Themesic Browser Agent Tools for WooCommerce

This plugin turns your site into a set of structured WebMCP tools that AI agents can discover and call, so an assistant can search your content and browse your catalog through a defined, permissioned interface instead of scraping pages. It serves those tools two ways from one plugin:

• In the browser for WebMCP-capable agents, via document.modelContext (with fallbacks).
• Over REST + OpenAPI at /wp-json/themesic-agent/v1/manifest, /execute and /openapi - for any HTTP agent and for Custom GPT Actions, plus RFC 8288 Link discovery.

Every authorization decision is made server-side. The browser is never trusted. What you get WordPress content tools: get_site_info, get_menu, search, get_post, list_posts, list_categories, list_tags. WooCommerce catalog tools (when WooCommerce is active): get_store_info, search_products, get_product, list_products, get_product_variations, check_product_stock, list_categories. Plus the full engine: the in-browser WebMCP bridge, REST + OpenAPI + discovery, a security gate, per-caller and global rate limiting, an activity log with CSV export, and a request playground - all in the admin. Every tool this plugin registers is a read tool. Nothing in it changes your content, your catalog or an order. Security-first by design

• Every tool is classified read or write. Reads of public content are public; writes always require a same-session nonce.
• Four access tiers - public, browser session, logged in, and a specific capability - and an admin override that can only ever tighten a tool, never loosen it.
• Per-tool and per-group enable/disable from the admin.
• Per-caller and global rate limiting, applied before the authorization decision so rejected calls still cost the caller quota.
• Output is sanitized before it reaches an agent (defense against stored XSS and prompt injection).
• Denied calls are recorded in the activity log, not only successful ones, so an attempt is visible to you.
• No administrator email, usernames, private meta, secrets, or non-public content are ever exposed. Password-protected posts are never returned.

Extensible Register your own tools with a documented PHP API (themesic_agent_register_tools) - no core files need editing. Custom tools get the same security gate, validation, rate limiting and delivery surfaces as the built-in ones. Hooks are also provided for adding REST routes, resolving a caller's identity, narrowing which tools are allowed, and extending the admin screens. Privacy This plugin makes no external calls at all. Every tool runs inside your WordPress install, nothing is sent anywhere on activation or afterwards, and the optional activity log stores recent tool calls with no personal data (and can be cleared or turned off). There is no account, no licence check and no telemetry. A separate paid add-on exists The author also sells a separate commercial plugin that adds write tools (cart, checkout, orders), a server-side MCP endpoint, per-agent API keys and integrations with other plugins. It is a different plugin, sold and distributed from the author's own website. It is not part of this package, in whole or in part. Its code is not here, switched off or otherwise; nothing in this plugin downloads, installs or checks for it; and nothing anyone can buy changes what the files in this package do. Everything described above works on its own and always will.

1. Install via Plugins > Add New and search for the plugin name, or upload the ZIP under Plugins > Add New > Upload Plugin.
2. Activate it. No build step, no Composer, no external setup required.
3. Go to Themesic Agent Tools in the admin menu to review tools, settings, the usage dashboard, and the request playground.

Requirements

• WordPress 6.4 or higher
• PHP 8.1 or higher
• WooCommerce (optional; only needed for the store tools)

0.1.4

• The upgrade card now links to the plan and pricing page instead of the documentation, and says plainly that Pro is a separate plugin.
• Corrected the upgrade card, which advertised CSV export of the activity log as a paid feature. It is part of this plugin.

0.1.3

• This package now contains only the free plugin. The MCP endpoint, per-agent API keys, webhooks, the confirmation step and the write tools are not shipped here and are not switched off here - the code is absent, and the plugin reaches those features through hooks that nothing in this package answers.
• No licensing code and no external requests. The plugin contacts nothing, on activation or afterwards.
• CSV export of the activity log is part of this plugin.
• Rate-limit counters no longer have a check-then-create step, so simultaneous requests cannot undercount.

0.1.2

• Renamed. The plugin is now Themesic Browser Agent Tools for WooCommerce; the previous name was withdrawn at the WordPress.org review team's request.

0.1.1

• Abilities registered through the WordPress Abilities API now carry a permission callback, so they apply the same access checks as the REST endpoints.
• Rate-limit counters are incremented atomically, so simultaneous requests can no longer slip past a limit.

0.1.0

• Initial release: the WebMCP engine; in-browser bridge, REST, OpenAPI and discovery; security gate with rate limiting and output sanitization; admin UI with tools manager, settings, usage dashboard, logs and playground.
• WordPress and WooCommerce read tools.