woocommerce-mcp tool explorer

A Model Context Protocol server for running one or more WooCommerce stores through the WooCommerce REST API (GitHub · Docs · npm · Docker Hub · MCP Registry).

An MCP server runs next to your MCP client and talks to your store, so it does not run on this page. This page lists every tool, prompt, and resource that the server exposes, with the exact input schemas it reports over tools/list, and builds the JSON-RPC requests a client would send.

Stores are read-only until you allow writes. Write tools then return a preview of the exact REST request and apply it only when called again with confirm: true; dryRun: true always previews. Each preview carries a previewId, a fingerprint of the tool, store, and arguments; pass it back with the confirm call and the server refuses the write with preview_mismatch if the arguments no longer match the preview. When a write is computed from store data, such as a percentage price change, the preview lists the records it read under preconditions with before and after values, and the previewId also fingerprints that data: if it changed before the confirm, the write is refused with stale_preview and nothing is sent, so ask for a fresh preview. Every tool takes an optional store id when several stores are configured.

Signed approvals (0.6.0, optional). With WOOCOMMERCE_APPROVAL_SECRET set, write tools also take an approval input: a short-lived, single-use token that a person signs for the exact previewId, tool, and store after reviewing the preview, for example with woocommerce-mcp approve <previewId>. The agent never holds the secret, so it cannot approve its own writes. Refusals: approval_required (no token or no previewId), approval_invalid (bad signature or format, or a lifetime over the limit), approval_expired, approval_mismatch (signed for another previewId, tool, or store), and approval_replayed (already used). This catalog was captured with signed approvals on, so the approval field is listed; without the secret the server does not list it and behaves as in 0.5.0.

Node.js 20 or newer for npm, or Docker. Create a REST API key under WooCommerce > Settings > Advanced > REST API: a Read key while the store is read-only, and a Read/Write key only when you enable writes.

MCP client config (npx, stdio)

Most MCP hosts accept an mcpServers map like this. Keep secrets in env, never in args.

{
  "mcpServers": {
    "woocommerce": {
      "command": "npx",
      "args": ["-y", "@sadrmanesh/woocommerce-mcp"],
      "env": {
        "WOOCOMMERCE_URL": "https://store.example.com",
        "WOOCOMMERCE_CONSUMER_KEY": "ck_your_consumer_key",
        "WOOCOMMERCE_CONSUMER_SECRET": "cs_your_consumer_secret"
      }
    }
  }
}

npm

npm install -g @sadrmanesh/woocommerce-mcp
WOOCOMMERCE_URL=https://store.example.com \
WOOCOMMERCE_CONSUMER_KEY=ck_... \
WOOCOMMERCE_CONSUMER_SECRET=cs_... \
woocommerce-mcp

Signed approvals (optional)

Set the secret only where the server runs, never in a client config the agent can read. A person approves each preview out of band and passes the printed token to the agent as approval.

# server side
WOOCOMMERCE_APPROVAL_SECRET="$(openssl rand -base64 32)"
WOOCOMMERCE_AUDIT_LOG=./woocommerce-mcp-audit.jsonl

# approver, on a host the agent cannot reach
woocommerce-mcp approve pv_e2a742fe51c807fc_a3510d17b8a51b93 --by "Naser"

Docker Hub

docker run --rm -i -e MCP_TRANSPORT=stdio \
  -e WOOCOMMERCE_URL -e WOOCOMMERCE_CONSUMER_KEY -e WOOCOMMERCE_CONSUMER_SECRET \
  sadrmanesh/woocommerce-mcp:VERSION

GitHub Container Registry

docker run --rm -i -e MCP_TRANSPORT=stdio \
  -e WOOCOMMERCE_URL -e WOOCOMMERCE_CONSUMER_KEY -e WOOCOMMERCE_CONSUMER_SECRET \
  ghcr.io/sadrmanesh/woocommerce-mcp:VERSION

Docker as an MCP client command

{
  "mcpServers": {
    "woocommerce": {
      "command": "docker",
      "args": ["run", "--rm", "-i", "-e", "MCP_TRANSPORT=stdio",
               "-e", "WOOCOMMERCE_URL", "-e", "WOOCOMMERCE_CONSUMER_KEY", "-e", "WOOCOMMERCE_CONSUMER_SECRET",
               "sadrmanesh/woocommerce-mcp:VERSION"],
      "env": {
        "WOOCOMMERCE_URL": "https://store.example.com",
        "WOOCOMMERCE_CONSUMER_KEY": "ck_your_consumer_key",
        "WOOCOMMERCE_CONSUMER_SECRET": "cs_your_consumer_secret"
      }
    }
  }
}

Remote server over streamable HTTP

MCP_TRANSPORT=http MCP_HTTP_AUTH_TOKENS="$(openssl rand -base64 32)" woocommerce-mcp

{
  "mcpServers": {
    "woocommerce": {
      "type": "http",
      "url": "https://mcp.example.com/mcp",
      "headers": { "Authorization": "Bearer <token>" }
    }
  }
}

Without authentication the HTTP endpoint only binds to loopback. Multi-store setups, OAuth, PII redaction, tool allow and deny lists, webhooks, and OpenTelemetry are covered in the configuration guide.