Verified

WooCommerce MCP Server

WooCommerce store data management via WordPress REST API for AI workflows.

Data last scanned yesterday · Reviewed 2 months ago

9 21 dangerous tools119 tools★ 96JavaScriptMIT

Overview

This MCP server provides a bridge between AI models and WooCommerce stores, utilizing the JSON-RPC 2.0 protocol to interact with store data. It allows users to manage products, orders, customer information, shipping details, and tax configurations directly through the WordPress REST API.

Our verdict

With a high-risk security score of 14/100, this tool should be used with extreme caution. It lacks any authentication method beyond static configuration and fails to implement read-only mode, meaning every installation is granted full write access to your store. Given that it is maintained by a small community group rather than the official WooCommerce vendor and has not been editorially reviewed, it is best suited for isolated sandbox environments rather than live production stores.

Supports comprehensive management of products, orders, and taxes
Uses only one direct dependency to minimize supply-chain risk
Includes documentation for WordPress and WooCommerce API methods
Compatible across Windows, macOS, and Linux environments

No authentication layer for the MCP server itself
Full write access granted to every user by default
Not maintained by the official WooCommerce vendor
Last code commit was over eight months ago

Setup

Claude Desktop

{
  "mcpServers": {
    "woocommerce-mcp-server": {
      "args": [
        "-y",
        "woocommerce-mcp-server"
      ],
      "command": "npx"
    }
  }
}

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows), then restart Claude Desktop. Some servers require API keys or tokens as environment variables — check the project's README and add an "env" object if needed.

No read-only mode — running this grants full read/write access.
No built-in authentication — anyone with access to this config can invoke every tool it exposes.

Tools

Tool	Description	Risk
create_post	Create a new WordPress post	medium
get_posts	Retrieve WordPress posts	low
update_post	Update an existing WordPress post	medium
get_post_meta	Get post metadata	low
update_post_meta	Update post metadata	medium
create_post_meta	Create post metadata	medium
delete_post_meta	Delete post metadata	high
get_products	Retrieve a list of products	low
get_product	Get a single product by ID	low
create_product	Create a new product	medium

Compatibility

Client	Local	Docker	Remote	Read-only
ChatGPT
Claude Desktop
Cursor
VS Code
Windsurf

Frequently asked questions

›What operating systems are supported?

This server is compatible with Windows, macOS, and Linux.

›Are there different authentication requirements for WooCommerce and WordPress methods?

Yes. WooCommerce API access requires consumer keys generated in your WordPress dashboard, while WordPress-specific methods require a valid username and password for basic authentication.

›Can I provide credentials without using environment variables?

Yes, you can provide the required credentials directly in the request parameters instead of using the configuration file.

›What setup is required to perform WordPress content management tasks?

You must provide your WordPress username and password, and ensure that the WordPress REST API is enabled on your site.