Starting with WooCommerce 11.3, WooCommerce core product and order abilities will be enabled by default, and will require the WordPress MCP Adapter plugin active on your store to establish an MCP connection.
This update will remove the /wp-json/woocommerce/mcp endpoint and legacy abilities that have been deprecated since WooCommerce 10.9.
If your MCP client connects to your store with the deprecated endpoint and a WooCommerce REST API key, you will need to update that connection to use the WordPress MCP Adapter plugin and a WordPress application password before testing or upgrading to 11.3.
Enabling MCP in WooCommerce 11.3
MCP Adapter 0.7.0 is the first release published as a WordPress.org plugin, and it deprecates bundling the adapter as a Composer library. With one shared adapter per site, a separate WooCommerce endpoint with its own authentication and its own set of REST-shaped tools only added configuration and confusion.
The purpose-built WooCommerce abilities replace the REST-derived ones, and the adapter’s default server already exposes them, along with abilities registered by other plugins on your site. We’re also working on bringing more abilities to Woo core and our extensions to round out the type of actions and tools available for humans and agents working with WooCommerce.
What’s removed
- The
/wp-json/woocommerce/mcpendpoint and its WooCommerce REST API key authentication (theX-MCP-API-Keyheader). Requests to it now return HTTP 410 with a JSON-RPC error that explains how to connect through the MCP Adapter. - The WooCommerce MCP feature (
mcp_integration) under WooCommerce > Settings > Advanced > Features.FeaturesUtil::feature_is_enabled( 'mcp_integration' )now always returnsfalse. - The REST-derived abilities that only the deprecated endpoint used:
woocommerce/products-list,woocommerce/products-get,woocommerce/products-create,woocommerce/products-update,woocommerce/products-delete,woocommerce/orders-list,woocommerce/orders-get,woocommerce/orders-create, andwoocommerce/orders-update. - Filters that only applied to the deprecated endpoint:
woocommerce_mcp_include_ability,woocommerce_mcp_allow_insecure_transport, andwoocommerce_check_rest_ability_permissions_for_method. Callbacks attached to them no longer run. Theexpose_in_deprecated_woocommerce_mcpability metadata is no longer read. - Bundled packages:
wordpress/mcp-adapterandwordpress/abilities-api. The Abilities API is part of WordPress core as of WordPress 7.0, WooCommerce’s minimum version. The MCP Adapter project has deprecated the package in favor of the canonical plugin (which is built from the same repo).
How can developers tell if they are affected?
You are affected if any of these apply:
- An MCP client connects to
/wp-json/woocommerce/mcpwith a WooCommerce REST API key. - Your extension registers abilities that it expected to appear in the WooCommerce MCP endpoint, through the
woocommerce/namespace,expose_in_deprecated_woocommerce_mcp, or thewoocommerce_mcp_include_abilityfilter. - Your code hooks into
woocommerce_mcp_include_ability,woocommerce_mcp_allow_insecure_transport, orwoocommerce_check_rest_ability_permissions_for_method. - Your code uses
WP\MCP\*classes and relies on WooCommerce to load them. - Your code calls
MCPAdapterProvider,WooCommerceRestTransport,AbilitiesRestBridge, orRestAbilityFactory, or one of the removed REST-derived ability IDs listed above.
What action do developers need to take if affected?
Merchants and MCP client users
If you connected an AI assistant to /wp-json/woocommerce/mcp:
- Install and activate the MCP Adapter plugin, for example with
wp plugin install mcp-adapter --activate. - Create a WordPress application password for a user with only the capabilities the client needs.
- Point your MCP client at
/wp-json/mcp/mcp-adapter-default-serverwith that username and application password, instead of the WooCommerce endpoint and REST API key.
The WooCommerce MCP documentation has client configuration examples. Stores that had the WooCommerce MCP feature enabled see an admin notice after updating. It links to the documentation and, when no MCP adapter is loaded, to Install MCP Adapter (which opens the official plugin’s details) or Activate MCP Adapter if the plugin is already installed. The notice goes away for every admin once someone dismisses it or activates the plugin from it. You can revoke the WooCommerce REST API keys you created for the old endpoint.
Extension developers
- Register abilities through the WordPress Abilities API and add
mcpmetadata ('mcp' => array( 'public' => true, 'type' => 'tool' )) so the MCP Adapter exposes them. Custom abilities that appeared in the removed endpoint don’t carry over: before 10.9 it included abilities in thewoocommerce/namespace, from 10.9 those withexpose_in_deprecated_woocommerce_mcpset totrue, and thewoocommerce_mcp_include_abilityfilter could change either. None of these affect the MCP Adapter’s default server, which only exposes abilities whosemeta.mcp.publicistrue(falling back to the top-levelmeta.public). - Don’t rely on WooCommerce for MCP Adapter classes. If your extension uses
WP\MCP\*classes, check for them at runtime (see below), or addRequires Plugins: mcp-adapterif your extension can’t work without MCP. - Removed internal classes don’t fatal.
MCPAdapterProvider,WooCommerceRestTransport,AbilitiesRestBridge, andRestAbilityFactorystill exist, but their methods do nothing except trigger a “called incorrectly” notice with migration guidance. Remove any calls to them.WooCommerceRestTransportno longer extends the MCP adapter’sHttpTransport, so code that type-hints orinstanceof-checksHttpTransportwon’t accept it, and passing it to the adapter’screate_server()fails. Use the adapter’s ownHttpTransportwith application passwords, or your own transport.
if ( class_exists( 'WP\MCP\Core\McpAdapter' ) ) {
// Register your MCP server or tools.
}
Leave a Reply