WooCommerce MCP server: connecting a store to ChatGPT or Claude

Key points

• WooCommerce's MCP integration is a developer preview, and the feature stays off until a site admin turns it on.
• Its tools query products and orders, and also create, update and delete products, change order status and add order notes.
• Both routes sign in as a WordPress user with an application password, so that user's permissions set the limit.
• SAR Intelligence exposes read tools only: products, orders, stock, categories, a sales summary, and published posts and pages.
• You can revoke an application password on its own in WordPress, and revoke an AI app in SAR Intelligence within about a minute.

Two ways WooCommerce reaches an AI app

What WooCommerce ships

WooCommerce includes an MCP (Model Context Protocol) integration that turns store operations into tools an AI app can call. WooCommerce's developer docs call it a developer preview whose APIs may change, and WooCommerce's source marks the feature as experimental and off by default.

It builds on two WordPress pieces. The Abilities API, available from WordPress 6.9, registers distinct units of functionality a site can perform. The MCP Adapter, which WooCommerce bundles and which also exists as a separate plugin, turns abilities marked public into MCP tools. WooCommerce's abilities cover:

• Products: query with filters, create, update and delete
• Orders: query with filters, update status and add notes
• An older WooCommerce MCP endpoint, now deprecated, with REST-based operations that include creating, updating and deleting products

WooCommerce tools that change your store

Several WooCommerce abilities write to the store, and in WooCommerce's source the delete product and update order status abilities are marked as not read-only and destructive. Every operation respects WooCommerce's permission system, so what a tool can do also depends on the WordPress user it runs as.

WooCommerce's docs describe connecting from Claude Desktop, Claude Code, Cursor and VS Code: through WP-CLI for a site on your own computer, or through a Node.js proxy running on your computer for a site on the internet. They advise testing thoroughly before you use it on a live store.

The SAR Intelligence route

SAR Intelligence does a different job: answering questions about the store. ChatGPT or Claude add one hosted address, https://mcp.sar-soft.com/mcp, as a custom connector. SAR then calls the SAR Commerce Connector plugin's tools on your site, using a WordPress application password that it stores encrypted.

The plugin needs WordPress 6.9 or later and the WordPress MCP Adapter plugin. It publishes its own MCP server that lists each tool by name, so SAR never uses a general tool that runs any ability by name. The AI app can read:

• Products with price, SKU and stock, and product categories
• Products running low on stock, measured against the shop's own low-stock setting
• Recent orders and single orders, with status, totals, dates, payment method and line items
• A sales summary: revenue, order count, average order value and best sellers, counted from orders that are processing, completed or on hold
• Published posts and pages with their text, and the plugin's status

What the SAR connection does not read or do

Orders never include the customer's name, address, email or phone. The connection does not read drafts, SEO plugin fields, media, comments, users or settings. The following also applies:

• The plugin's write switches are off by default. If an admin turns one on, SAR still never lists or calls that tool.
• One connection reads one store, inside one organization.
• Answers come from ChatGPT or Claude and can be wrong or incomplete, so check the totals that matter in WooCommerce.

What to check before you approve any WooCommerce MCP server

These checks apply to WooCommerce's own integration, to SAR Intelligence and to any other server that reaches your store:

• The tool list: sort the tools into read and write. Look for create, update, delete and status changes, and for a general tool that runs any ability by name, like the one on the MCP Adapter's default server.
• The WordPress user: requests run as the user behind the application password, so create a dedicated user with only the capabilities the tools need. SAR's shop tools need a user who can manage WooCommerce, view WooCommerce reports or edit shop orders.
• Customer data: find out whether order tools return names, emails, addresses or payment details.
• Where the connection comes from: a Claude custom connector reaches the server from Anthropic's cloud, so the server must be reachable from the internet. A local proxy runs on your own computer.
• Revoking access: you can revoke an application password on its own from the user's profile in WordPress. In SAR Intelligence you can also revoke an AI app in the app, and it takes effect within about a minute.

Questions to try

• What were our best-selling products this month?Sources: WooCommerce
• Show me our most recent orders.Sources: WooCommerce
• Which products are running low on stock?Sources: WooCommerce
• Which products sell best, and how did the people who bought them reach our site?Sources: WooCommerce · Google Analytics

Questions people ask

References

• WooCommerceModel Context Protocol (MCP) Integration
• WooCommerce on GitHubFeatures controller (WooCommerce MCP feature)
• WooCommerce on GitHubDelete product ability
• WordPress on GitHubMCP Adapter
• WordPress Developer BlogFrom abilities to AI agents: introducing the WordPress MCP Adapter
• WordPress Developer ResourcesAbilities API
• AnthropicGetting started with custom connectors using remote MCP