WooCommerce MCP: Official Preview, Proxy, and API Keys
Yes — WooCommerce has an official MCP integration, and it’s from WooCommerce itself. It first appeared in WooCommerce 10.3 and firmed up over the releases since, exposing your products and orders to AI clients like Claude, Cursor, and VS Code. But two things matter more than the headline: it is still labelled a developer preview, and it is not a hosted connector you click on. There’s no URL to paste. You enable a feature on your own site, run a small proxy on your own machine, and generate your own API keys.
That distinction is the whole story for a store owner. WooCommerce is self-hosted WordPress, so unlike Shopify there is no vendor-run endpoint sitting in the middle — you control the endpoint, and you also own the setup and the security. Here’s what the official MCP does, how the community servers compare, how to generate keys without handing over your whole store, and what to use when you want WooCommerce work that runs on its own.
WooCommerce is one of many — the complete list of MCP servers covers every app that ships one, grouped by category.
What the official WooCommerce MCP does
Model Context Protocol (MCP) is the open standard that lets an AI client talk to an outside app through a shared interface. WooCommerce’s version is built on two WordPress pieces: the Abilities API (in WordPress core as of 6.9) and the MCP Adapter, which translates MCP calls into the WooCommerce REST API operations that already existed. Nothing new is happening underneath — it’s your REST API with a standard doorway bolted onto the front.
The abilities that ship out of the box are deliberately narrow, and they’re all products and orders:
- Products — list with filtering and pagination, get one, create, update, delete.
- Orders — list, get one, create, update.
That covers a lot of the questions a store owner actually asks. “Which products haven’t sold in 60 days?” “Pull up every order from this customer.” “Update the price on this variant.” “Which orders are stuck in processing?” All answered against live store data instead of a CSV export.
What it does not cover, at least in the shipped set, is customers as a first-class object, coupons, subscriptions, or anything an extension added. WooCommerce’s stated expansion path is custom Abilities — plugins register their own, and they show up to the AI. That’s a genuinely good architecture, but it means today’s tool list is short and your extensions probably aren’t in it.
Setting it up: what a store owner is actually signing up for
The honest version of the setup, in order:
- Turn the feature on. In WP Admin, go to WooCommerce → Settings → Advanced → Features and enable the MCP integration. (There’s a WP-CLI equivalent,
wp option update woocommerce_feature_mcp_integration_enabled yes, if your host gives you a terminal.) - Generate REST API credentials. More on this below — it’s the part worth slowing down for.
- Run the local proxy. MCP clients talk to a small proxy tool on your machine, which forwards requests over HTTPS to your store’s MCP endpoint. The proxy’s own README asks for Node.js 22+, though its published package manifest declares support back to Node 18 — so if you’re on an older runtime, expect to test rather than trust either number. This is the step where most non-technical store owners stop, and there’s no shame in stopping there.
Two caveats WooCommerce states itself and you should take seriously. The feature is a developer preview, so “implementation details, APIs, and integration patterns may change in future releases” — there are already two endpoints in flight, with the original WooCommerce-specific one being folded into the shared WordPress MCP adapter. And the docs flag that these operations may expose personally identifiable information — order data includes customer emails, billing and shipping addresses, and payment URLs. Whatever AI client you authorize can read all of it.
Generating your store’s API keys without handing over everything
The credential path is the same one WooCommerce has used for years, and it’s the piece you should get right regardless of which MCP server you end up using.
Go to WooCommerce → Settings → Advanced → REST API and add a key. You’ll pick a user to attach it to, write a description, and — the important field — choose a permission level:
- Read — the AI can query products, orders, and reports and nothing else.
- Read/Write — the AI can also create, update, and delete.
You get a Consumer Key starting with ck_ and a Consumer Secret starting with cs_, shown exactly once. The official MCP endpoint passes them as a single X-MCP-API-Key header in the form ck_...:cs_....
Two rules that will save you a bad week. Start with Read. Almost every “can AI help with my store” question is answered by read access, and a read key that leaks is an embarrassment rather than a catastrophe. Attach the key to a dedicated user, not your admin account, so revoking it later doesn’t mean rotating your own login. There’s a Revoke button next to every key — use it the moment an experiment ends.
The community WooCommerce MCP servers, and the trust question
Search “WooCommerce MCP” and you’ll hit a pile of GitHub projects — techspawn/woocommerce-mcp-server, AmitGurbani/mcp-server-woocommerce, wppoland/woocommerce-mcp (read-only by design), juanlurg/woocommerce-mcp, and more, plus a paid plugin or two on the WooCommerce marketplace. Several predate the official integration and some cover more surface area than it does, because they call the REST API directly rather than going through the Abilities layer.
They are community projects, not WooCommerce products, and the distinction is not academic. Every one of them works by taking your ck_/cs_ pair and using it to act on your store. If the server runs on your own machine, that’s a reasonable trade — you can read the code and the keys never leave your laptop. If it’s a hosted service someone else operates, you are giving a third party standing access to your customer list, order history, and, with a write key, your catalog and prices. There is no scope smaller than what the key grants.
So the sane order of preference: official integration if you can run the proxy, then a self-hosted community server whose source you’ve actually looked at, then a hosted third party only with a read-only key and a clear reason. Anything you connect, connect with the narrowest permission that answers your question.
Where every WooCommerce MCP stops
This isn’t a knock on any particular server — it’s the shape of the protocol, and it’s identical whether you use the official one or a community build.
MCP has no trigger mechanism and no scheduler. Its own Triggers and Events working group opens by conceding that clients learn about server-side changes by polling, and that work is still listed as on the horizon rather than shipped.
For a store, that limit is the whole game. Four things fall out of it:
- It only works inside a chat you open. Close the window and nothing happens. The AI doesn’t watch your store; it waits for you to ask.
- Nothing fires on a store event. A cart abandoned, a payment failing, a refund coming through, stock dropping below your reorder point, a first-time buyer placing an order — none of these can start anything through MCP.
- It’s one app at a time. The WooCommerce MCP knows WooCommerce. Getting an order into your accounting tool, your email platform, and a Slack channel means wiring and authing a separate server for each. The same constraint applies in ChatGPT’s MCP connectors and in Claude — it’s the protocol, not the client.
- You own the plumbing. The feature flag, the proxy, the Node version, the keys, and the blast radius of what those keys can reach are all yours. That’s the price of self-hosting, and it’s the same reason you get to control the endpoint.
Ask your store things: MCP is great. Make your store run: MCP wasn’t built for it.
The five WooCommerce events actually worth acting on
Every store has a short list of moments where money is won or lost, and all five are events — which is precisely the category MCP can’t see:
- Abandoned cart — the highest-value unsent email in e-commerce.
- Failed payment — a renewal or order that silently didn’t go through, found weeks later.
- Refund issued — the moment to tag the customer, log the reason, and decide whether to follow up.
- Low stock — better caught at the threshold than at zero.
- First-time buyer — the one order where a personal follow-up changes lifetime value.
That gap is where Carly fits. Carly connects to WooCommerce natively — no proxy to run, no Node version to manage, no feature flag — and to the ~260 other apps it supports, plus anything with a public API through your own key. The difference from MCP is the important part: Carly’s workflows are triggered and scheduled, so store work happens whether or not anyone has a chat open.
What that looks like in practice:
- When an order’s payment fails → check whether the customer has a prior successful order, draft a recovery email in your voice, and post the order to
#ordersin Slack. - When stock on a tracked product drops below your threshold → open a task with the supplier’s lead time and last order quantity already filled in.
- When a first-time buyer’s order completes → wait three days, then send a personal check-in that references what they actually bought.
- Every Monday morning → summarize last week’s refunds and their stated reasons, and send the pattern to the owner.
The non-AI steps — moving, matching, and routing between apps — are free and unlimited, the Zapier-style backbone of the workflow. The AI steps (drafting, summarizing, deciding) start at $35/month. If you’d rather run the store’s AI work through your own keys, generate the ck_/cs_ pair exactly as above and paste them into Carly at carlyassistant.com/integrations.
If you want to interrogate your catalog from a chat window and you’re comfortable running a proxy, the official WooCommerce MCP is the right tool. If you want your store to react to what happens in it, that’s a different job, and it needs a different tool. For the Shopify side of the same question, the Shopify MCP breakdown covers a hosted-vendor version of this story; for Claude specifically, see connecting Claude to WooCommerce.
FAQ
Does WooCommerce have an official MCP server? Yes. WooCommerce ships a native MCP integration built on the WordPress Abilities API and MCP Adapter, first introduced in WooCommerce 10.3. It’s still labelled a developer preview, and unlike hosted connectors there’s no vendor-hosted URL to paste — you enable the feature on your own site, generate REST API keys, and run a local proxy to connect an MCP client.
What can the WooCommerce MCP actually do? The shipped abilities cover products (list, get, create, update, delete) and orders (list, get, create, update). Customers, coupons, and extension data aren’t in the default set. Plugins can register their own abilities, which is how the tool list is expected to grow.
How do I get a WooCommerce API key for an MCP server?
Go to WooCommerce → Settings → Advanced → REST API and add a key, choosing Read or Read/Write permissions. You get a Consumer Key (ck_) and Consumer Secret (cs_), shown once. Start with Read, attach the key to a dedicated user rather than your admin account, and revoke it when the experiment ends.
Are the community WooCommerce MCP servers safe? They vary, and none of them are WooCommerce products. Each one works by using your consumer key and secret to act on your store, and there’s no scope narrower than what the key grants. A self-hosted server whose source you’ve read is a reasonable risk; handing keys to a hosted third-party service means giving it standing access to your customer and order data.
Can a WooCommerce MCP server notify me about abandoned carts or failed payments? No. MCP has no triggers and no scheduler — it responds inside a chat you open and can’t notice anything on its own. An AI can look up failed payments when you ask, but nothing fires automatically. For event-driven store work like abandoned carts, refunds, or low stock, you need a workflow tool with real triggers rather than an MCP server.
Ready to automate your busywork?
Carly schedules, researches, and briefs you—so you can focus on what matters.
See what people say
"Before Carly, I relied on a Calendly link, but the whole process felt impersonal and not very professional. Carly changed that by handling all the back-and-forth, so I'm no longer stuck in endless email threads trying to line up schedules.
Now Carly reaches out to candidates, shares my real-time availability, lets them pick a slot, then sends a Zoom link and drops it straight into my calendar. She sends reminders to both of us before each call, which has significantly reduced no-shows and last-minute confusion.
On top of scheduling, Carly acts like a full executive assistant, sending me my schedule the night before so I can prepare for each call. It reminds me of the old x.ai assistant, but Carly is noticeably smarter, faster, and better suited to my healthcare recruitment business."
