WooCommerce MCP Setup Generator

Generate a least-privilege client config to connect a WooCommerce store to Claude, Cursor or another MCP client.

Your details

Connection

Client config format

Store URL

WordPress username

Application password (a placeholder, swap it after you copy this)

Server name in the config

Your MCP client config

{
  "mcpServers": {
    "woocommerce_store": {
      "command": "npx",
      "args": [
        "-y",
        "@automattic/mcp-wordpress-remote@latest"
      ],
      "env": {
        "WP_API_URL": "https://example.com/wp-json/mcp/mcp-adapter-default-server",
        "WP_API_USERNAME": "mcp-agent",
        "WP_API_PASSWORD": "xxxx xxxx xxxx xxxx xxxx xxxx"
      }
    }
  }
}

WooCommerce's MCP integration is a developer preview behind a feature flag: wp option update woocommerce_feature_mcp_integration_enabled yes. Confirm the current setup steps at developer.woocommerce.com/docs/features/mcp before relying on this.

Application Passwords inherit everything the account can do, there's no separate read-only scope. Create a dedicated WordPress user with only the role you're comfortable an AI agent having, then generate its Application Password under Users → Profile → Application Passwords.

Needs HTTPS and pretty permalinks (not "Plain") on the store.

Everything above runs in your browser. Nothing you type here, including keys or passwords, is sent to this site or saved in the page's address.

This is an early feature

WooCommerce's MCP integration is a developer preview as of this review, sitting behind a feature flag. The endpoint, setup steps and available tools can change before it's fully released, so treat this generator as a starting point and confirm the current steps on WooCommerce's own developer docs before you rely on it.

Local vs. remote connections

Remote (HTTP): your MCP client connects to https://yourstore.com/wp-json/mcp/mcp-adapter-default-server using a WordPress Application Password. This is the setup for a store hosted somewhere else, or a hosted client like Claude Desktop.
Local (WP-CLI): for a WordPress install running on the same machine as your MCP client, it launches the connection through wp mcp-adapter serve instead.

Application Passwords inherit everything the account can do, there's no separate scoped, read-only token. The closest thing to least privilege here is a dedicated WordPress user with the lowest role that can still do the job, not a broadly capable admin account.

Questions people ask

Is this officially supported by WooCommerce?

It's part of WooCommerce's own developer preview for MCP, but previews can change. Check developer.woocommerce.com/docs/features/mcp for the current state before depending on it.

Can I limit an AI agent to read-only access?

Only by giving it a WordPress user whose role can't write (or by not creating products/orders yourself with that account). WordPress Application Passwords don't support per-scope permissions the way some APIs do.

Do I need a special plugin for this?

It's built on WooCommerce's own MCP integration and WordPress's Application Passwords feature, both need enabling and neither needs a separate plugin as of this preview.

What does the feature flag command do?

wp option update woocommerce_feature_mcp_integration_enabled yes turns the integration on via WP-CLI. There's no admin toggle for it yet as of this preview.

Last reviewed 30 September 2026.

Sources: WooCommerce Developer Docs: MCP Integration