WooCommerce MCP is the connection that lets an AI assistant like Claude or ChatGPT answer questions about your shop and carry out small store chores in plain language. If you sell an ebook, a writing course, or a little merch next to your blog, that can turn real admin time into a chat message.
Here’s the short version. WooCommerce has its own MCP support, free and built by the WooCommerce team, but it covers products and orders only, and it reaches AI apps through a companion plugin from desktop or command-line apps. To run your shop from the claude.ai or ChatGPT web apps, you need a route with its own sign-in (Claude’s limited fixed-header beta aside), which is what the setup below uses.
This article covers what WooCommerce ships, which route fits a small shop, how to connect in three steps, which chores are worth handing over, and where the safety lines sit. Let’s dive in! 🛒
📚 Table of contents:
- What WooCommerce MCP means (and what WooCommerce ships)
- Which route fits a blogger’s shop
- How to connect your store in three steps
- Shop chores worth handing over
- What it can’t do (yet)
- Keeping your shop safe
- The bottom line
What WooCommerce MCP means (and what WooCommerce ships) 📦
🧙 Beginner’s note: MCP, short for Model Context Protocol, is an open standard that lets AI apps use a connected site’s features as tools. WooCommerce MCP is that idea applied to your store: shop data and shop actions become things an AI can read or change, but only with the permissions you grant.
WooCommerce’s own MCP support is real, free and moving quickly, so the details depend on your version. Here’s where things stand:
- On WooCommerce 11.2.1, every install registers seven store abilities (WooCommerce’s name for these actions): query products, create a product, update a product, delete a product, query orders, update an order’s status, and add an order note. There is no WooCommerce setting to switch on for them.
- WooCommerce marks product update, product delete, and order status update as destructive, and deleting a product moves it to the trash unless the caller forces a permanent delete.
- To reach the abilities from an AI app, you add the free MCP Adapter plugin (WordPress 6.9 or newer) and connect with a WordPress Application Password from a desktop or command-line app such as Claude Code or VS Code.
- An older WooCommerce-specific endpoint still ships behind an experimental option called “WooCommerce MCP”, unticked by default, and it signs in with WooCommerce REST API keys. WooCommerce has deprecated it and removes it in 11.3 (in beta since October 26 and scheduled for the week of November 9, 2026), where the MCP Adapter plugin becomes the way in and an ability that lists an order’s notes joins the set, as its developer documentation describes.
- WooCommerce calls the whole feature a developer preview and advises testing on a staging site before production.
The 11.3-style setup also works on WooCommerce 11.2.1: with MCP Adapter active and the old option left off, a scripted check listed the seven WooCommerce abilities plus three core ones.
The old route’s switch sits under Experimental features in the Features section of the Advanced tab in WooCommerce’s Settings, and on WooCommerce 11.2.1 it is unticked out of the box:
Which route fits a blogger’s shop 🧭
Use WooCommerce’s own route when you work in a desktop or command-line app like Claude Code, Cursor, or VS Code, when creating an Application Password sounds fine, and when product and order basics cover your chores. It is free, the store abilities are WooCommerce’s own code (the adapter comes from the WordPress project), and every action runs as the WordPress user you connect with. The trade-offs: no customers, coupons, refunds, or store settings in the current ability set, a preview label, and no way in for the claude.ai and ChatGPT web apps on their own. The MCP Adapter’s own guide says the web versions of Claude and ChatGPT “cannot connect to MCP Adapter on their own today”, because they sign in with OAuth, which the adapter does not provide. (Claude documents a fixed-header option as a limited beta for some organizations, a narrower path this article does not rely on.)
Use a plugin route when you chat with AI in the browser and want more of the shop within reach. The plugin this article sets up is Easy MCP AI, a free WordPress plugin that turns your site into an MCP server with its own OAuth sign-in. Easy MCP AI is built by Themeisle, a sister brand of BloggingPro. Because the sign-in lives on your site, the claude.ai and ChatGPT web apps can connect to it directly, and both are among its documented clients. MCP traffic runs straight between the AI app and your site with no hosted relay, the plugin calls no AI provider, and it works through WooCommerce’s own REST API rather than the MCP Adapter. It holds 30,000+ active installs on WordPress.org.
Other routes exist: the Woo Marketplace sells MCP for WooCommerce by W7S at $39 for a one-year plan, hosted platforms such as Pipedream run a WooCommerce MCP server on their own infrastructure, and developers can self-run a server from GitHub.
One contrast before the setup: if your whole shop is a single ebook, you may not need a shop at all. You can accept card payments in WordPress with Stripe and skip the store layer entirely.
How to connect your store in three steps ⚙️
Three steps, no code. You need a live site on HTTPS (the sign-in requires it) and an administrator account.
Step 1: Install Easy MCP AI and switch on WooCommerce
In wp-admin, open Plugins, then Add New Plugin, search for Easy MCP AI, and install and activate it.
👉 Get Easy MCP AI free from WordPress.org
Then open the Easy MCP AI menu, go to Tools and the Abilities tab, and switch on the WooCommerce group, which starts off. Easy MCP AI’s general REST tools, on by default, can still reach WooCommerce under WooCommerce’s own permission checks even with the group off; switch the WooCommerce REST namespace off under Tools to block that path.
If connecting fails, the Dashboard’s diagnostics check for known problems, such as hosts that strip the sign-in header or firewalls that block the API addresses; one WordPress.org reviewer who found connecting to Claude hard suspected their own firewalls.
Step 2: Connect Claude or ChatGPT
For Claude, the connect card’s “Connect to Claude (1-click)” button opens claude.ai’s “Add custom connector” dialog with your site’s name and address already filled in. Add the connector, then approve access on your own site (the consent button reads “Approve & Continue”). For the full walkthrough, follow the steps for connecting Claude to WordPress.
For ChatGPT, “Connect to ChatGPT” opens ChatGPT’s plugins page. Adding a custom MCP server depends on your ChatGPT plan and workspace settings, and on Business and Enterprise workspaces an admin must allow it. On the plugins page, open Add, choose Add custom MCP server, enter a name and the MCP server URL shown on your Easy MCP AI Dashboard, set Authentication to OAuth, tick “I understand and want to continue”, and click Create as a plugin, then approve access on your site.
Step 3: Choose what the AI may touch
Every tool call runs as the connected WordPress user, with that user’s permission checks, so connect as a user whose role fits the job. On the consent screen, choose Custom and tick only the rows your chores need: WooCommerce read for questions, the WooCommerce write row for product, coupon, and order edits, and the store-setup row, which starts unticked, only when the chore covers store settings, currency, shipping, tax, or payment methods. Store-setup changes also need a user with WooCommerce’s manage capability. Keep REST write unticked unless you need it, because a grant holding it reaches WooCommerce writes too, under WooCommerce’s own checks.
💡 Pro tip: start with WooCommerce read only. To confirm the connection works before you widen anything, ask the AI a read-only store question first, such as the stock prompt below. You can widen the grant later from the Connections screen once the workflow has earned your trust.
Shop chores worth handing over 💬
With a scoped grant in place, these are good chores to try first. Each prompt below is an example to adapt, not a recorded result:
- Example prompt: “Which of my products are low on stock or sold out, and are any of them in orders that are still processing?”
- Example prompt: “Create the coupon READERS10 for 10% off my ebook, valid until the end of the month.”
- Example prompt: “Draft a new product for my ebook at $12, marked virtual and downloadable, and keep it as a draft.”
- Example prompt: “Add a flat-rate shipping method for US orders at $4.95, and switch cash on delivery off.”
- Example prompt: “Order #512 went out with today’s mail, so mark it as completed.”
The ebook product prompt deserves two footnotes. New products are saved as drafts when the AI sends no status, but an AI can still ask to publish, so for a hard guarantee switch on Force draft on create under Settings, Access & safety: Easy MCP AI’s own create tools then keep new products as drafts even when the AI asks to publish (it covers creates, not updates). And when the product is an ebook, attach the file yourself in the product’s Downloadable files box in WooCommerce.
One caveat on store settings: changing the store currency converts no prices, so every product keeps its numbers in the new currency.
If you sell a writing course online through WooCommerce, you can adapt the same example prompts for enrollment products and launch coupons.
What does a chore look like once connected? In a Claude Code session (Claude’s command-line app), a request to mark an order as completed ran straight through, and completing the order made WooCommerce try to send its “Completed order” email to the customer. Reads and simple status changes are quick; deletes are another story, told in the safety section.
What it can’t do (yet)
The dedicated WooCommerce tools have edges worth knowing before you promise the AI a task:
- No dedicated tool creates a refund: the AI can at most mark an order as refunded and list the refunds on an order, and whether the refunded status moves any money is WooCommerce’s behavior, not the plugin’s.
- The payment-method tool switches methods on or off and renames or reorders them, but it never sends gateway credentials, API keys, or modes; set those in WooCommerce’s own payment settings.
- The single-order tool cannot edit an order’s line items, and the order list has no text or email search.
- Sales figures come from WooCommerce’s older report endpoints, not the WooCommerce Analytics screens.
- Deletes through the dedicated tools are permanent, with no trash for products, coupons, customers, or variations, and Change history cannot restore WooCommerce objects.
WooCommerce’s own route is narrower still: its abilities cover products and orders, with nothing for customers or coupons.
Keeping your shop safe 🔒
For deletes and other tools Easy MCP AI marks as destructive, there is an opt-in guard: Ask before destructive actions, under Settings, Access & safety, off by default. With it on, you can make Easy MCP AI ask for your approval before destructive actions such as deletes. In a Claude Code session with the switch on, a request to delete a coupon returned an approval link instead of deleting anything, the coupon survived until a person approved the request on the site, and only then did the same call delete it, permanently. The approval page must be opened by the WordPress user the AI acts as, and each request expires after 15 minutes.
Here’s the approval page that request produced:
Two limits to keep in mind. Order status changes (completed, cancelled and refunded included) and product and coupon edits run without pausing unless you add those tools to Always ask for, so add any store-settings, shipping, tax, or payment-method tools you want guarded there too; the store-setup deletes, batch order updates and REST writes do pause. And the guard has exceptions: Always ask for beats Never ask for, a site’s approval filter has the last word over both lists, and an API key marked Unattended never pauses, though OAuth connections, the route the web apps use, cannot be Unattended.
The Audit log records every MCP tool call while it is on, and it is on by default. In that session it kept the whole episode on record, down to the two “Pending” rows the single paused request produced:
Remember where the data flows: whatever the AI reads is returned to the AI app and processed by that vendor’s model, and Easy MCP AI’s WooCommerce log tools redact secrets but not customer names, emails, or addresses.
One risk deserves its own paragraph. Text the AI reads in a shop, product reviews, order notes, even customer-entered addresses, can carry hidden instructions that steer a model with write access; security researchers call this prompt injection, and it tops the OWASP Top 10 for LLM applications. The mitigations are a scoped grant, a user whose role fits, approvals for deletes, the Audit log, and the Pause AI access switch on the Dashboard, which leaves clients connected but refuses every tool call until you switch it back.
The bottom line 🏁
Both forms of WooCommerce MCP can handle small, low-risk chores today, though WooCommerce still calls its own a developer preview and advises testing on a staging site first. If you chat with Claude or ChatGPT in the browser and run a small shop, the plugin route above is the practical choice: a free plugin (Claude or ChatGPT may cost money on their own), three steps, and scoped to the chores you allow. If you live in a desktop app and need only product and order basics, WooCommerce’s own abilities plus the MCP Adapter cost nothing and stay closer to core. If your entire catalog is one ebook, skip the shop layer and just take card payments.
Whichever route you pick, start read-only and widen permissions only when a chore earns it; with Easy MCP AI, watch the Audit log while you test. And for the selling side, here is how to sell an ebook on your website.
Which shop chore would you hand to Claude or ChatGPT first? Share it in the comments below!
