MCP for WooCommerce

MCP for WooCommerce turns your store into a read-only Model Context Protocol (MCP) server. AI assistants such as Claude, ChatGPT, Cursor or VS Code can connect to it and answer questions about your catalogue, using the same information a shop visitor already sees on your storefront. This is a community-developed plugin. It is not an official WooCommerce or WordPress plugin and is not affiliated with Automattic. What AI assistants can read

• Products – published products, prices, sale prices, stock status, variations, images and product links
• Catalogue structure – categories, tags, brands and attributes
• Reviews – approved product reviews (the reviewer's name, never their e-mail address)
• Shipping and taxes – shipping zones, enabled shipping methods and their costs, tax classes and rates
• Payment methods – the payment methods offered at checkout
• Posts and pages – published WordPress posts and pages
• Smart product search – natural-language search that understands price ranges, brands, categories and attributes

What it never does

• It never creates, changes or deletes anything. Every tool is read-only.
• It never signs in as a WordPress user and has no administrator access.
• It never returns orders, customers, users, e-mail addresses, settings, or draft, private or password-protected content.

How access works The MCP endpoint is public while MCP is enabled, the same way the WooCommerce Store API and the public WordPress REST API are. Because it only returns storefront information, no account or token is needed. You can switch the whole endpoint off, or turn individual tools off, from the settings page. What is MCP? The Model Context Protocol is an open standard that lets AI assistants call tools and read data from external systems. This plugin is an MCP server: it describes your store's read-only tools so an AI assistant can use them. Use cases

• A shopping assistant or AI chatbot that recommends products and links straight to them
• Answering customer questions about products, shipping and payment options
• Exploring your catalogue in Claude, ChatGPT, Cursor or VS Code

Requirements

• WordPress 6.4 or higher
• PHP 8.0 or higher
• WooCommerce

1.3.0

• The MCP endpoint is now public and strictly read-only, and it only returns storefront information: published products, catalogue structure, approved reviews, shipping, tax and payment options, and published posts and pages
• Removed JWT and OAuth authentication. The plugin no longer issues tokens or signs in as a WordPress user
• SECURITY: Posts and pages tools no longer accept a status filter, so draft, private and password-protected content can no longer be requested
• SECURITY: Reviews no longer include the reviewer's e-mail address, and posts and pages no longer include the author's login or e-mail address
• SECURITY: Products that are not published or are hidden from the catalogue are no longer returned
• Payment and shipping tools return only what checkout shows, not gateway or shipping method settings
• Removed the system status tool, the OpenAPI document, and unused code for tools that were never registered
• The plugin no longer generates a proxy script in the uploads directory; an existing one is deleted on update
• Removed the firebase/php-jwt dependency

1.2.5

• Confirm compatibility with WordPress 7.1

1.2.4

• Confirm compatibility with WordPress 7.0
• Correct the Contributors field to a valid WordPress.org username, and remove a Screenshots section that had no matching assets
• SECURITY: The OAuth authorization form submission accepted any client_id and redirect_uri without validation, so a crafted form could capture an authorization code on an attacker-controlled host. Both are now validated against the registered client before credentials are processed.
• Harden the tax rate query so every SQL placeholder is visible to static analysis, and cache results in the object cache
• Serve /.well-known/oauth-authorization-server with a 200 status instead of 404, and stop writing a static copy into the web root on activation
• Pass the WordPress.org Plugin Check with zero errors and zero warnings
• Remove set_time_limit() and ini_set() calls, and delete unused proxy code
• Move client-setup.md into documentation/ and drop the command-line proxy script from the distributed package

1.2.3

• Fix Streamable HTTP transport writing HTTP chunk framing into the JSON body, which made every JSON-RPC response unparseable for spec-compliant MCP clients (issue #5)
• Responses are now a single complete application/json body with a correct Content-Length; the plugin no longer sets Transfer-Encoding or Connection headers
• Fix Mcp-Session-Id header being silently dropped for batches of more than 5 messages
• Notification-only requests now return an empty 202 body instead of stray framing bytes
• Remove references to a decommissioned demo host from the setup docs; mcp-proxy.php now takes the endpoint URL as an argument instead of hard-coding one

1.2.2

• Fix "Unable to generate new token" error when jwt-authentication-for-wp-rest-api plugin is active (issue #3)
• Move all JWT auth REST routes from jwt-auth/v1/* to plugin-specific mcpfowo/v1/auth/* namespace to avoid collisions
• Update OAuth discovery endpoint URLs to the new namespace

1.2.1

• Added OAuth 2.0 Authorization Code Flow with PKCE support
• Implemented dynamic client registration for MCP clients
• Added custom authorization form for seamless OAuth flow
• Enhanced JWT authentication to accept tokens with or without Bearer prefix
• Automatic OAuth discovery endpoint creation on plugin activation
• Added activation/deactivation hooks for automated setup
• Improved Claude Code compatibility with OAuth-compliant error responses
• Token endpoint now returns OAuth-standard response format (access_token, token_type)

1.2.0

• Enhanced JWT authentication system
• Improved security and token management
• Better MCP client compatibility

1.1.9

• Fix missing build files in WordPress.org distribution
• Ensure React admin UI loads correctly after installation

1.1.8

• Apply WordPress.org review requirements
• Improve boolean settings storage consistency
• Resolve admin UI rendering issues
• Update documentation for WordPress.org submission

1.1.7

• Rebranded as community plugin independent from Automattic
• Updated author information to Filip Dvoran only
• Updated all repository links to community GitHub repo
• Added community plugin disclaimers throughout documentation
• Clarified plugin independence in all descriptions

1.1.6

• Enhanced build scripts with version auto-detection
• Improved stable tag handling in readme

1.1.5

• Enhanced intelligent search capabilities
• Improved JWT authentication handling
• Added comprehensive documentation
• Better error handling and logging
• Updated MCP protocol compatibility

1.1.4

• Added streamable HTTP transport
• Enhanced WooCommerce integration
• Improved security measures
• Better plugin compatibility

1.1.3

• Added product search and filtering
• Enhanced order management tools
• Improved resource documentation
• Bug fixes and performance improvements

1.1.2

• Initial WooCommerce MCP server implementation
• JWT authentication system
• STDIO transport support
• Basic tools and resources

1.1.1

• Beta release with core MCP functionality

1.1.0

• Initial alpha release