Skip to content
littleworksdocs

Explore the documentation

Meet LittleworksA small backend for the Shopify task you and your agent are already working on.Connect your agentApprove access once, then return to the conversation where your task started.Build with an agentThe operating guide for an agent using Littleworks as part of an existing Shopify task.Write a workA JavaScript handler, a small manifest, and an immutable version each time you deploy.Store dataDocument collections with a small API, scoped automatically to the work that uses them.Call ShopifyUse Shopify’s GraphQL API directly, with credentials held by Littleworks.Expose an endpointConnect an existing frontend to a work through a small JSON API.MCP tool referenceTen tools to inspect, deploy, run, and manage the backend for a connected store.Inspect and troubleshootFind the relevant run, understand the failure, and make the next change deliberately.Limits and securityThe current runtime boundaries, data isolation model, and execution allowances.
Shopify admin
Browse documentation
Reference
Markdown

Limits and security

The current runtime boundaries, data isolation model, and execution allowances.

Execution limits

ResourceCurrent limit
Sandbox CPU time50 ms per run
Application deadline10 seconds
Data and Shopify capability calls50 per run
Bundled JavaScript source128 KiB
Input / document body16 KiB each
Result64 KiB
Documents per SDK list100
Operations per atomic batch10 distinct documents

A deadline revokes further capabilities. It does not undo effects already committed. CPU time is distinct from elapsed time while awaiting data or Shopify requests.

Store execution budgets

BudgetAll executionsPublic executions
Daily1,000800
Monthly10,0008,000

Public executions count toward both limits. The difference reserves capacity for authenticated work. Budgets are shared across Preview and Live; daily and monthly resets use UTC.

HTTP routes also have approximate, per-edge burst limits: 30 requests per visitor/store/minute, 120 per work/environment/minute, and 300 per store/minute. Failed attempts and preflight requests count. These counters are traffic protection, not exact global quotas.

Isolation and permissions

Code runs in a separate sandbox with no platform secrets or database bindings. Littleworks supplies scoped capabilities for each invocation. Storage access is constrained to the current store, feature, and environment. Shopify calls require the work’s explicit permission and the app’s approved scopes.

Works cannot make arbitrary outbound network calls. They use db and shopify.graphql for supported operations. Static portability checks flag known incompatible APIs, but do not guarantee that code will run unchanged on another provider.

Public endpoint responsibilities

Rate limits and input validation are automatic. Customer authorization is task-specific: validate a suitable proof inside the work. CORS is not authentication, and an order ID supplied by a visitor is not proof of purchase. See Expose an endpoint.

Current boundaries

  • No scheduled jobs, Shopify event subscriptions, or Flow integration.
  • No arbitrary outbound HTTP, secret injection, or file storage for works.
  • No hosted package installation or TypeScript build through MCP.
  • No HTML hosting, streaming responses, custom response headers, or cookies.
  • No theme-editing tool or theme app extension supplied by Littleworks.

Use these boundaries when deciding whether Littleworks fits a task. Read the connected server’s get_context for current capabilities before deploying.