SDX AI Readiness Toolkit for WooCommerce

No. WooCommerce 10.7+ ships internal ACP infrastructure with the agentic_checkout feature flag (default off). Our Coexistence detector activates our endpoints only when the WC native flag is off, and defers (410 + Location header) when on.

Only for ACP payment_intent flow. Without Stripe, agents can still discover, browse, and create checkout sessions — they just can't authorize payment through ACP directly. There are two flow models to choose from, and most stores can start without Stripe entirely:

• Model A — Agent pays directly (ACP payment_intent): Requires Stripe. The ACP protocol uses Stripe's PaymentIntent under the hood, so you must define AGTC_STRIPE_SECRET_KEY in wp-config.php. The agent never sees the customer's card; payment is captured server-side at session completion. This is the fully autonomous flow.
• Model B — Agent creates order, customer pays later: Works with any WooCommerce payment gateway — PayPal, Square, Stripe via WooCommerce Payments, bank transfer, cash on delivery, anything you already have configured. The agent creates an ACP session, which the plugin converts into a standard pending WooCommerce order. The customer receives an order link and completes payment using whatever gateway your store already uses.
• Recommendation: Most stores should start with Model B (no Stripe required) and add Model A later if and when they want fully autonomous agent purchases without a human checkout step.

By default, public product data only (name, price, description, images). An agent can additionally read its own orders if it holds the read:orders scope — but only orders it created itself through the ACP checkout flow. Agents never see other agents' orders or orders placed by human customers through normal checkout.

Order access is scoped to ownership and safe by default: an agent (OAuth client) can only ever read orders it created itself via the ACP checkout flow. It can never read another agent's orders or orders placed by human customers through normal checkout. To read its own orders, an agent must request the read:orders scope at registration; dynamic client registration only ever grants read:products by default, so read:orders must always be requested explicitly. No server-side opt-in or wp-config.php constant is required.

Yes. Client secrets are hashed with password_hash(). Access tokens are RS256-signed JWTs with iat, exp (max 2h), aud, iss, and jti claims. Admin endpoints require WP nonce + manage_woocommerce.

Open the AI Readiness dashboard. If JWKS rotation is needed, click the "Rotate JWKS keypair now" button. Old key remains valid for a 24h grace period.

On WordPress 7.0 this plugin registers its tools as WordPress Abilities, making them available through the core MCP Adapter to clients such as Claude Desktop, Claude Code, Cursor, and VS Code. Those clients authenticate with standard WordPress application passwords — no OAuth setup is required on their side. The plugin's own OAuth MCP server remains active alongside the core adapter and continues to serve headless or autonomous agents that manage their own credentials. The AI Readiness dashboard shows a "Protocol exposure" card with two settings: MCP exposure controls which MCP path is active: "both" (default — core adapter and plugin server run side by side), "core" (plugin's own MCP server is disabled, traffic goes to the WP core adapter only), or "plugin" (core adapter integration is disabled, plugin MCP server only). ACP exposure controls ACP checkout availability: "auto" (default — plugin ACP is active when WooCommerce native ACP is off, deferred when on), "plugin" (plugin ACP is always active regardless of WC native state), or "off" (ACP checkout is fully disabled). Both settings can be overridden programmatically with the filters agtc_mcp_exposure_mode and agtc_acp_exposure_mode, which receive the stored option value and should return one of the accepted mode strings.

The plugin publishes a Google-spec product feed at https://yourstore.com/merchant-feed/google.xml. In Google Merchant Center, go to Products → Feeds, add a new feed, and choose the scheduled fetch option pointing at that URL. Google then fetches the feed on its own schedule — the plugin never contacts Google. The feed carries title, description, price, availability, image, and brand/GTIN when set; adding a brand and GTIN to each product improves listing quality and match rate. The dashboard's FEED-001 check flags products missing those attributes.