Turn your WooCommerce store into a secure MCP server for AI assistants — scoped, revocable API tokens included
Counterhand MCP for WooCommerce
以下摘录自该仓库的 README(片段) · 在 GitHub 读完整 README →
Turn a WooCommerce store into a secure MCP server, so Claude, ChatGPT, Cursor,
VS Code and Claude Code can read and manage products, orders, customers and
reports — behind OAuth 2.1 browser consent, per-connection scopes and an audit
log. Free, GPL, self-hosted.
Website: · Plugin directory:
Install
From wp-admin: Plugins → Add New → search "Counterhand MCP" → Install → Activate.
Or with WP-CLI:
WooCommerce ≥ 8.0, WordPress ≥ 6.5, PHP ≥ 8.2. For cloud assistants (Claude,
ChatGPT) the store must be reachable over HTTPS from the internet; Cursor, VS
Code and Claude Code connect from your machine and work with a local site.
What you get
- **An MCP endpoint at /mcp** with OAuth 2.1 + PKCE and CIMD client identity —
no tokens to copy, no client secrets, no manual registration.
- **Consent per connection.** The assistant asks for scopes; you narrow them on a
consent screen in your browser. Write never implies read. One click revokes.
- **127 tools in 16 switchable groups** — products, orders, customers, coupons,
reviews, variations, refunds, reports, shipping, tax, posts and pages, plus
store settings, payment gateways and maintenance behind an Advanced heading
that is off by default. A fresh install exposes Products, Orders and Reports,
read-only.
- **Schemas derived from WooCommerce at runtime**, not copied: tools delegate to
WooCommerce's own REST controllers and run its permission callbacks, so a
shop manager and an administrator see different tools without this plugin
keeping a capability list.
- **Confirmation-gated risky writes**, credential fields that are never
writable, irreversible maintenance routines refused outright, custom-field
keys for roles and sessions blocked in both directions.
- **An in-admin chat** that uses the same tools — through WordPress 7.0's AI
connectors, or with your own Anthropic / OpenAI / Gemini / Ollama key.
- **An opt-in action log** with PII masked before storage.
How it differs from WooCommerce's built-in MCP
WooCommerce ≥ 10.3 ships an experimental, feature-flagged MCP server exposing a
handful of product and order abilities, authenticated with REST API keys.
Counterhand fills what a self-hosted store still lacks: OAuth 2.1 consent
instead of copied keys, the whole wc/v3 and wp/v2 surface, scoped and revocable
connections, confirmation gates, an audit log and the chat. Both can run side by