WooCommerce 11.3 MCP: move your AI assistant before you update

Who the WooCommerce 11.3 MCP change affects

MCP, short for Model Context Protocol, is an open standard that lets AI tools connect to other systems and use the actions those systems offer. WooCommerce previously offered its own MCP endpoint, linked to an MCP feature (mcp_integration) that appeared under WooCommerce > Settings > Advanced > Features, and AI clients signed in to it with a REST API key sent in an X-MCP-API-Key header. WooCommerce had already deprecated that endpoint, and the 11.3 release notes confirm it has now been removed, along with legacy abilities deprecated since version 10.9.

You need to act if an MCP client, such as Claude Desktop, Cursor or a similar tool, points at /wp-json/woocommerce/mcp on your store. If you have never connected an AI assistant this way, the change leaves your store's normal running untouched and there is nothing to migrate. Extension developers form the second affected group, because code that registered abilities for the old endpoint or hooked its filters stops having any effect.

For either group, the work is a planned migration rather than a response to a security advisory, so there is no vulnerability to patch. Expect further movement too: WooCommerce describes its MCP implementation as a developer preview, and its documentation states that implementation details, APIs and integration patterns may change in future releases.

What WooCommerce 11.3 removes and what replaces it

With 11.3, the WooCommerce endpoint, its REST API key sign-in, the Features setting and a set of older abilities modelled on the REST API all go. An ability is a single action a plugin registers with WordPress, such as listing products or updating an order. The removed versions carried names such as woocommerce/products-list and woocommerce/orders-get.

In their place, WooCommerce registers purpose-built product and order abilities with the WordPress Abilities API, part of WordPress core from 7.0, which is the minimum version WooCommerce now requires. They cover querying, creating, updating and deleting products, plus querying orders and order notes, updating order status and adding notes. WooCommerce no longer bundles the connection layer, so the separate MCP Adapter plugin has to be installed and active before any AI client can reach them. Its listing on WordPress.org states that the adapter provides no AI features itself and only exposes abilities that have been marked public.

Stores that had the old feature switched on see an admin notice after updating, linking to the documentation and, when no adapter is loaded, offering to install or activate it. The MCP client's own configuration still has to be changed to the new endpoint, username and Application Password.

Move your AI assistant to the MCP Adapter before updating

Work through these steps before you install 11.3, on a staging copy first if you have one. Take a fresh backup before any plugin change, and use the same checks you would apply to install a WordPress plugin safely. WooCommerce's MCP documentation has client configuration examples for both local and remote sites.

Store the new Application Password somewhere secure and never commit a configuration file containing it to version control. If a developer helps with the setup, the encrypted BugShield Vault keeps site credentials out of email and chat.

1. Install and activate MCP Adapter from Plugins > Add New by searching for MCP Adapter, or run wp plugin install mcp-adapter --activate if you use WP-CLI.
2. Create a dedicated WordPress user for the assistant with only the capabilities it needs. The adapter's default server requires the read capability, and each WooCommerce ability runs its own permission check on top.
3. Signed in as that user, open Users > Profile, enter a name for the client under Application Passwords and click Add New Application Password. Copy the password straight away, because WordPress shows it only once.
4. Confirm the store runs on HTTPS and that Settings > Permalinks uses any structure other than Plain.
5. Point the MCP client at https://yourstore.com/wp-json/mcp/mcp-adapter-default-server with the new username and Application Password. For a remote store, WooCommerce documents the @automattic/mcp-wordpress-remote proxy, configured with WP_API_URL, WP_API_USERNAME and WP_API_PASSWORD.
6. Test the connection, then update WooCommerce to 11.3.
7. Revoke the WooCommerce REST API keys you created for the old endpoint, found under WooCommerce > Settings > Advanced > REST API.

Check the new WooCommerce MCP connection properly

Ask the client to list its tools first. The default server exposes three adapter tools, mcp-adapter-discover-abilities, mcp-adapter-get-ability-info and mcp-adapter-execute-ability, rather than a separate tool for each store action, so a short list is expected. Running the discovery tool on an 11.3 store returns abilities such as woocommerce/products-query and woocommerce/order-notes-query.

A discovery result listing those abilities confirms the client can reach the adapter, yet it says nothing about whether the assistant's access is as narrow as you intended. Check the account's role under Users, and confirm that actions you have not granted are refused. After the update, WooCommerce documents that requests to the old /wp-json/woocommerce/mcp address return HTTP 410 with a JSON-RPC error explaining how to connect through the MCP Adapter.

When an ability you expect is missing, the adapter returns an ability_not_found error, the same response it gives for names that are unknown or not exposed through MCP. Version 0.7.1 of the plugin also added a site-owner guide covering Application Passwords and troubleshooting.

Custom abilities and extensions do not carry over

Some stores relied on extensions or custom code that added their own tools to the old endpoint. Those abilities vanish from the AI client after the move, because the adapter's default server ignores the old inclusion rules and only exposes an ability when its meta.mcp.public value is true (falling back to meta.public when that is not set).

Responsibility for the fix sits with whoever maintains the code. Developers need to register abilities through the WordPress Abilities API with mcp metadata set to public and type tool, remove calls to the retired WooCommerce classes, and check for WP\MCP classes at runtime instead of relying on WooCommerce to load them. If a paid extension supplied an AI feature, ask its vendor whether a release supports the MCP Adapter before you update WooCommerce.

Keep customer data and credentials under control

Order and customer abilities can expose names, email addresses, postal addresses and payment details to whichever AI tool holds the credentials. WooCommerce's documentation places compliance with data protection rules on the store owner, so treat the assistant's account like any staff login with access to customer records.

Application Passwords can be revoked from the user's profile without changing the main password, which keeps clean-up simple. Remove any you no longer use, delete the old REST API keys once the new connection works, and review the assistant's user whenever its job changes. Should the update go badly and the store need rolling back, restore WordPress from a backup using the tool that created it, and check for orders placed since that backup first.