -0,0 +1,49 @@
+# frozen_string_literal: true
+
+module SolidusMcp
+  # Fixed public representations. Related records are checked separately.
+  class Serializers
+    def initialize(policy)
+      @policy = policy
+    end
+
+    def product(record)
+      @policy.authorize_record!(:read, record)
+      record.attributes.slice("id", "name", "slug", "description", "meta_title", "meta_description", "meta_keywords")
+    end
+
+    def variant(record)
+      @policy.authorize_record!(:read, record.product)
+      @policy.authorize_record!(:read, record)
+      record.attributes.slice("id", "product_id", "sku", "is_master")
+    end
+
+    def price(record)
+      variant(record.variant)
+      @policy.authorize_record!(:read, record)
+      {id: record.id, variant_id: record.variant_id, currency: record.currency,
+       country_iso: record.country_iso, amount: record.amount&.to_s("F")}
+    end
+
+    def inventory(record)
+      variant(record.variant)
+      @policy.authorize_record!(:read, record.stock_location)
+      @policy.authorize_record!(:read, record)
+      {id: record.id, variant_id: record.variant_id, sku: record.variant.sku,
+       stock_location_id: record.stock_location_id, count_on_hand: record.count_on_hand,
+       backorderable: record.backorderable}
+    end
+
+    def order(record)
+      @policy.authorize_record!(:read, record)
+      status(record).merge(currency: record.currency, total: record.total.to_s("F"),
+        item_total: record.item_total.to_s("F"), completed_at: record.completed_at&.iso8601)
+    end
+
+    def status(record)
+      @policy.authorize_record!(:read, record)
+      {id: record.id, number: record.number, state: record.state,
+       payment_state: record.payment_state, shipment_state: record.shipment_state}
+    end
+  end
+end

data/app/tools/solidus_mcp/tools/base.rb

@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+module SolidusMcp
+  module Tools
+    class Base < Tool
+      class << self
+        def pagination
+          input :after_id, type: "integer", minimum: 0
+          input :limit, type: "integer", minimum: 1, maximum: 100
+        end
+      end
+
+      protected
+
+      def serializers
+        @serializers ||= Serializers.new(policy)
+      end
+
+      def page(relation, after_id:, limit:)
+        table = relation.klass.arel_table
+        records = relation.where(table[:id].gt(after_id)).reorder(table[:id].asc).limit(limit + 1).to_a
+        more = records.length > limit
+        records = records.first(limit)
+        {items: records.map { |record| yield record }, next_after_id: more ? records.last.id : nil}
+      end
+
+      def variants
+        policy.scope(Spree::Variant).where(product_id: policy.scope(Spree::Product).select(:id))
+      end
+
+      def stock_items
+        policy.scope(Spree::StockItem).where(variant_id: variants.select(:id),
+          stock_location_id: policy.scope(Spree::StockLocation).select(:id))
+      end
+    end
+  end
+end

data/app/tools/solidus_mcp/tools/bulk_update_variant_prices.rb

@@ -0,0 +1,48 @@
+# frozen_string_literal: true
+
+module SolidusMcp
+  module Tools
+    class BulkUpdateVariantPrices < Base
+      tool_name :bulk_update_variant_prices
+      description "Update up to 100 SKU prices independently. Each entry specifies amount, currency and country_iso (null for general-country pricing). Returns a result for every entry."
+      category "Pricing"
+      permission "bulk_update_variant_prices"
+      read_only false
+      ability :update, "Spree::Product"
+      ability :update, "Spree::Variant"
+      ability :update, "Spree::Price"
+      input :entries, type: "array", minItems: 1, maxItems: 100, required: true,
+        items: {type: "object", additionalProperties: false,
+                required: %w[sku amount currency country_iso],
+                properties: {sku: {type: "string", minLength: 1, maxLength: 255},
+                             amount: {type: "string"}, currency: {type: "string"},
+                             country_iso: {type: ["string", "null"]}}}
+
+      protected
+
+      def call(entries:)
+        entries = entries.map(&:stringify_keys)
+        keys = entries.map { |entry| entry.values_at("sku", "currency", "country_iso") }
+        duplicates = keys.tally.select { |_, count| count > 1 }.keys
+        results = entries.each_with_index.map do |entry, index|
+          authorize!
+          raise ToolError, "Duplicate pricing target" if duplicates.include?(keys[index])
+          candidates = policy.scope(Spree::Variant, :update).where(sku: entry.fetch("sku")).limit(2).to_a
+          raise ToolError, "SKU is unavailable or ambiguous" unless candidates.one?
+          result = PriceUpdate.new(policy).call(variant_id: candidates.first.id,
+            **entry.except("sku").symbolize_keys) { authorize! }
+          {index: index, sku: entry["sku"], success: true, price: result}
+        rescue AccessDenied, ToolError => e
+          {index: index, sku: entry["sku"], success: false, error: e.message}
+        rescue ActiveRecord::RecordNotUnique, ActiveRecord::Deadlocked, ActiveRecord::LockWaitTimeout
+          {index: index, sku: entry["sku"], success: false, error: "Concurrent price change; retry this entry"}
+        rescue ActiveRecord::RecordNotFound
+          {index: index, sku: entry["sku"], success: false, error: "Price is unavailable"}
+        rescue ActiveRecord::RecordInvalid => e
+          {index: index, sku: entry["sku"], success: false, error: e.record.errors.full_messages.to_sentence}
+        end
+        {results: results}
+      end
+    end
+  end
+end

data/app/tools/solidus_mcp/tools/create_product.rb

@@ -0,0 +1,42 @@
+# frozen_string_literal: true
+
+module SolidusMcp
+  module Tools
+    class CreateProduct < Base
+      tool_name :create_product
+      description "Create a draft product."
+      category "Products"
+      permission "create_product"
+      read_only false
+      ability :create, "Spree::Product"
+      input :name, type: "string", minLength: 1, maxLength: 255, required: true
+      input :price, type: "number", minimum: 0, required: true
+      input :shipping_category_id, type: "integer", minimum: 1
+
+      protected
+
+      def call(name:, price:, shipping_category_id: nil)
+        default_shipping_category_id = SolidusMcp.configuration.default_shipping_category_id
+        specified_shipping_category_id = shipping_category_id || default_shipping_category_id
+
+        if specified_shipping_category_id.nil?
+          raise SolidusMcp::ToolError, "Provide shipping_category_id. No default shipping category is configured."
+        elsif Spree::ShippingCategory.find_by(id: specified_shipping_category_id).nil?
+          raise SolidusMcp::ToolError, "The provided shipping category ID could not be found."
+        end
+
+        product = Spree::Product.new(
+          name: name,
+          price: price,
+          shipping_category_id: specified_shipping_category_id
+        )
+
+        authorize!
+        policy.authorize_record!(:create, product)
+        product.save!
+
+        {product_id: product.id, created: true}
+      end
+    end
+  end
+end

data/app/tools/solidus_mcp/tools/get_inventory_levels.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+module SolidusMcp
+  module Tools
+    class GetInventoryLevels < Base
+      tool_name :get_inventory_levels
+      description "Read stock counts and backorderability by location for one variant. Does not reserve or adjust stock."
+      category "Inventory"
+      permission "get_inventory_levels"
+      read_only true
+      ability :read, "Spree::Product"
+      ability :read, "Spree::Variant"
+      ability :read, "Spree::StockItem"
+      ability :read, "Spree::StockLocation"
+      input :variant_id, type: "integer", minimum: 1, required: true
+      pagination
+
+      protected
+
+      def call(variant_id:, after_id: 0, limit: 25)
+        serializers.variant(variants.find(variant_id))
+        page(stock_items.where(variant_id: variant_id), after_id: after_id, limit: limit) { |item| serializers.inventory(item) }
+      end
+    end
+  end
+end

data/app/tools/solidus_mcp/tools/get_order.rb

@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+module SolidusMcp
+  module Tools
+    class GetOrder < Base
+      tool_name :get_order
+      description "Retrieve order totals, status and up to 100 authorized line items. Includes a truncation indicator."
+      category "Orders"
+      permission "get_order"
+      read_only true
+      ability :read, "Spree::Order"
+      ability :read, "Spree::LineItem"
+      input :order_id, type: "integer", minimum: 1, required: true
+
+      protected
+
+      def call(order_id:)
+        order = policy.scope(Spree::Order).find(order_id)
+        data = serializers.order(order)
+        data[:line_items] = policy.scope(Spree::LineItem).where(order_id: order.id).order(:id).limit(100).map do |item|
+          policy.authorize_record!(:read, item)
+          {id: item.id, variant_id: item.variant_id, quantity: item.quantity, price: item.price.to_s("F")}
+        end
+        data[:line_items_truncated] = policy.scope(Spree::LineItem).where(order_id: order.id).count > 100
+        data
+      end
+    end
+  end
+end

data/app/tools/solidus_mcp/tools/get_order_status.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+module SolidusMcp
+  module Tools
+    class GetOrderStatus < Base
+      tool_name :get_order_status
+      description "Retrieve the order, payment and shipment states for an order ID."
+      category "Orders"
+      permission "get_order_status"
+      read_only true
+      ability :read, "Spree::Order"
+      input :order_id, type: "integer", minimum: 1, required: true
+
+      protected
+
+      def call(order_id:)
+        serializers.status(policy.scope(Spree::Order).find(order_id))
+      end
+    end
+  end
+end

data/app/tools/solidus_mcp/tools/get_product.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+module SolidusMcp
+  module Tools
+    class GetProduct < Base
+      tool_name :get_product
+      description "Retrieve product descriptions and supported product attributes by ID."
+      category "Products"
+      permission "get_product"
+      read_only true
+      ability :read, "Spree::Product"
+      input :product_id, type: "integer", minimum: 1, required: true
+
+      protected
+
+      def call(product_id:)
+        serializers.product(policy.scope(Spree::Product).find(product_id))
+      end
+    end
+  end
+end

data/app/tools/solidus_mcp/tools/get_product_variants.rb

@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+module SolidusMcp
+  module Tools
+    class GetProductVariants < Base
+      tool_name :get_product_variants
+      description "List authorized product variants, including the master variant, with IDs and SKUs."
+      category "Products"
+      permission "get_product_variants"
+      read_only true
+      ability :read, "Spree::Product"
+      ability :read, "Spree::Variant"
+      input :product_id, type: "integer", minimum: 1, required: true
+      pagination
+
+      protected
+
+      def call(product_id:, after_id: 0, limit: 25)
+        policy.authorize_record!(:read, policy.scope(Spree::Product).find(product_id))
+        page(variants.where(product_id: product_id), after_id: after_id, limit: limit) { |variant| serializers.variant(variant) }
+      end
+    end
+  end
+end