Documentation

MCP for WooCommerce

MCP for WooCommerce by w7s connects Claude, ChatGPT, and other AI assistants to your WooCommerce store so they can work with your orders, products, customers, and more in plain language. It turns on the built-in WooCommerce Model Context Protocol (MCP) features, gives you a settings screen to manage the connection and your API keys, and lets you choose exactly which groups of tools the AI client is allowed to use. This guide covers what you need, how to set it up, what every setting does, and how developers can extend it.

Overview

↑ Back to top

MCP for WooCommerce configures and extends the WooCommerce MCP integration. MCP is the standard that lets an AI assistant call tools on your site, and WooCommerce ships an MCP endpoint at /wp-json/woocommerce/mcp. This plugin enables that endpoint on activation and adds the pieces a store needs to use it in practice.

It does three main things:

It provides a new settings area under WooCommerce > Settings > MCP for connecting an assistant, creating API keys, and reviewing activity;
It registers a large set of MCP abilities so an assistant can list and manage orders, products, customers, coupons, refunds, tax, shipping, webhooks, reports, and more; and
It lets you switch whole groups of tools (called tool packs) on or off, so an assistant only ever sees the capabilities you have chosen to expose.

The plugin does not replace the WooCommerce MCP endpoint. It enables it, then layers on smaller tools/list responses for faster client setup, per-request size caps so remote clients do not time out, optional activity logging, and API key permission enforcement on every call.

Requirements

↑ Back to top

MCP for WooCommerce needs the following to run:

WordPress 5.8 or higher.
WooCommerce 9.0 or higher. WooCommerce is a hard dependency. The plugin declares Requires Plugins: woocommerce and will prompt you if WooCommerce is missing.
PHP 7.4 or higher.
MySQL 5.6 or higher, or the MariaDB equivalent.
An AI assistant that understands MCP, such as Claude Desktop or ChatGPT, or any other MCP or OpenAPI 3.1 client (Cursor, Cline, n8n, Ollama, and more).
A paid ChatGPT plan that allows custom GPTs, or a paid Claude plan (Pro, Max, Team, or Enterprise) that supports custom connectors.
For the one-click Claude Desktop setup: Claude Desktop 0.13.37 or newer.

The Claude connection holds an open link to your site for the length of a session, up to about an hour, which uses a PHP worker for that time. On constrained shared hosting, keep that in mind when sizing PHP workers.

Developer note: MCP for WooCommerce enables WooCommerce MCP automatically when you activate it. If WooCommerce MCP is ever turned off, the plugin shows a notice with a link to switch it back on.

Installation

↑ Back to top

To start using a product from WooCommerce.com, you can use the “Add to store” functionality on the order confirmation page or the My subscriptions section in your account.

Navigate to My subscriptions.
Find the Add to store button next to the product you’re planning to install.
Follow the instructions on the screen, and the product will be automatically added to your store.

Alternative options and more information at: Managing WooCommerce.com subscriptions.

Setup and configuration

↑ Back to top

All settings live under WooCommerce > Settings > MCP, on a page headed MCP Settings, organized into tabs: Connection, Tool Packs, Add tools, Store Control, Logs, and — on WordPress 6.9 or higher — Abilities. The plugin uses its own Save controls inside each tab, so the standard WooCommerce Save changes button is hidden here. When the MCP connector is disabled, only the Connection tab is shown. The sections below follow the tabs in the order you will use them.

Connection settings

↑ Back to top

The Connection tab is where you link an assistant to your store and manage the credentials it uses. It walks you through the setup as numbered steps:

Select your environment (local sites only) — choose between a public website (accessible on the internet) and a local website (on your computer). On a public site this step is skipped.
Select your AI assistant — choose Claude (Recommended), ChatGPT (Limited functionality), or Other AI service.
Create an API key — give the key a name, pick its permission (Read, Write, or Read/Write), and create it. The consumer key and secret are shown once, so save them straight away.
Connect — follow the instructions for the assistant you chose. The exact steps for each assistant are covered in Connecting an assistant below.

Beyond the setup steps, the tab contains:

Enable connector. The master switch for the whole integration. When it is off, no tools and no keys are exposed to any assistant, and the other settings tabs are hidden.

Verify site readiness. A one-click check that confirms the basics — the endpoint, the WooCommerce MCP feature, and your site’s reachability — before you connect.

API keys. Create and manage the WooCommerce REST API keys an assistant uses, in the Manage API Keys list. The key is sent as the X-MCP-API-Key header on MCP requests. The key’s own permission controls what the assistant can do: a read key can only run read operations like search, list, and get, while write or read/write keys can also create, update, and delete. The user attached to the key must also have the manage_woocommerce capability. Create the most limited key that still does the job. Revoking a key from this list immediately cuts off any assistant that was using it — this is also how you disconnect an assistant.

Recent AI activity. A short list of the last few actions AI assistants have taken on your store, with the tool, result, client, and user behind each one. It appears once there is activity to show and links through to the full log.

Action logging. Optionally record MCP tool calls, with a retention period you choose. Logging is on by default with a 7-day retention, after which entries are deleted automatically. See the Logs tab to read what gets recorded.

Developer note: The remote connector for Claude and ChatGPT has to replay your API key to the site on every request, so this one credential is stored in your database. It is encrypted at rest using a key derived from your site’s WordPress salts, which live in wp-config.php rather than the database, so a database backup alone does not expose a usable key. Treat it as a live credential. To revoke it, delete the API key that backs the connector from the Manage API Keys list — that clears the stored token and credential. Deactivating the plugin also clears it.

Connecting an assistant

↑ Back to top

This section walks you from a fresh install to a working connection. Which steps you follow depends on two things: the assistant you are connecting (Claude, ChatGPT, or another AI service), and where your store runs (a public website on the internet, or a local site on your own computer). Read the prerequisites first, then jump to the section that matches your setup:

Connect the Claude Desktop app to a public site
Connect the Claude Desktop app to a local site
Connect Claude.ai in the browser to a public site
Connect ChatGPT to a public site
Connect ChatGPT to a local site
Connect another AI service

All of these start the same way. Go to WooCommerce > Settings > MCP > Connection, pick your environment (on a local site) and assistant, and create an API key. The key is shown once and is the credential the assistant uses. Create the most limited key that does the job: a read key for reporting, a write or read/write key only when the assistant needs to make changes.

Before you start

↑ Back to top

A few things need to be true before a connection will work. Most failed setups trace back to one of these.

For a public website (your live store on the internet):

The site must be reachable over HTTPS with a valid, trusted SSL certificate. A self-signed or expired certificate will fail.
Your host, firewall, or CDN must allow long-lived connections. The Claude and ChatGPT stream connections (Server-Sent Events, or SSE) hold an open link to your site for the length of a session, up to about an hour, and some CDNs cut these off early.
You may need a paid plan on the assistant’s side, such as ChatGPT with custom GPTs or a Claude plan that supports custom connectors (Pro, Max, Team, or Enterprise).

For a local website (running on your own computer, for example in a tool like Local, MAMP, or Docker):

Connecting locally is more involved and is aimed at developers comfortable with a terminal, with editing configuration files, and with a tunneling tool such as ngrok.
On a local site, the Connection tab starts with an environment picker. Choose Local website (on your computer) in Step 1 and the instructions adapt to the local setup, including the extra certificate settings.
Claude Desktop can talk to a local site directly through a bridge, with one extra setting for the local SSL certificates. See Connect the Claude Desktop app to a local site below.
Anything hosted by the assistant’s own servers, which includes the Claude.ai browser connector and ChatGPT, cannot reach localhost. You have to expose the local site through a tunnel first. See the local ChatGPT steps below.

Developer note: When setting up Claude Desktop manually (rather than with the one-click bundle), the bridge needs Node.js 22 or newer. If the assistant shows the server as failed or no tools appear, this is almost always the cause. The fix is discussed in the manual setup steps below.

How the connection works

↑ Back to top

It helps to know what the pieces are before you wire them together.

The MCP endpoint is the address an assistant connects to. WooCommerce exposes it at /wp-json/woocommerce/mcp. This is the value a bridge needs as its WP_API_URL. Pass the full endpoint, not just your site root. Passing only the root returns a 404 rest_no_route error.

The API key authenticates each request. It is a WooCommerce REST API key in the form consumer_key:consumer_secret, sent in the X-MCP-API-Key header. The key’s permission scope is enforced on every call, so a read key cannot write no matter how a request is phrased. The user attached to the key also needs the manage_woocommerce capability.

From there, clients connect in one of three shapes:

A local bridge. Claude Desktop runs a small helper on your machine that speaks to your store and presents the tools to the app. With the one-click bundle, the bridge ships inside the bundle; with the manual setup, it is the @automattic/mcp-wordpress-remote package. Either way, the key stays on your machine and is never stored on the site.
A remote stream. The Claude.ai browser connector and other hosted clients connect to your site over SSE. Because some of these clients cannot send a custom header, the plugin gives them a connector URL with a revocable token in it instead of the raw key. That one credential is stored on the site, encrypted at rest.
A direct MCP or OpenAPI client. Tools such as Cursor, Cline, n8n, or your own integration talk to the MCP endpoint directly with the X-MCP-API-Key header, or import the OpenAPI 3.1 schema. See Connect another AI service.

Connect the Claude Desktop app to a public site

↑ Back to top

This is the most common setup, and in most cases it is now one click. The Connection tab’s Claude instructions are split into two tabs — Claude Desktop app and Claude.ai (web browser) — so pick the Claude Desktop app tab for these steps.

One-click setup (recommended):

In WooCommerce > Settings > MCP > Connection, choose Claude and create an API key.
On the Claude Desktop app tab, select Download Claude Desktop bundle (.mcpb). The bundle is built with this store’s endpoint and your new key already filled in.
Double-click the downloaded .mcpb file. Claude Desktop opens and registers the store automatically — there is no configuration file to edit. This needs Claude Desktop 0.13.37 or newer.
Back on the Connection tab, use the verify control to confirm the connection is live.

The bundle contains your API key, so treat the file like a credential. If the file is ever shared, revoke that key from the Manage API Keys list and download a fresh bundle with a new key.

Manual setup:

If you prefer to configure Claude Desktop by hand, or the one-click bundle is not available on your server, select Set up manually instead on the same tab. The manual setup runs a bridge on your computer using the @automattic/mcp-wordpress-remote package.

Select Copy Claude Desktop Config. This builds a ready-to-paste block with your endpoint and key already filled in.
Open the Claude Desktop configuration file, claude_desktop_config.json, and merge the block into its mcpServers section. See Find the Claude Desktop configuration file below if you are not sure where it is. The block looks similar to this:

{
  "mcpServers": {
    "woocommerce-mcp": {
      "command": "npx",
      "args": ["-y", "@automattic/mcp-wordpress-remote"],
      "env": {
        "WP_API_URL": "https://yourstore.com/wp-json/woocommerce/mcp",
        "CUSTOM_HEADERS": "{\"X-MCP-API-Key\": \"ck_yourkey:cs_yoursecret\"}"
      }
    }
  }
}

Save the file, then fully quit and reopen Claude Desktop. A restart is required for it to pick up the change.
Back on the Connection tab, use the verify control to confirm the connection is live.

If the server shows as failed or no tools appear, Claude is using a Node.js version older than 22. In a terminal, run nvm use 22, then nvm which npx to print the full path to Node 22’s npx. Put that full path in the command field instead of npx, for example /Users/you/.nvm/versions/node/v22.22.0/bin/npx, then restart Claude Desktop.

Find the Claude Desktop configuration file

↑ Back to top

The manual setup above asks you to edit claude_desktop_config.json. The easiest way to open it is from inside Claude Desktop, which also creates the file the first time if it does not exist yet.

Open Claude Desktop.
Go to Settings, then the Developer section.
Select Edit Config. This opens claude_desktop_config.json in your default text editor.

If the file is new, it may be empty or contain only {}. Add the mcpServers block inside the top-level braces. If mcpServers already exists with other servers in it, add woocommerce-mcp alongside them rather than replacing the whole section.

If you would rather open the file directly, it lives here:

macOS: ~/Library/Application Support/Claude/claude_desktop_config.json. The Library folder is hidden in Finder. Use Go, then Go to Folder (Shift+Cmd+G), and paste the path.
Windows: %APPDATA%\Claude\claude_desktop_config.json. Paste that into the File Explorer address bar or the Run dialog (Win+R).
Linux: ~/.config/Claude/claude_desktop_config.json.

After saving, fully quit and reopen Claude Desktop. It only reads the configuration at startup, so a running app will not pick up your changes. A missing comma or bracket will silently disable every server in the file, so check the JSON is valid if nothing loads.

Connect the Claude Desktop app to a local site

↑ Back to top

Pick Local website (on your computer) in Step 1 of the Connection tab, and the Claude Desktop instructions adapt to the local environment. A local site usually serves over a self-signed certificate that will be rejected by default, so there is one extra step on the WordPress side. Add this to your site using the Code Snippets plugin:

add_filter( 'woocommerce_mcp_allow_insecure_transport', '__return_true' );

From there, the one-click setup works as it does on a public site: download the bundle from the Claude Desktop app tab and double-click it. When the local environment is selected, the bundle is built to accept the local certificate for you.

If you set up manually instead, follow the manual steps from the public-site section above and add NODE_TLS_REJECT_UNAUTHORIZED to the env block so the bridge accepts the local certificate. The claude_desktop_config.json file should contain the following:

{
  "mcpServers": {
    "woocommerce-mcp": {
      "command": "npx",
      "args": ["-y", "@automattic/mcp-wordpress-remote"],
      "env": {
        "WP_API_URL": "https://yourstore.local/wp-json/woocommerce/mcp",
        "CUSTOM_HEADERS": "{\"X-MCP-API-Key\": \"ck_yourkey:cs_yoursecret\"}",
        "NODE_TLS_REJECT_UNAUTHORIZED": "0"
      }
    }
  }
}

Save, restart Claude Desktop, and verify. The Connection tab generates this local variant for you when you pick the local environment, including the Node 22 reminder.

Developer note: Only use the insecure transport filter and NODE_TLS_REJECT_UNAUTHORIZED on a local development site. Never set them on a public store. They tell the connection to skip certificate checks, which is unsafe over the open internet.

Connect Claude.ai in the browser to a public site

↑ Back to top

If you use Claude in your web browser at claude.ai rather than the desktop app, Claude connects to your store as a custom connector over SSE. There is nothing to install, but it needs a paid Claude plan (Pro, Max, Team, or Enterprise) that supports custom connectors, and it works for public sites only, because Claude’s servers cannot reach a local address.

Claude’s remote connectors cannot send a custom header, so this method uses a connector URL with a revocable token rather than the X-MCP-API-Key header.

In WooCommerce > Settings > MCP > Connection, choose Claude, create an API key, and open the Claude.ai (web browser) tab. The tab shows the connector name and a generated connector URL, each with a copy button. The URL ends in /wp-json/w7s-mcp/v1/claude/sse with a token attached.
In Claude, go to Settings > Connectors and add a custom connector.
Paste the connector name (woocommerce-mcp) into the name field and the connector URL into the URL field. Leave the OAuth fields blank.
Save the connector and enable it in a chat.

The token in the URL is revocable and separate from your raw API key. To revoke access later — or if the token is ever exposed — delete the key that backs the connector from the Manage API Keys list on the Connection tab. That turns off the connector and clears the stored credential. To reconnect, create a new key and add the fresh connector URL in Claude.

Connect ChatGPT to a public site

↑ Back to top

ChatGPT connects through an OpenAPI schema that it imports from a URL. Note that ChatGPT can use at most 30 tools, so the plugin exposes the top 30 enabled tools; you can manage which tools are enabled on the Tool Packs tab.

On the Connection tab, select the public environment and choose ChatGPT. The tab shows the ChatGPT setup steps and an import URL.
The import URL ends in /wp-json/w7s-mcp/v1/chatgpt/openapi.json and carries a short-lived, revocable token in the query string. ChatGPT does not send the custom header when it fetches the schema, which is why the token is in the URL. In ChatGPT, create a GPT, add an action, use Import from URL, and paste it in.
For the authentication header, set the custom header name to X-MCP-API-Key and the key value to your consumer_key:consumer_secret. The Connection tab has copy buttons for both.

Because the import URL uses a token rather than your key, you can rotate it from the Connection tab without disturbing a Claude connection that uses the same store.

Connect ChatGPT to a local site

↑ Back to top

ChatGPT cannot reach localhost, so you run the plugin’s bridge locally and expose it through a tunnel. This bridge is a small Node server bundled with the plugin, separate from the Claude Desktop bridge.

Open a terminal and change into the plugin folder, for example wp-content/plugins/w7s-mcp/.
The first time only, install dependencies with npm install. This needs Node.js installed on your computer already.
Set your endpoint and key, then start the bridge. It listens on port 3333. Leave this window open.

On macOS or Linux:

export W7S_MCP_URL="https://yourstore.local/wp-json/woocommerce/mcp"
export W7S_MCP_API_KEY="ck_yourkey:cs_yoursecret"
npm run chatgpt

On Windows (PowerShell):

$env:W7S_MCP_URL="https://yourstore.local/wp-json/woocommerce/mcp"; $env:W7S_MCP_API_KEY="ck_yourkey:cs_yoursecret"; npm run chatgpt

In a second terminal, expose port 3333 with a tunnel. With ngrok installed and authenticated, run ngrok http 3333 and copy the HTTPS URL it shows, for example https://abc123.ngrok-free.app.
Stop the bridge in the first terminal with Ctrl+C, then start it again with BASE_URL set to your tunnel URL so the schema points at the public address:

export W7S_MCP_URL="https://yourstore.local/wp-json/woocommerce/mcp"
export W7S_MCP_API_KEY="ck_yourkey:cs_yoursecret"
export BASE_URL="https://abc123.ngrok-free.app"
npm run chatgpt

In ChatGPT, import the schema from your tunnel URL and set the header name to X-MCP-API-Key as in the public-site steps.

The tunnel URL changes each time you restart ngrok on the free plan, so you will re-import the schema when it changes.

Connect another AI service

↑ Back to top

You are not limited to Claude and ChatGPT. Choose Other AI service in the assistant step and the Connection tab shows three ready-to-copy endpoints that work with any MCP or OpenAPI 3.1 client — Gemini, Grok, Ollama, Cursor, Cline, Continue, Zed, n8n, Zapier, Make, or your own custom integration:

MCP endpoint (Streamable HTTP / JSON-RPC). The WooCommerce MCP endpoint at /wp-json/woocommerce/mcp, for MCP-aware clients such as Cursor, Cline, Continue, Zed, and agent frameworks that support remote MCP servers.
MCP over SSE (Claude-compatible). The SSE endpoint at /wp-json/w7s-mcp/v1/claude/sse. Once you create an API key, the tab shows a connector URL with a revocable token, ready to paste into any SSE-compatible client that cannot send custom headers.
OpenAPI 3.1 schema. The schema at /wp-json/w7s-mcp/v1/chatgpt/openapi.json, with a revocable token in the URL for the import step — ready to import into Grok, ChatGPT GPTs, n8n, Zapier, Make, Postman, or Open WebUI.

For authentication, send your WooCommerce API key as the header X-MCP-API-Key: ck_xxx:cs_xxx. The schema and connector URLs carry a revocable token (not your key) so you can share them with an import step safely. Passing ?api_key=ck_xxx:cs_xxx as a query parameter still works but exposes your key in the URL, so prefer the header.

The same rules apply as everywhere else. Only enabled tool packs are exposed, and the key’s read or write scope is enforced on every call.

Verify and troubleshoot

↑ Back to top

The Connection tab has a verify control for the active assistant and a Verify site readiness check that confirms the basics before you connect. Start there if something is not working.

Common issues:

No tools appear, or the server shows as failed in Claude Desktop after a manual setup. The bridge is running on Node.js older than 22. Set command to the full path of Node 22’s npx, as described in the manual setup steps. The one-click bundle does not have this problem, so consider switching to it.
A 404 rest_no_route error. The WP_API_URL is set to your site root instead of the full endpoint. It must end in /wp-json/woocommerce/mcp.
A local connection is refused over HTTPS. The certificate is being rejected. On a local site, add the insecure transport filter and, for a manual setup, NODE_TLS_REJECT_UNAUTHORIZED, as in the local Claude steps. Never do this on a public store.
The connection seems to hold resources for a while. That is expected. The SSE stream keeps an open connection and a PHP worker for the length of a session, up to about an hour. On constrained shared hosting, account for this when sizing PHP workers.
A token or bundle was exposed. Revoke the API key behind it from the Manage API Keys list on the Connection tab — that clears the stored credential and token and stops the connector immediately. Then create a new key and reconnect. Deactivating the plugin also clears the stored credential.

Tool Packs settings

↑ Back to top

A tool pack is a group of related abilities, such as everything to do with orders or everything to do with products. The Tool Packs tab lists the available packs and abilities, each with a toggle, plus a select all/deselect all control in the header for bulk changes.

Only enabled packs are exposed to AI clients. This is the main control for deciding what an assistant can and cannot touch. A disabled pack is invisible to the assistant, and the restriction is enforced when a tool runs, not just hidden from the tool list, so a disabled pack cannot be called even if an assistant knows its name.

Tools you have added from other plugins through the Add tools tab also appear here, listed with the plugin they come from, so everything an assistant can reach is visible in one place. Their toggles are managed on the Add tools tab.

If ChatGPT is your assistant, keep an eye on the enabled count: ChatGPT can use at most 30 tools, and the tab shows a notice with the current count. When more than 30 are enabled, only the top 30 are used.

Add tools

↑ Back to top

Other plugins can offer extra tools for your assistant — for example, a subscriptions plugin offering subscription tools. The Add tools tab is where you find and manage them. Anything you add appears in Tool Packs and becomes available to the assistant. The tab is shown only while the MCP connector is enabled.

Find tools from other plugins. Select Find tools and the plugin scans your active plugins for extra tools the assistant can use. Discovered tools are listed under Available to add, grouped by the plugin they come from, each with an Add button.

Your added tools. Tools you have added are listed with an enable toggle and a remove control, grouped by their source plugin.

Unavailable tools. If a plugin that provided tools is deactivated or removed, its tools are flagged with an Unavailable badge and are no longer sent to the assistant. Reactivate the plugin to use them again, or clear them all at once with the Remove unavailable tools button.

Store Control

↑ Back to top

Store Control is a chat window built into the WordPress Admin dashboard (WP Admin), so you can run MCP tools without leaving your store. Open it with the floating button in the corner of any admin page, or by typing // in an admin input field. It is handy for testing that your tools work and for quick day-to-day tasks.

The Store Control tab holds its settings:

Enable Store Control. Turns the in-admin chat on or off.

Show the floating Store Control button. Choose whether the corner button appears on admin pages. When the button is hidden, the // shortcut still opens Store Control.

AI provider. Store Control calls out to an AI provider on your behalf, so it needs its own provider key — separate from the API keys that connect Claude Desktop or ChatGPT to your store. Choose Claude (Anthropic) or ChatGPT (OpenAI), then supply a key directly or, on WordPress 7.0 or higher, use a key stored site-wide in WordPress Connectors.

Model. Pick the model Store Control uses. For Claude: Claude Sonnet 4.6 (recommended), Claude Opus 4.8 (most capable), or Claude Haiku 4.5 (fastest). For ChatGPT: GPT-5.5 (recommended), GPT-5.4, or GPT-5.4 mini (faster).

Tool permissions. Choose how much you want to approve before the AI runs an action: ask before every action; auto-approve everyday actions but ask before major changes such as deletes, refunds, and bulk edits; or auto-approve everything. Full auto-approve asks you to type a confirmation before it can be enabled.

Save your choices with the Save changes button. The Tool Packs and key scope rules still apply, so Store Control sees exactly the same abilities you have enabled everywhere else.

Logs

↑ Back to top

When action logging is enabled on the Connection tab, the Logs tab shows a record of MCP tool calls: the date, the action, and the user or API key behind it. You can clear the whole log with Clear all, and you control how long entries are kept before they are removed automatically. On small screens, the log rows collapse into stacked cards so they stay readable.

Logged arguments can contain customer data, so the plugin redacts personally identifiable information (PII) by default. Fields such as emails, addresses, and phone numbers are masked before anything is written. You can adjust redaction and retention, or turn logging off entirely, from the Connection tab.

The Logs tab only appears when logging is enabled.

What the assistant can do

↑ Back to top

Once connected, and depending on which packs you enable and which WooCommerce extensions you run, an assistant can work with:

Orders – list, create, update, and delete orders, run order actions, and manage order notes.
Products – list, create, update, and delete products, plus variations, attributes, categories, tags, shipping classes, custom fields, and reviews.
Customers – list, create, update, and delete customers.
Coupons – list, create, update, and delete, when WooCommerce coupons are enabled.
Refunds – create and manage refunds.
Tax – manage tax rates and tax classes.
Shipping – manage shipping zones and methods.
Payments – view and adjust payment gateway settings.
Webhooks – list, create, update, and delete webhooks.
Reports and Analytics – read WooCommerce reports and Analytics report types.
Emails – view and change email settings.
System status – read store environment and system status.

Some abilities need the matching WooCommerce extension installed and active, including WooCommerce Subscriptions, WooCommerce Bookings, WooCommerce Memberships, Product Brands, and Cost of Goods Sold. Other plugins can also offer tools of their own, which you add from the Add tools tab.

Use cases

↑ Back to top

These are real situations a store runs into, and the setup in MCP for WooCommerce that handles each one. Every scenario uses abilities the plugin actually ships. Read them as practical recipes. Pick the few that match how you work and start there.

A note on safety before the scenarios. Two controls do the heavy lifting in almost every setup below. The first is the permission scope on your API key. A read key cannot write, and that is enforced when a tool runs, not just hidden from the assistant’s tool list. The second is Tool Packs. Only the packs you enable are exposed, and a disabled pack will not run even if the assistant tries to call it. You can expand any pack to see its individual abilities and switch off the ones you do not want, so you can keep list, get, and update on while turning delete off. Most of the safety in these scenarios comes from those two settings.

Answer the daily questions without touching anything

↑ Back to top

You start the morning wanting numbers. How many orders shipped yesterday. What sold best this week. Which products are about to run out of stock. You do not want to click through five admin screens, and you definitely do not want a tired 7am mistake changing live data.

Set up a read-only assistant. Create an API key with read permission, then enable the Orders, Products, and Reports and Analytics packs. Leave everything else off. Now you can ask in plain English and get an answer pulled straight from the store. The Analytics pack returns summaries, not just rows, so “what was net revenue last month” or “show me my top ten products by sales” comes back as a total, not a spreadsheet you have to add up yourself.

The read key is the point. Even if you phrase something as a command, the assistant cannot change an order, edit a product, or refund a payment. The key is blocked from every write operation the moment a tool runs. You get the answers and none of the risk.

Close the month without exporting a single CSV

↑ Back to top

Month-end means revenue, tax collected, refunds, and margin. The usual routine is exporting reports, opening them in a spreadsheet, and reconciling by hand. It takes an afternoon and it is easy to fumble a number.

A read key with the Reports and Analytics pack covers most of this. Ask for the revenue summary for the period, the tax summary, and the refund totals, and you get the aggregates back directly. If you run WooCommerce Cost of Goods Sold, the COGS abilities let you ask for margin on a product or an order, so “what was my gross margin on orders last month” is a question you can answer in chat instead of a formula you have to build.

Keep this assistant read-only. Nothing here needs to write, and a read key means your accountant or bookkeeper can use it without any chance of changing the books while they look at them.

Make a hundred catalog changes for a client and keep the receipts

↑ Back to top

You run an agency. A client wants a seasonal price change across a category, new tags on a product line, and a batch of variations updated before a launch. Doing it by hand in WP Admin is slow and error-prone, and when the client asks what changed, you want a clear answer.

Create a read/write key and enable the Products pack. The plugin ships batch abilities for products, variations, attribute terms, categories, tags, and more, so bulk work that would take an hour of clicking becomes a few instructions. Add the Tax or Shipping pack only if the job touches them. Leave Customers and Orders off, so the assistant stays inside the catalog and cannot wander into a customer record by accident.

Keep action logging on for this one. Every change the assistant makes is recorded, with the time and the key that made it. When the client asks what you did, you have the record. Customer fields in the log are masked by default, so the audit trail does not become a second copy of their data.

Give support the tools to fix things, but not to break them

↑ Back to top

Your support lead wants the assistant to pull up an order, read its history, add a note, and handle a refund when one is due. What they do not want is a junior agent, or the assistant itself, deleting an order during a busy shift.

This is where per-ability control earns its place. Use a write key and enable the Orders pack, then switch off the delete abilities while leaving list, get, update, and order notes on. Add the Refunds pack if your team handles refunds. The result is an assistant that can look up “find the order for this customer’s last purchase,” add an internal note, and process a refund, but cannot remove anything. This is the case where whole packs are too blunt and switching off individual abilities is exactly what you need.

Action logging gives you the rest of the comfort. You can see which tools ran and when, so a refund issued at the wrong time is a question you can answer rather than a mystery.

Set up a sale, or a whole new store section, by talking it through

↑ Back to top

You are launching a promotion next week. That means a coupon, maybe a new shipping zone for a region you are expanding into, the right tax rate for it, and a couple of order emails turned on or off for the campaign. Each of those lives on a different settings screen.

MCP for WooCommerce exposes the configuration side of WooCommerce, not just the data. With a read/write key and the relevant tool packs enabled, you can create a coupon with its restrictions and expiry, add a shipping zone and a method, create a tax rate for a new region, and enable or disable specific transactional emails by ID. You describe what the sale needs and the assistant sets it up across those screens in one go.

Because Tool Packs gate everything, you decide how far this reaches. Enable Coupons, Shipping, and Tax for the launch and leave the rest off, and the assistant can build the promotion without being able to touch products or customers.

Stay on top of a subscriptions business

↑ Back to top

You run recurring billing with WooCommerce Subscriptions. The questions that matter are different from a one-off store. Which subscriptions are on hold. Whose renewal just failed. What a particular customer is paying and when their next payment lands.

When WooCommerce Subscriptions is active, its pack appears automatically and the assistant can list and filter subscriptions, read a single one, add a subscription note, and look up the orders tied to a renewal. So “show me subscriptions that failed to renew this week” or “add a note to this subscription that the customer asked to pause” become plain questions. The same extension-aware behavior applies to Bookings and Memberships. The packs only show up when the extension is installed, so you never see tools for features your store does not run.

Match the key to the work. A read key is enough for monitoring renewals. Use a write key only if you want the assistant to add notes or make changes.

Run the assistant inside WP Admin with no desktop app

↑ Back to top

Not everyone wants to install and configure a desktop client. Sometimes you just want to ask a question while you are already in the dashboard.

The plugin includes Store Control, an in-admin chat. Type // on any admin page, or use the floating button, and a chat opens right inside WP Admin. It runs the same MCP tools locally using your own Claude or OpenAI key, so the person at the keyboard can ask about orders or update a product without leaving the page they are on and without a separate app to set up. It is the fastest way to get a non-technical team member using the assistant, because there is nothing to connect. If the floating button gets in the way, hide it from the Store Control tab — the // shortcut keeps working.

The Tool Packs and key scope rules still apply, so Store Control sees exactly the same abilities you have enabled everywhere else, and its permission modes let you decide whether it asks before running actions or only before major changes.

Troubleshooting

↑ Back to top

This section covers problems that show up once the plugin is installed and an assistant is connected. If you are still trying to connect, or the assistant cannot reach your store at all, see Verify and troubleshoot in the Connection section first, since those are connection-specific.

A tool or a whole pack is missing from the assistant

↑ Back to top

The most common reason is that the pack is switched off. Only enabled packs are exposed, so open Tool Packs and confirm the pack you expect is on. If it is on and you only want some of its abilities, check that the specific ability’s toggle is still on.

If a whole feature never appears in the list, the plugin is hiding it on purpose because the feature it depends on is not active. Packs only register when their requirement is met:

Coupons appear only when Enable coupons is turned on in WooCommerce > Settings > General.
Product Brands appear only when a brand taxonomy exists, which usually means the Brands feature or a brands plugin is active.
Cost of Goods Sold abilities appear only when the Cost of Goods Sold feature is enabled.
Analytics reports appear only when the Analytics feature is enabled.
Product custom field tools require WooCommerce 9.2 or higher.
Subscriptions, Bookings, and Memberships tools require the matching WooCommerce extension installed and active.

Turn on the underlying feature or extension, then reload the Tool Packs tab and the pack will be there.

If you are using ChatGPT, remember its 30-tool limit: when more than 30 tools are enabled, only the top 30 reach ChatGPT, so a tool can be enabled and still not show up there. Trim the enabled set on the Tool Packs tab.

An added tool shows as Unavailable

↑ Back to top

Tools you added from another plugin stop working when that plugin is deactivated or removed. On the Add tools tab they are flagged with an Unavailable badge, their toggles are disabled, and they are no longer sent to the assistant. Reactivate the source plugin to bring them back, or select Remove unavailable tools to clear them all at once.

The assistant changed nothing, or reports a read-only key

↑ Back to top

If a request to create, update, or delete comes back refused, the API key is almost certainly a read key. A read key can run searches, lists, and lookups, but it is blocked from every write the moment a tool runs. Create a new key with write or read/write permission on the Connection tab and connect the assistant with that one.

If a write still fails with a write-capable API key, check the user the key belongs to. That user must have the manage_woocommerce capability. A key tied to a user without it cannot use the tools at all.

Nothing works, and no tools show up anywhere

↑ Back to top

Two switches turn the whole integration off.

First, the connector itself. On the Connection tab, confirm Enable connector is on. When it is off, no tools and no keys are exposed to any assistant, and the Tool Packs, Add tools, Store Control, and Logs tabs are hidden until it is switched back on.

Second, WooCommerce MCP. The plugin turns this on when you activate it, but if it has since been switched off, MCP for WooCommerce shows a notice with a link to switch it back on. Follow that link, then reconnect.

How do I disconnect an assistant?

↑ Back to top

Delete the API key the assistant uses from the Manage API Keys list on the Connection tab. The key stops working immediately: a Claude.ai connector or ChatGPT import that relied on it loses access, and the stored connector credential and token are cleared. For Claude Desktop, also remove the connector from Claude’s settings, since the app-side entry does not remove itself.

The Logs tab is missing

↑ Back to top

The Logs tab only appears when action logging is enabled. Turn logging on under the Connection tab and the Logs tab returns.

Store Control will not open or answer

↑ Back to top

Store Control needs its own AI provider key, separate from the API keys that connect Claude Desktop or ChatGPT. Those keys let an outside assistant reach your store. Store Control is the reverse: it calls out to Claude or OpenAI on your behalf, so it needs a provider key to do that.

Open the Store Control tab, choose a provider, and supply a key, either from WordPress Connectors or entered directly. Until a provider key is in place, the chat window can open but cannot reply.

Also check that Store Control is enabled on its tab. And if the floating button is missing, it may simply be hidden — the Show the floating Store Control button setting controls it, and the // shortcut opens Store Control either way.

The standard WooCommerce Save button is gone on these screens

↑ Back to top

Also expected. Each MCP tab has its own Save control, so the shared WooCommerce Save changes button is hidden under WooCommerce > Settings > MCP. Use the Save button inside the tab you are editing. If a change did not stick, check that you saved within that specific tab.

On a large store, tools are slow or time out

↑ Back to top

The plugin already trims responses for remote clients. It sends a compact tool list so clients set up faster, and it caps how many records a single list call can return so a request does not pull your entire catalog at once. If a question still feels slow, ask for a narrower result, for example a date range or a status filter, rather than everything at once.

Keep in mind that a Claude or ChatGPT session holds an open connection and a PHP worker for up to about an hour. On constrained shared hosting, a few simultaneous sessions can use up your available workers, which looks like slowness or dropped connections. Account for this when sizing PHP workers.

When you are stuck, turn on logging and reproduce

↑ Back to top

The fastest way to see what an assistant actually did is the action log. Enable action logging on the Connection tab, repeat the action that failed, then open the Logs tab. Each entry shows the tool that ran, the key or user behind it, the time, and whether it succeeded. That tells you whether a call reached your store and what it tried to do, which is usually enough to pinpoint the cause. Customer fields in the log are masked by default, so turning logging on to debug does not expose personal data.

FAQ

↑ Back to top

Does this work with WooCommerce High Performance Order Storage (HPOS)?

↑ Back to top

Yes.

Do I have to keep WooCommerce MCP turned on?

↑ Back to top

Yes. MCP for WooCommerce enables it on activation. If it gets switched off, the plugin shows a notice with a link to enable it again, because the integration depends on it.

Where do API keys come from?

↑ Back to top

They are standard WooCommerce REST API keys (a consumer key and secret). The plugin uses the key’s existing permission, so a read key cannot make changes. Create keys from the Connection tab.

How do I disconnect an assistant or revoke access?

↑ Back to top

Delete the API key that backs the connection from the Manage API Keys list on the Connection tab. The key stops working immediately, and for the Claude.ai connector this also clears the stored token and credential. There is no separate Disconnect button — the key is the connection.

Can I connect something other than Claude or ChatGPT?

↑ Back to top

Yes. Choose Other AI service on the Connection tab to get the MCP endpoint, an SSE connector URL, and an OpenAPI 3.1 schema URL that work with clients such as Cursor, Cline, Continue, Zed, n8n, Zapier, Make, Ollama, Gemini, and Grok.

An assistant is trying to use a tool I did not enable. What happens?

↑ Back to top

Nothing runs. Disabled tool packs are enforced when a tool is called, not merely hidden, so a tool from a disabled pack cannot execute even if the assistant requests it by name.

What happens to added tools if I deactivate the plugin that provides them?

↑ Back to top

They are flagged as Unavailable on the Add tools tab and are no longer sent to the assistant. Reactivate the plugin to restore them, or remove them all with one click.

Will logging store my customers’ personal details?

↑ Back to top

Not by default. PII redaction is on out of the box, so emails, addresses, phone numbers, and similar fields are masked before the log is written. You can change this on the Connection tab.

My Claude connection seems to hold resources for a while. Is that expected?

↑ Back to top

Yes. A Claude session keeps an open connection, and a PHP worker, for up to about an hour. On limited shared hosting, factor that into your PHP worker count.

Developer documentation

↑ Back to top

This section is for developers extending or customizing MCP for WooCommerce. Hooks are listed by their exact name; read the referenced source for arguments and timing.

Master switch

↑ Back to top

w7s_mcp_connector_enabled (filter) is the master switch returned by W7S_MCP::is_connector_enabled(). When it resolves to false, no MCP tools and no ChatGPT or keys APIs are exposed. It defaults to the stored connector option. Source: includes/class-w7s-mcp.php.

Registering tool packs and tools

↑ Back to top

Two action hooks let other plugins contribute to the registry:

w7s_mcp_register_tool_packs fires when tool packs are collected. Source: includes/class-w7s-mcp-tool-packs.php.
w7s_mcp_tools_register fires when individual tools are registered. Source: includes/class-w7s-mcp-tools-registry.php.

A tool implementation can also short-circuit execution through the w7s_mcp_execute_tool filter. Returning a non-null value from this filter supplies the tool result directly and skips the default handling. It receives the tool name and its arguments. Source: includes/class-w7s-mcp-tools-registry.php.

API key permission scope

↑ Back to top

Read-only key enforcement relies on two classifiers, both filterable, in includes/class-w7s-mcp-ability-helper.php:

w7s_mcp_is_write_operation decides whether a given ability or tool name counts as a write. The plugin classifies by name (write verbs such as create, update, delete, batch; read verbs such as get, list, search). Anything unrecognized defaults to write, so an unknown tool cannot be run by a read-only key. Use this filter to correct the classification for a custom tool.
w7s_mcp_is_destructive_ability overrides whether an ability is treated as destructive. The plugin first trusts an explicit destructive declaration from the Abilities API, then falls back to name heuristics.

Write allowlists and upload guardrails

↑ Back to top

Writes through the WordPress tools are restricted to allowlists, all filterable, in includes/class-w7s-mcp-wordpress-tools.php:

w7s_mcp_writable_option_keys controls which options may be written.
w7s_mcp_writable_post_fields controls which post fields may be written.
w7s_mcp_allowed_protected_post_meta allows specific protected meta keys (defaults to _thumbnail_id).
w7s_mcp_max_upload_bytes caps the maximum upload size in bytes.

Action log and PII redaction

↑ Back to top

The action log records MCP tool calls and masks PII before storage. w7s_mcp_log_pii_arg_keys (filter) adjusts which argument keys are redacted, so you can add custom checkout meta or remove a default. Source: includes/class-w7s-mcp-action-log.php. The log is viewable under the Logs tab, and retention is configurable on the Connection tab.

Logging for troubleshooting

↑ Back to top

The plugin writes to its action log at numerous points during tool execution. When diagnosing an issue, enable action logging on the Connection tab and reproduce the call, then review the Logs tab for the action, the key or user, and the timestamp.

Related Products

Let customers subscribe to your products or services and pay on a weekly, monthly or annual basis.

Offer add-ons like gift wrapping, special messages or other special options for your products.

30-day money-back guarantee

Support teams across the world

Safe and secure online payments