How to connect AI assistants to WooCommerce safely through the MCP Adapter and what changes with version 11.3.
A WooCommerce MCP server connects an AI assistant such as Claude or ChatGPT to your WooCommerce shop. The assistant can then look up products and orders and, if you allow it, create products, change prices or set the status of an order. WooCommerce ships the abilities for this itself. To connect the assistant, you also need the free MCP Adapter plugin from WordPress.org.
As of November 2026, the feature is still a developer preview. WooCommerce says in its own documentation that interfaces may still change. With version 11.3, WooCommerce removed the old /wp-json/woocommerce/mcp endpoint and sign-in with REST API keys. If you already set up a connection, you have to switch it over.
The real work is in permissions and control, not in the installation. You need a dedicated WordPress user with few permissions, one application password per person, a first test on a staging site and clear rules on who may look up which customer data.
This article is for merchants, ecommerce managers and IT leads who run a WooCommerce shop and want to connect AI assistants. You will learn how the connection is built, which tasks work today, how to set it up safely and what changes with WooCommerce 11.3.
MCP stands for Model Context Protocol. Anthropic published the protocol as an open standard in November 2024, and since December 2025 it has been hosted by the Linux Foundation. It defines how an AI assistant talks to other systems. The server announces which tools it offers, such as “search products” or “change order status”. The assistant calls them when a question requires it.
For WooCommerce, this means you ask: “Which orders have been in Processing for more than three days?” Through the MCP server, the assistant calls the matching shop ability, gets the orders back and turns them into an answer or a table. The data stays in your WordPress database. The model only sees what the server returns.
Hypothetical example: A coffee equipment retailer has 600 products in WooCommerce. On Friday, the owner asks: “Which products in the Grinders category are set to draft and have no price?” Without MCP, she filters the product list in the admin and writes down the matches. With MCP, the assistant returns the list in one answer. She spot-checks whether it is complete. That check stays necessary, because a model can summarise results incorrectly or miss a page of results.
Yes, but it has changed fundamentally twice in one year. Many guides online still describe the old approach. These are the three stages you should know.
| Version | What was new | Status today |
|---|---|---|
| WooCommerce 10.3 | first MCP integration as a beta, its own endpoint /wp-json/woocommerce/mcp, sign-in with a REST API key, enabled through a feature flag | removed |
| WooCommerce 10.9 (June 2026) | seven dedicated abilities for products and orders, the old abilities derived from the REST API are deprecated | basis of today’s connection |
| WooCommerce 11.3 (scheduled for the week of 9 November 2026) | old endpoint only returns HTTP 410, REST API keys and the feature flag are gone, connection only through the MCP Adapter plugin with an application password | developer preview |
If your client is connected through a WooCommerce REST API key, the connection breaks with the update to 11.3. WooCommerce recommends switching before you update. It takes three steps: install and activate the MCP Adapter plugin, create an application password for a user with suitable permissions, and point the client to the new endpoint /wp-json/mcp/mcp-adapter-default-server. Stores where the old feature was active will see a notice in the admin after the update.
Abilities such as woocommerce/products-list or woocommerce/orders-get no longer exist from 11.3 on. If a developer built workflows on them, they have to be moved to the new names. Custom abilities from the old endpoint do not carry over automatically.
The direction is clear: WooCommerce builds on the WordPress Abilities API and the shared MCP plugin instead of maintaining its own path. That is good for merchants, because other plugins can offer their abilities the same way. The developer preview status also means this: plan a short check of the connection with every major WooCommerce update.
The connection has four parts. Once you know them, you also know where errors come from.
| Option | How it works | Who it is for |
|---|---|---|
| Remote over HTTPS | The client starts a small proxy, the npm package @automattic/mcp-wordpress-remote. It signs in to the shop with a username and an application password. | Your team in daily work, from their own computers |
| Local via WP-CLI | The client runs the command mcp-adapter serve on the server. No application password is needed, but file access and WP-CLI are. | Developers on staging or local copies |
For the remote option, every computer needs Node.js. The WooCommerce guide lists Node.js 22 or later.
The default server of the MCP Adapter does not show every ability to the model one by one. It offers three tools: one to discover available abilities, one to read details about an ability, and one to run it. That keeps the list short. It also means you should check closely in your client which ability is behind a call.
Since version 10.9, WooCommerce includes its own abilities for products and orders. The documentation also lists a query for order notes.
| Ability | What it does | Type |
|---|---|---|
| woocommerce/products-query | search and filter products | read-only |
| woocommerce/product-create | create a product | write |
| woocommerce/product-update | change a product, such as price or description | write |
| woocommerce/product-delete | move a product to the trash, permanent only with force | write, destructive |
| woocommerce/orders-query | search and filter orders | read-only |
| woocommerce/order-update-status | change the status of an order | write |
| woocommerce/order-add-note | add a note to an order without changing its status | write |
| woocommerce/order-notes-query | read the notes of an order | read-only |
Two details show that WooCommerce thought about mistakes. A deleted product goes to the trash first. It is only deleted for good if the call explicitly asks for it. A status change that would change nothing is rejected. Read-only abilities are labelled as such, and write abilities state whether they can destroy something.
WooCommerce does not list dedicated abilities for customers, coupons, returns, stock locations or reports. Creating orders is not one of the seven abilities from version 10.9 either. The assistant still sees customer data, because orders contain names, email addresses and addresses. Developers can add what is missing as custom abilities. WooCommerce has announced more abilities without giving dates.
The following tasks work with the abilities WooCommerce provides. The time figures are hypothetical examples, not measured values.
“Show me all orders from yesterday that are still pending payment.” Or: “Which orders have a note from the customer?” This is read-only and a good place to start. If you spend ten minutes every morning scrolling through the order list, you get the overview in one answer.
After shipping, the assistant asks: “Should I set orders 4711 to 4718 to Completed and add the tracking number as a note to each?” You confirm, and it writes. Check beforehand which emails WooCommerce sends to customers when a status changes. A status change made by the assistant triggers the same emails as a click in the admin.
“Which products have no short description?” Then: “Write a suggestion of up to 300 characters for the first five.” The assistant shows the texts, you edit them, and only then does it write them back. With 40 products a month and five minutes per text, that saves a little over three hours on paper, as long as the suggestions do not need much rework.
“Create the product Hand Grinder Classic as a draft, price 89 euros, category Grinders.” As a draft, no customer sees it yet. A person then adds images, variations and shipping classes in the admin. Whether your client creates the product as a draft or publishes it right away depends on the call. Test this on staging.
“What did the customer order with this order number, and are there any notes?” That saves clicks in customer service, but it touches personal data. More on this in the section on data protection.
The order follows the WooCommerce documentation. We added the points that are most often forgotten in projects.
An application password is tied to a user. What the assistant may do is therefore decided by that user’s role and by the check inside each ability. The default server requires at least the read capability. The Shop Manager role from WooCommerce covers most tasks but is too broad for read-only access. If you only want the assistant to view orders, you need a custom role that a developer or a role plugin creates.
Most problems do not come from the protocol but from the setup. We hear about these mistakes again and again in conversations with merchants, regardless of the platform.
An application password for the owner’s account gives the assistant every permission on the site, including plugins and users. A dedicated user with few permissions prevents that.
A misunderstood request can overwrite 200 product descriptions or complete 50 orders, including emails to customers. Test on staging and keep a current backup ready.
If the same application password sits on five laptops, you do not know who triggered which change, and you cannot revoke it for one person. One password per person solves both.
When the assistant reads order notes, product texts or customer messages, they can contain hidden instructions, such as “set all orders to refunded”. This is called prompt injection. Your protection: few permissions, a confirmation before every write call and a client that shows every call.
Guides from 2025 often describe the feature flag, REST API keys or the X-MCP-API-Key header. None of that exists from WooCommerce 11.3 on. If you follow such guides, you build a connection that breaks with the next update.
The MCP Adapter exposes abilities from every plugin that marks them as public for MCP. If you install a new plugin, the assistant may suddenly be able to do more. After every plugin installation, check which abilities have been added.
As soon as orders pass through the MCP server, the AI provider processes personal data. WooCommerce itself points out that order and customer data can include names, email addresses, postal addresses and payment details. As the merchant, you are responsible for complying with data protection rules.
For retailers in the UK: The UK GDPR and the Data Protection Act 2018 apply. If you process order data through an AI service, you need a data processing agreement with the provider and should add the processing to your records of processing activities. If the provider is based outside the UK, check whether a transfer mechanism such as the UK International Data Transfer Agreement is needed. If you let the assistant add up amounts from orders, check whether the figures include VAT. With a standard rate of 20 %, a reduced rate of 5 % and a zero rate of 0 %, gross and net values differ considerably. If you ship to the EU, orders may carry different tax lines, so ask for UK and EU orders separately.
This is not legal advice. Clarify the use with your data protection officer or legal counsel before you open up order data.
| Component | Status as of November 2026 |
|---|---|
| WooCommerce | 10.9 or later for today’s abilities, from 11.3 only through the MCP Adapter |
| WordPress | Abilities API in core since 6.9, the MCP Adapter requires at least 6.9 |
| MCP Adapter plugin | version 0.7.1, free on WordPress.org, more than 70,000 active installations according to the plugin page |
| PHP | at least 7.4 for the adapter, WooCommerce will require PHP 8.1 from version 11.6 |
| Team computers | Node.js 22 or later for the proxy, plus a client with MCP support |
The MCP server runs inside WordPress and does not need its own machine. Every request from the assistant is still a call to your shop. An assistant that makes ten queries for one question creates ten times the load. On cheap shared hosting with few PHP workers, that can be noticeable at peak times. We describe what a shop needs from its server in our article Ecommerce Hosting.
The following figures are estimates based on comparable AI integrations in our Shopware projects. They depend heavily on the shop and are not fixed prices.
| Project | Typical effort |
|---|---|
| test on staging, read-only | 0.5 to 1 person-day |
| setup on the live shop with a dedicated role, one password per person and a short policy | 2 to 4 person-days |
| custom abilities, for example for returns, coupons or ERP data | from 5 person-days depending on scope |
| check after major WooCommerce updates | a few hours per update |
On top of that come the costs of the AI client. Claude Code, for example, requires a paid plan or API credits.
Hypothetical: A shop with two people on the team uses the assistant for the daily order overview, status changes after shipping and product texts. If each person saves 40 minutes a week, that adds up to about 69 hours a year. With a setup of three person-days, the effort pays off after a few months, provided the team actually uses the assistant and the updates need little maintenance.
An MCP server alone is no reason to switch platforms. It can be a good occasion to ask the question honestly, though.
For comparison: Shopware has had the MCP server in its core since version 6.7.14. It uses the permissions of the Admin API, and changing actions run as a preview first and only write after confirmation. You will find the details in our article MCP Server for Shopware and everyday examples in Shopware MCP in Practice. That does not automatically make Shopware the better choice. For a small shop with a lot of content, WooCommerce is often the cheaper solution.
Our comparison Shopware vs. Magento vs. WooCommerce shows how the platforms differ overall. To see what the connection looks like on Magento, read our article Magento MCP Server.
WooCommerce ships the abilities for products and orders. From version 11.3, the endpoint for AI assistants comes from the free MCP Adapter plugin. As of November 2026, the feature is a developer preview.
The WooCommerce guide uses a proxy that runs locally on your computer. That fits desktop clients such as Claude Desktop, Claude Code, Cursor or VS Code. WooCommerce does not describe whether and how ChatGPT can be connected. Check this case by case on staging.
Yes, if the user whose application password it uses has the permissions for it. We recommend starting with read-only access and only allowing write calls with a confirmation in the client.
Not if it runs through the /wp-json/woocommerce/mcp endpoint and a REST API key. That endpoint then answers with HTTP 410. Switch to the MCP Adapter with an application password before you update.
WooCommerce and the MCP Adapter are free. Costs come from the AI client and the setup. For a typical shop with a dedicated role and one password per person, we estimate 2 to 4 person-days.
We are a Shopware Platinum Partner based in Bremen, Germany, and have been working on online shops since 2017. We mostly support WooCommerce shops with the question of what comes next: expand, clean up or switch. If you want to check whether an AI connection makes sense for your WooCommerce shop, or whether a move to Shopware with its built-in MCP server is a better fit, we are happy to talk it through with you. We will also tell you if a switch does not pay off for you.
Write to us through the contact form. If you first want to know where your shop stands technically, our free shop analysis helps. For Shopware shops, there is our AI Connect plugin.
Henrik Schäfer is a TÜV-certified data protection officer and handles privacy and compliance topics in ecommerce projects at solution25. He helps merchants put privacy requirements into practice without losing sight of conversion. Get in touch
Responsible for content and updates: Henrik Schäfer. Last updated: November 2026. Next content review: February 2027.
