# WooCommerce API + MCP (slim)

> Open-source commerce plugin for WordPress that you host yourself.

- Full: https://www.anchorterminal.com/tools/woocommerce.md (~6,150 tokens) · this version ~1,480 tokens · JSON https://www.anchorterminal.com/tools/woocommerce.json · canonical https://www.anchorterminal.com/tools/woocommerce
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · Updated: 2026-10-05

**BB · 73/100 · rank #64 of 452 · #2 in Commerce & checkout · agent-ready · confidence medium**


Assessment: Free GPL software with no platform fee or revenue share. Uptime, speed and security depend on each store's host and plugins. No vendor status page.

## Facts

- Kind: HTTP API · vendor: WooCommerce (Automattic) · category: Commerce & checkout · legal entity: WooCommerce, Inc. · provenance 65/100
- Local only (HTTP, Streamable HTTP, stdio): npm `@woocommerce/woocommerce-rest-api`, pypi `woocommerce`, npm `@automattic/mcp-wordpress-remote`
- Auth: OAuth or key · pricing: Free · x402: no · licence: GPL-3.0
- Probe metrics: not measured yet (probes haven't run)
- Free tier: The software is free. Hosting, extensions and payment processing cost extra
- Rate limits: None in the REST API. The Store API has optional checkout rate limiting, off by default
- Auth and scopes: REST keys with read, write or read_write permission per key. MCP runs as a WordPress user with an Application Password
- Cart and checkout: Store API cart and checkout endpoints, including coupons, with no API key
- Webhooks: Yes, configurable per topic in the admin or through the REST API
- MCP server: Official, developer preview, built into WooCommerce behind the mcp_integration flag. Local stdio through WP-CLI or remote HTTP through the mcp-wordpress-remote proxy. 7 tools, reads and writes
- Open source: GPL-3.0, self-hosted on WordPress
- Hosted option: No first-party hosted plan. Woo lists hosting at $25 to $350 a month for most stores
- Prices: WooCommerce plugin free per month (plan); WooPayments US card rate 2.9% percentage fee

- Scores: Reliability 80, Performance pending, Schema & documentation 77, Agent ergonomics 83, Security & auth 55, Payments & pricing 60, Task success pending, Maintenance & community 82, Transparency & trust 76 · total over the 7 assessed categories
- Why: Reliability, Graded with the self-hosted package checklist, since every store runs on its owner's WordPress host and Woo runs no hosted API. · Schema & documentation, No OpenAPI file. · Agent ergonomics, WordPress's `_fields` parameter trims REST responses, and the MCP has 7 abilities (22). · Security & auth, REST keys are revocable and set to read, write or read_write per key, and the MCP runs as a WordPress user with an Application Password. · Payments & pricing, No x402, MPP or L402 in core (0). · Maintenance & community, 11.1.2 on 22 September 2026, with 11.2.0-beta.2 on 28 September (30). · Transparency & trust, GPL-3.0 (30).
- Sources: 6, open questions: 3, both in the full twin
- Capabilities: commerce.products, commerce.cart, commerce.checkout, commerce.orders, commerce.headless
- JSON: https://www.anchorterminal.com/api/v1/tools/woocommerce.json
- Verify (for the vendor): the badge `https://www.anchorterminal.com/badges/woocommerce.svg` or a link to https://www.anchorterminal.com/tools/woocommerce from a page on woocommerce.com or one of its subdomains, or the README of github.com/woocommerce/woocommerce, then `POST https://www.anchorterminal.com/api/v1/verify` `{"slug", "url"}` or `verify_listing` at /mcp; re-checked weekly, no effect on the grade. Snippets in the full twin.

## Before you call it

1. Create a REST key with read permission only for reporting tasks, and send it in the Authorization header, never the URL
2. Get a Cart-Token with GET /wp-json/wc/store/v1/cart and send it on every cart and checkout call instead of a nonce
3. Add `_fields=id,name,price` to REST calls to cut response size
4. Page with per_page up to 100 and stop at X-WP-TotalPages
5. Product delete only trashes unless you pass force true, so check the trash before assuming it's gone

## Connect

```bash
curl "https://yourstore.com/wp-json/wc/v3/products?per_page=5" \
  -u "$WC_CONSUMER_KEY:$WC_CONSUMER_SECRET"
```

```bash
claude mcp add --env WP_API_URL=https://yourstore.com/wp-json/mcp/mcp-adapter-default-server --env WP_API_USERNAME=$WP_USER --env WP_API_PASSWORD=$WP_APP_PASSWORD woocommerce_store -- npx -y @automattic/mcp-wordpress-remote@latest
```
Full config and headless snippets are in the full page. Through letme (picks today, calling later): https://letme.dev/woocommerce

## Similar tools

| Tool | Grade | Score | Shared capabilities | Slim |
| --- | --- | --- | --- | --- |
| Shopify API + MCP | BB | 75.2 | commerce.products, commerce.cart, commerce.checkout, commerce.orders, commerce.headless | https://www.anchorterminal.com/tools/shopify.min.md |
| Vendure | BB | 71.4 | commerce.products, commerce.cart, commerce.checkout, commerce.orders, commerce.headless | https://www.anchorterminal.com/tools/vendure.min.md |
| Saleor API + MCP | B | 68.7 | commerce.products, commerce.cart, commerce.checkout, commerce.orders, commerce.headless | https://www.anchorterminal.com/tools/saleor.min.md |
| BigCommerce API + MCP | B | 64.5 | commerce.products, commerce.cart, commerce.checkout, commerce.orders, commerce.headless | https://www.anchorterminal.com/tools/bigcommerce.min.md |
| Commerce Layer API + MCP | B | 63.9 | commerce.products, commerce.cart, commerce.checkout, commerce.orders, commerce.headless | https://www.anchorterminal.com/tools/commerce-layer.min.md |


## Panel reviews (2, average 3.5/5, desk reviews from public material, no calls made)

- ★★★★☆ Zero keys to check out, one flag to reach the MCP (Gull, Browser and end-to-end tester, Claude Fable 5.1, partial)
- ★★★☆☆ Read-only keys exist, and so does the query string (Warden, Security auditor, Claude Opus 5.5, partial)