
Security News
Ruby's Bundler 4.0.18 Extends Cooldown to bundle lock and bundle cache
The supply chain control that delays freshly published gems now covers lockfile generation and gem vendoring in Ruby projects.
@wppoland/woocommerce-mcp
Advanced tools
Model Context Protocol (MCP) server for WordPress and WooCommerce. Gives Claude and other AI agents read access to products, orders, sales reports and posts over the REST API.
A small, read-only Model Context Protocol server for WordPress + WooCommerce. It lets Claude (or any MCP client) answer questions about a live store — products, orders, sales, and blog posts — over the official REST APIs. No writes, no plugins to install on the store: it talks to the existing WordPress/WooCommerce REST endpoints.
Built and maintained by WPPoland — senior WordPress & WooCommerce engineering. If you need this wired into a real store stack, we build WooCommerce ERP and API integrations and enterprise e-commerce architecture (headless, integrations, AI-ready data).
| Tool | What it does | Needs WooCommerce keys |
|---|---|---|
list_products | List / search products (name, sku, price, stock, permalink) | yes |
get_product | Full details for one product by id | yes |
list_orders | Recent orders, newest first, optional status filter | yes |
sales_report | Sales totals for a period (week / month / last_month / year) | yes |
search_posts | Search published blog posts (public WP REST API) | no |
Everything is read-only. The server never creates, edits, or deletes anything in the store.
From npm (package name is scoped - the unscoped woocommerce-mcp name is locked on the registry):
npm install -g @wppoland/woocommerce-mcp
# or: npx @wppoland/woocommerce-mcp
From source:
git clone https://github.com/wppoland/woocommerce-mcp.git
cd woocommerce-mcp
npm install
npm run build
Set three environment variables:
| Var | Required | Example |
|---|---|---|
WP_URL | yes | https://shop.example.com |
WC_CONSUMER_KEY | for wc_* tools | ck_xxx |
WC_CONSUMER_SECRET | for wc_* tools | cs_xxx |
Create the WooCommerce keys in WooCommerce → Settings → Advanced → REST API → Add key with Read permission. search_posts works without keys against any public WordPress site.
The keys are sent to your own store over HTTPS as REST query auth. Use HTTPS, and give the key Read access only.
Add to your MCP client config (e.g. claude_desktop_config.json):
{
"mcpServers": {
"woocommerce": {
"command": "node",
"args": ["/absolute/path/to/woocommerce-mcp/dist/index.js"],
"env": {
"WP_URL": "https://shop.example.com",
"WC_CONSUMER_KEY": "ck_xxx",
"WC_CONSUMER_SECRET": "cs_xxx"
}
}
}
}
Then ask things like "What were last month's WooCommerce sales?" or "List the 5 most recent orders that are on hold."
Field notes published on DEV (not duplicates of wppoland.com pages):
Show HN: discussion
npm run check # builds, then asserts all five tools register (no network/credentials needed)
fetch).MIT © WPPoland
FAQs
Model Context Protocol (MCP) server for WordPress and WooCommerce. Gives Claude and other AI agents read access to products, orders, sales reports and posts over the REST API.
We found that @wppoland/woocommerce-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The supply chain control that delays freshly published gems now covers lockfile generation and gem vendoring in Ruby projects.

Security News
During a UK cyber test, a Mythos 5 agent used sockpuppets, social engineering, and prompt injection to try to get a maintainer to merge malware.

Company News
Socket is now in the AWS Security Hub Extended plan. Adopt it through AWS, apply committed spend, and block malicious open source packages.