WooCommerce MCP server

What is an MCP server for WooCommerce?

An MCP server for WooCommerce makes your shop’s operations available as standardised tools that an AI agent can call via the Model Context Protocol. Instead of building a separate interface or a Zapier workflow for every report, the model gets uniform access to products, orders, customers and coupons — read and write.

WooCommerce is widespread among German mid-sized companies because it sits on top of WordPress: no separate shop stack, full control over hosting and data, a large plugin ecosystem. It is precisely this WordPress foundation that makes the MCP connection interesting — and, to be honest, also somewhat quirky, more on that in a moment.

Official server, community server — or directly via the API?

Honesty is worth more than marketing here. The situation in October 2026:

• Official MCP integration (developer preview): WooCommerce provides product and order functions as abilities via the WordPress Abilities API. MCP clients connect via the plugin WordPress MCP Adapter at /wp-json/mcp/mcp-adapter-default-server, signed in with a WordPress username and application password. According to WooCommerce, the integration is a developer preview and details may still change (WooCommerce docs). With WooCommerce 11.3 (21 October 2026), the earlier endpoint /wp-json/woocommerce/mcp, including sign-in via REST API key, was removed; it now responds with HTTP 410 (WooCommerce Developer Blog). Where it fits, we rely on this official route.
• Community servers: There are open-source MCP servers from the community that map the REST API more broadly, for example also customers and coupons. Before use, we check the code, maintenance status and permissions of every such server.
• Directly via the REST API v3: If we have special logic, custom validation or particular security requirements, we encapsulate the /wp-json/wc/v3/ endpoints in a custom-built MCP server. Full control, no third-party code dependency.

Which route is right, we decide based on your setup — not the other way round. We never claim that a community tool is “official”, and before productive use we check every server against the raw API spec.

Use cases: what can a WooCommerce MCP server do in practice?

1. Order triage & status handling “Show me all orders in status on-hold since yesterday.” The agent lists them via the Orders object, groups them by cause (payment outstanding, stock missing) and, after approval, sets status or a note.
2. Product maintenance & stock Create new variants, update prices or stock levels, set discontinued products to draft — via the Products operations, also as a batch for whole categories.
3. Coupon campaigns “Create a 10% coupon for new customers, valid until the end of the month, only for baskets of €50 or more.” The agent creates the coupon with the matching restrictions — you review once and activate.
4. Customer & repeat-buyer analysis Identify regular customers, summarise order history, flag B2B contacts with a missing VAT ID — pulled from the Customers object, without export hassle.
5. Revenue & range reporting “Which products performed best last month?” — “Where is the return rate unusual?” The agent condenses order data into an answer, instead of you exporting reports.
6. Bridge to other systems Pass orders on to accounting or the ERP, write tracking numbers from the shipping provider into the order — the agent orchestrates WooCommerce as one building block in the overall process.

An anonymised, realistic sketch (not a specific reference): a DACH mail-order retailer with several thousand SKUs has an agent review the overnight orders each morning, report stock below the threshold and prepare dunning drafts for open prepayment orders — approval stays with the team.

How the integration works

The architecture for a custom MCP server:

AI agent ↔ MCP server (your EU host) ↔ WooCommerce REST API v3 (/wp-json/wc/v3/, consumer key/secret)

Concrete technical steps:

• Generate API keys: In WordPress under WooCommerce → Settings → Advanced → REST API you create a consumer key/secret pair — with the permission level Read or Read/Write, depending on the task.
• Secure authentication: Over HTTPS, the connection runs as basic auth with key/secret; without TLS, OAuth 1.0a (one-legged, HMAC-SHA256) applies. We enforce HTTPS and store the credentials encrypted on the EU host.
• Tool mapping: We define MCP tools such as list_orders, get_order, update_product, create_coupon — each with a JSON schema, validated inputs and clear error messages.
• Read vs. write separation: By default the agent writes only in draft/suggestion form; publishing, cancelling or refunding requires human approval — configurable per tool.
• Logging: Every API action is logged with timestamp, triggering user and diff — important because order and customer data are personal data.

GDPR, hosting & security

WooCommerce runs on your own WordPress — from a data protection point of view that is an advantage, because you choose the hosting location yourself. So that the overall system can be designed to meet data protection requirements, we pay attention to the following with every WooCommerce MCP server:

• EU hosting for the shop and the MCP server (e.g. Hetzner or the Azure region Germany West Central in Frankfurt), no US edge.
• Least-privilege keys with read-only where reading is enough, plus a defined rotation and revoke strategy.
• DPA with the AI provider in EU data residency: Claude via AWS Bedrock (EU region Frankfurt) or Google Vertex AI (EU), OpenAI Enterprise EU, Azure OpenAI in an EU region.
• Data minimisation: The agent sees only the fields it needs for the task — order and customer objects contain names, addresses and sometimes payment details, so no blanket access.
• Separation of test and production, so that experiments never run on real customer data.

What does it cost?

WooCommerce is one of the more straightforward MCP projects, because the REST API is stable and well documented and there are already servers we can build on. In concrete terms:

• First use case clearly defined, then step-by-step expansion — a typical start is order triage or product maintenance.
• Clear scope per use case instead of hours roulette; scaling after that in small, clearly defined steps.

We give a concrete figure in the initial consultation — depending on shop size, the objects you want (orders only, or also products, customers, coupons) and whether the official developer preview or a hardened custom server is used.

Frequently asked questions

Is there an official WooCommerce MCP server?

Yes — WooCommerce offers an official MCP integration via the WordPress Abilities API and the WordPress MCP Adapter plugin, as a developer preview according to WooCommerce. Since WooCommerce 11.3 (21 October 2026), the earlier endpoint /wp-json/woocommerce/mcp has been removed; connection is via /wp-json/mcp/mcp-adapter-default-server with an application password. There are also community servers. Depending on your requirements, we rely on the official integration, a vetted community server or our own encapsulation of the REST API — and tell you transparently what you actually get.

Which interface does the connection use?

That depends on the route. A custom MCP server uses the WooCommerce REST API v3 at /wp-json/wc/v3/, authenticated with consumer key/secret. The official MCP integration runs via the WordPress Abilities API and the WordPress MCP Adapter, signed in with a WordPress username and application password; since WooCommerce 11.3 it no longer accepts REST API keys.

Which objects can the AI agent reach?

Products, orders, customers and coupons — each can be read, created, updated and deleted, also as a batch. The official integration covers products and orders; customers and coupons are added through community or custom servers.

Can the agent cancel or refund orders on its own?

Technically yes. In practice we put such write actions behind an approval step — the agent prepares the change, a human confirms. That protects against costly mistakes and is advisable anyway with personal order data.

Can WooCommerce + MCP be implemented in a GDPR-compliant way?

Yes, provided your shop is hosted in the EU, the MCP server runs in the EU and the AI provider offers EU data residency with a DPA. We work with least-privilege keys and data minimisation, because order and customer objects contain personal data.

Which AI models work?

All MCP-compatible models: Anthropic Claude, OpenAI GPT, Google Gemini, Microsoft Copilot. Switching models does not require a new integration.